Microsoft (R) Windows Debugger Version 10.0.10586.567 AMD64Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\122915-20872-01.dmp]Mini Kernel Dump File: Only registers and stack trace are available

Symbol search path is: srv*Executable search path is: Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64Product: WinNt, suite: TerminalServer SingleUserTSBuilt by: 7601.17514.amd64fre.win7sp1_rtm.101119-1850Machine Name:Kernel base = 0xfffff800`02c11000 PsLoadedModuleList = 0xfffff800`02e56e90Debug session time: Tue Dec 29 18:51:40.491 2015 (UTC + 7:00)System Uptime: 0 days 20:18:23.818Loading Kernel Symbols.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.Run !sym noisy before .reload to track down problems loading symbols.

..............................................................

................................................................

....................................Loading User SymbolsLoading unloaded module list.........******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {7, 1097, 4090006, fffffa80076ea890}

GetPointerFromAddress: unable to read from fffff80002ec20e8Unable to get MmSystemRangeStartGetPointerFromAddress: unable to read from fffff80002ec20e8Unable to get MmSystemRangeStartProbably caused by : Unknown_Image ( ANALYSIS_INCONCLUSIVE )

Followup: MachineOwner---------

0: kd> !analyze -v******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************

BAD_POOL_CALLER (c2)The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.Arguments:

Arg1: 0000000000000007, Attempt to free pool which was already freedArg2: 0000000000001097, (reserved)Arg3: 0000000004090006, Memory contents of the pool blockArg4: fffffa80076ea890, Address of the block of pool being deallocated

Debugging Details:------------------

GetPointerFromAddress: unable to read from fffff80002ec20e8Unable to get MmSystemRangeStartGetPointerFromAddress: unable to read from fffff80002ec20e8Unable to get MmSystemRangeStart

DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 7601.17514.amd64fre.win7sp1_rtm.101119-1850

SYSTEM_MANUFACTURER: TOSHIBA

SYSTEM_PRODUCT_NAME: Satellite C40-A

SYSTEM_SKU: PSCD8Q

SYSTEM_VERSION: PSCD8Q-002001

BIOS_VENDOR: Insyde Corp.

BIOS_VERSION: 1.00

BIOS_DATE: 04/30/2013

BASEBOARD_MANUFACTURER: Type2 - Board Vendor Name1

BASEBOARD_PRODUCT: Type2 - Board Product Name1

BASEBOARD_VERSION: Type2 - Board Version

DUMP_TYPE: 2

BUGCHECK_P1: 7

BUGCHECK_P2: 1097

BUGCHECK_P3: 4090006

BUGCHECK_P4: fffffa80076ea890

POOL_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec20e8Unable to get MmSystemRangeStart fffffa80076ea890

BUGCHECK_STR: 0xc2_7

CPU_COUNT: 4

CPU_MHZ: 9be

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3a

CPU_STEPPING: 9

CPU_MICROCODE: 6,3a,9,0 (F,M,S,R) SIG: 17'00000000 (cache) 17'00000000 (init)

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

CURRENT_IRQL: 2

ANALYSIS_SESSION_HOST: ISTIQOMAHI7

ANALYSIS_SESSION_TIME: 12-29-2015 22:26:23.0956

ANALYSIS_VERSION: 10.0.10586.567 amd64fre

BAD_STACK_POINTER: 0000000000000000

IP_IN_FREE_BLOCK: 0

LAST_CONTROL_TRANSFER: from 0000000000000000 to 0000000000000000

STACK_TEXT: 00000000`00000000 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0

STACK_COMMAND: kb

SYMBOL_NAME: ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

IMAGE_VERSION:

BUCKET_ID: INVALID_KERNEL_CONTEXT_0xc2_7

DEFAULT_BUCKET_ID: INVALID_KERNEL_CONTEXT_0xc2_7

PRIMARY_PROBLEM_CLASS: INVALID_KERNEL_CONTEXT

FAILURE_BUCKET_ID: INVALID_KERNEL_CONTEXT_0xc2_7

TARGET_TIME: 2015-12-29T11:51:40.000Z

OSBUILD: 7601

OSSERVICEPACK: 1000

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 7

OSEDITION: Windows 7 WinNt (Service Pack 1) TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2010-11-20 16:30:02

BUILDDATESTAMP_STR: 101119-1850

BUILDLAB_STR: win7sp1_rtm

BUILDOSVER_STR: 6.1.7601.17514.amd64fre.win7sp1_rtm.101119-1850

ANALYSIS_SESSION_ELAPSED_TIME: 483

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:invalid_kernel_context_0xc2_7

FAILURE_ID_HASH: {74a6791c-293f-cb52-2363-2915348f73bd}

Followup: MachineOwner---------

0: kd> g ^ No runnable debuggees error in 'g'0: kd> !analyze -v******************************************************************************** ** Bugcheck Analysis ** ********************************************************************************

BAD_POOL_CALLER (c2)The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.Arguments:Arg1: 0000000000000007, Attempt to free pool which was already freedArg2: 0000000000001097, (reserved)Arg3: 0000000004090006, Memory contents of the pool blockArg4: fffffa80076ea890, Address of the block of pool being deallocated

Debugging Details:------------------

GetPointerFromAddress: unable to read from fffff80002ec20e8Unable to get MmSystemRangeStart

GetPointerFromAddress: unable to read from fffff80002ec20e8Unable to get MmSystemRangeStart

DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING: 7601.17514.amd64fre.win7sp1_rtm.101119-1850

SYSTEM_MANUFACTURER: TOSHIBA

SYSTEM_PRODUCT_NAME: Satellite C40-A

SYSTEM_SKU: PSCD8Q

SYSTEM_VERSION: PSCD8Q-002001

BIOS_VENDOR: Insyde Corp.

BIOS_VERSION: 1.00

BIOS_DATE: 04/30/2013

BASEBOARD_MANUFACTURER: Type2 - Board Vendor Name1

BASEBOARD_PRODUCT: Type2 - Board Product Name1

BASEBOARD_VERSION: Type2 - Board Version

DUMP_TYPE: 2

BUGCHECK_P1: 7

BUGCHECK_P2: 1097

BUGCHECK_P3: 4090006

BUGCHECK_P4: fffffa80076ea890

POOL_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec20e8Unable to get MmSystemRangeStart fffffa80076ea890

BUGCHECK_STR: 0xc2_7

CPU_COUNT: 4

CPU_MHZ: 9be

CPU_VENDOR: GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 3a

CPU_STEPPING: 9

CPU_MICROCODE: 6,3a,9,0 (F,M,S,R) SIG: 17'00000000 (cache) 17'00000000 (init)

CUSTOMER_CRASH_COUNT: 1

PROCESS_NAME: System

CURRENT_IRQL: 2

ANALYSIS_SESSION_HOST: ISTIQOMAHI7

ANALYSIS_SESSION_TIME: 12-29-2015 22:28:42.0063

ANALYSIS_VERSION: 10.0.10586.567 amd64fre

BAD_STACK_POINTER: 0000000000000000

IP_IN_FREE_BLOCK: 0

LAST_CONTROL_TRANSFER: from 0000000000000000 to 0000000000000000

STACK_TEXT: 00000000`00000000 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0

STACK_COMMAND: kb

SYMBOL_NAME: ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME: Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP: 0

IMAGE_VERSION:

BUCKET_ID: INVALID_KERNEL_CONTEXT_0xc2_7

DEFAULT_BUCKET_ID: INVALID_KERNEL_CONTEXT_0xc2_7

PRIMARY_PROBLEM_CLASS: INVALID_KERNEL_CONTEXT

FAILURE_BUCKET_ID: INVALID_KERNEL_CONTEXT_0xc2_7

TARGET_TIME: 2015-12-29T11:51:40.000Z

OSBUILD: 7601

OSSERVICEPACK: 1000

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK: 272

PRODUCT_TYPE: 1

OSPLATFORM_TYPE: x64

OSNAME: Windows 7

OSEDITION: Windows 7 WinNt (Service Pack 1) TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID: 0

OSBUILD_TIMESTAMP: 2010-11-20 16:30:02

BUILDDATESTAMP_STR: 101119-1850

BUILDLAB_STR: win7sp1_rtm

BUILDOSVER_STR: 6.1.7601.17514.amd64fre.win7sp1_rtm.101119-1850

ANALYSIS_SESSION_ELAPSED_TIME: 418

ANALYSIS_SOURCE: KM

FAILURE_ID_HASH_STRING: km:invalid_kernel_context_0xc2_7

FAILURE_ID_HASH: {74a6791c-293f-cb52-2363-2915348f73bd}

Followup: MachineOwner---------

0: kd> lmvm Unknown_ModuleBrowse full module liststart end module name0: kd> lmDvstart end module namefffff800`00bb3000 fffff800`00bbd000 kdcom (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\kdcom.dll\4A5BDFDBa000\kdcom.dll Image path: kdcom.dll Image name: kdcom.dll Browse all global symbols functions data Timestamp: Tue Jul 14 08:31:07 2009 (4A5BDFDB) CheckSum: 00009363 ImageSize: 0000A000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.A Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: kdcom.dll OriginalFilename: kdcom.dll ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: Serial Kernel Debugger LegalCopyright: Microsoft Corporation. All rights reserved.fffff800`02c11000 fffff800`031fb000 nt (pdb symbols) C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\ntkrnlmp.pdb\3844DBB920174967BE7AA4A2C20430FA2\ntkrnlmp.pdb Loaded symbol image file: ntkrnlmp.exe

Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\ntkrnlmp.exe\4CE7951A5ea000\ntkrnlmp.exe Image path: ntkrnlmp.exe Image name: ntkrnlmp.exe Browse all global symbols functions data Timestamp: Sat Nov 20 16:30:02 2010 (4CE7951A) CheckSum: 0055CE0C ImageSize: 005EA000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 1.0 App File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: ntkrnlmp.exe OriginalFilename: ntkrnlmp.exe ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: NT Kernel & System LegalCopyright: Microsoft Corporation. All rights reserved.fffff800`031fb000 fffff800`03244000 hal (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\hal.dll\4CE7C66949000\hal.dll Image path: hal.dll Image name: hal.dll Browse all global symbols functions data Timestamp: Sat Nov 20 20:00:25 2010 (4CE7C669) CheckSum: 000404C3 ImageSize: 00049000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: hal.dll OriginalFilename: hal.dll ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Hardware Abstraction Layer DLL LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00c00000 fffff880`00c10000 PCIIDEX (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\PCIIDEX.SYS\4A5BC11410000\PCIIDEX.SYS Image path: PCIIDEX.SYS Image name: PCIIDEX.SYS Browse all global symbols functions data Timestamp: Tue Jul 14 06:19:48 2009 (4A5BC114) CheckSum: 00019CC5 ImageSize: 00010000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32

File type: 3.7 Driver File date: 00000000.00000000 Translations: 0000.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: pciidex.sys OriginalFilename: pciidex.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: PCI IDE Bus Driver Extension LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00c16000 fffff880`00c65000 mcupdate (deferred) Image path: mcupdate.dll Image name: mcupdate.dll Browse all global symbols functions data Timestamp: Sat Nov 20 20:03:51 2010 (4CE7C737) CheckSum: 0004F97E ImageSize: 0004F000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4fffff880`00c65000 fffff880`00c79000 PSHED (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\PSHED.dll\4A5BE02714000\PSHED.dll Image path: PSHED.dll Image name: PSHED.dll Browse all global symbols functions data Timestamp: Tue Jul 14 08:32:23 2009 (4A5BE027) CheckSum: 0000F762 ImageSize: 00014000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: pshed.dll OriginalFilename: pshed.dll ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: Platform Specific Hardware Error Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00c79000 fffff880`00cd7000 CLFS (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\CLFS.SYS\4A5BC11D5e000\CLFS.SYS Image path: CLFS.SYS Image name: CLFS.SYS Browse all global symbols functions data Timestamp: Tue Jul 14 06:19:57 2009 (4A5BC11D) CheckSum: 00065C46 ImageSize: 0005E000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0000.04b0 CompanyName: Microsoft Corporation

ProductName: Microsoft Windows Operating System InternalName: clfs.sys OriginalFilename: Clfs.Sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: Common Log File System Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00cd7000 fffff880`00d97000 CI (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\CI.dll\4CE7C944c0000\CI.dll Image path: CI.dll Image name: CI.dll Browse all global symbols functions data Timestamp: Sat Nov 20 20:12:36 2010 (4CE7C944) CheckSum: 000CB0F6 ImageSize: 000C0000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: ci.dll OriginalFilename: ci.dll ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Code Integrity Module LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00d97000 fffff880`00df3000 volmgrx (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\volmgrx.sys\4CE792EB5c000\volmgrx.sys Image path: volmgrx.sys Image name: volmgrx.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:20:43 2010 (4CE792EB) CheckSum: 00065F6D ImageSize: 0005C000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: volmgrx.sys OriginalFilename: volmgrx.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Volume Manager Extension Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00df3000 fffff880`00dfe000 msahci (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\msahci.sys\4CE7A416b000\msahci.sys Image path: msahci.sys Image name: msahci.sys

Browse all global symbols functions data Timestamp: Sat Nov 20 17:33:58 2010 (4CE7A416) CheckSum: 00017292 ImageSize: 0000B000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: msahci.sys OriginalFilename: msahci.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: MS AHCI 1.0 Standard Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00e00000 fffff880`00e0c000 BATTC (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\BATTC.SYS\4A5BC3B5c000\BATTC.SYS Image path: BATTC.SYS Image name: BATTC.SYS Browse all global symbols functions data Timestamp: Tue Jul 14 06:31:01 2009 (4A5BC3B5) CheckSum: 000083B1 ImageSize: 0000C000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0000.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: battc.sys OriginalFilename: battc.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: Battery Class Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00e0c000 fffff880`00e21000 volmgr (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\volmgr.sys\4CE792A015000\volmgr.sys Image path: volmgr.sys Image name: volmgr.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:19:28 2010 (4CE792A0) CheckSum: 00019F72 ImageSize: 00015000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation

ProductName: Microsoft Windows Operating System InternalName: volmgr.sys OriginalFilename: volmgr.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Volume Manager Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00e21000 fffff880`00e3b000 mountmgr (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\mountmgr.sys\4CE792991a000\mountmgr.sys Image path: mountmgr.sys Image name: mountmgr.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:19:21 2010 (4CE79299) CheckSum: 00022621 ImageSize: 0001A000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: mountmgr.sys OriginalFilename: mountmgr.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Mount Point Manager LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00e3b000 fffff880`00e44000 atapi (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\atapi.sys\4A5BC1139000\atapi.sys Image path: atapi.sys Image name: atapi.sys Browse all global symbols functions data Timestamp: Tue Jul 14 06:19:47 2009 (4A5BC113) CheckSum: 000065BB ImageSize: 00009000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: atapi.sys OriginalFilename: atapi.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: ATAPI IDE Miniport Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00e44000 fffff880`00e6e000 ataport (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\ataport.SYS\4CE792932a000\ataport.SYS Image path: ataport.SYS Image name: ataport.SYS

Browse all global symbols functions data Timestamp: Sat Nov 20 16:19:15 2010 (4CE79293) CheckSum: 000287EF ImageSize: 0002A000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0000.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: ataport.sys OriginalFilename: ataport.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: ATAPI Driver Extension LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00e75000 fffff880`00f19000 Wdf01000 (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\Wdf01000.sys\4A5BC19Fa4000\Wdf01000.sys Image path: Wdf01000.sys Image name: Wdf01000.sys Browse all global symbols functions data Timestamp: Tue Jul 14 06:22:07 2009 (4A5BC19F) CheckSum: 000A2E74 ImageSize: 000A4000 File version: 1.9.7600.16385 Product version: 1.9.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: wdf01000.sys OriginalFilename: wdf01000.sys ProductVersion: 1.9.7600.16385 FileVersion: 1.9.7600.16385 (win7_rtm.090713-1255) FileDescription: Kernel Mode Driver Framework Runtime LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00f19000 fffff880`00f28000 WDFLDR (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\WDFLDR.SYS\4A5BC11Af000\WDFLDR.SYS Image path: WDFLDR.SYS Image name: WDFLDR.SYS Browse all global symbols functions data Timestamp: Tue Jul 14 06:19:54 2009 (4A5BC11A) CheckSum: 00011010 ImageSize: 0000F000 File version: 1.9.7600.16385 Product version: 1.9.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0000.04b0 CompanyName: Microsoft Corporation

ProductName: Microsoft Windows Operating System InternalName: wdfldr.sys OriginalFilename: wdfldr.sys ProductVersion: 1.9.7600.16385 FileVersion: 1.9.7600.16385 (win7_rtm.090713-1255) FileDescription: Kernel Mode Driver Framework Loader LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00f28000 fffff880`00f7f000 ACPI (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\ACPI.sys\4CE7929457000\ACPI.sys Image path: ACPI.sys Image name: ACPI.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:19:16 2010 (4CE79294) CheckSum: 0005ACF6 ImageSize: 00057000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: ACPI.sys OriginalFilename: ACPI.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: ACPI Driver for NT LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00f7f000 fffff880`00f88000 WMILIB (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\WMILIB.SYS\4A5BC1179000\WMILIB.SYS Image path: WMILIB.SYS Image name: WMILIB.SYS Browse all global symbols functions data Timestamp: Tue Jul 14 06:19:51 2009 (4A5BC117) CheckSum: 00005007 ImageSize: 00009000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: WmiLib.sys OriginalFilename: WmiLib.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: WMILIB WMI support library Dll LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00f88000 fffff880`00f92000 msisadrv (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\msisadrv.sys\4A5BC0FEa000\msisadrv.sys Image path: msisadrv.sys Image name: msisadrv.sys

Browse all global symbols functions data Timestamp: Tue Jul 14 06:19:26 2009 (4A5BC0FE) CheckSum: 0001320D ImageSize: 0000A000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: msisadrv.sys OriginalFilename: msisadrv.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: ISA Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00f92000 fffff880`00fc5000 pci (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\pci.sys\4CE7928F33000\pci.sys Image path: pci.sys Image name: pci.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:19:11 2010 (4CE7928F) CheckSum: 00033150 ImageSize: 00033000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: pci.sys OriginalFilename: pci.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: NT Plug and Play PCI Enumerator LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00fc5000 fffff880`00fd2000 vdrvroot (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\vdrvroot.sys\4A5BCADBd000\vdrvroot.sys Image path: vdrvroot.sys Image name: vdrvroot.sys Browse all global symbols functions data Timestamp: Tue Jul 14 07:01:31 2009 (4A5BCADB) CheckSum: 0000C04B ImageSize: 0000D000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation

ProductName: Microsoft Windows Operating System InternalName: vdrvroot.sys OriginalFilename: vdrvroot.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: Virtual Drive Root Enumerator LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00fd2000 fffff880`00fdc000 iusb3hcs (deferred) Image path: iusb3hcs.sys Image name: iusb3hcs.sys Browse all global symbols functions data Timestamp: Tue Dec 04 20:19:34 2012 (50BDF866) CheckSum: 000093E4 ImageSize: 0000A000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4fffff880`00fdc000 fffff880`00ff1000 partmgr (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\partmgr.sys\4CE792C015000\partmgr.sys Image path: partmgr.sys Image name: partmgr.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:20:00 2010 (4CE792C0) CheckSum: 000209B5 ImageSize: 00015000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0000.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: partmgr.sys OriginalFilename: partmgr.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Partition Management Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`00ff1000 fffff880`00ffa000 compbatt (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\compbatt.sys\4A5BC3B69000\compbatt.sys Image path: compbatt.sys Image name: compbatt.sys Browse all global symbols functions data Timestamp: Tue Jul 14 06:31:02 2009 (4A5BC3B6) CheckSum: 000080E2 ImageSize: 00009000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: compbatt.sys OriginalFilename: compbatt.sys ProductVersion: 6.1.7600.16385

FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: Composite Battery Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`01017000 fffff880`01022000 amdxata (deferred) Image path: amdxata.sys Image name: amdxata.sys Browse all global symbols functions data Timestamp: Fri Mar 19 23:18:18 2010 (4BA3A3CA) CheckSum: 0000D0AE ImageSize: 0000B000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4fffff880`01022000 fffff880`0106e000 fltmgr (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\fltmgr.sys\4CE7929C4c000\fltmgr.sys Image path: fltmgr.sys Image name: fltmgr.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:19:24 2010 (4CE7929C) CheckSum: 0005452D ImageSize: 0004C000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: fltMgr.sys OriginalFilename: fltMgr.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Microsoft Filesystem Filter Manager LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`0106e000 fffff880`01082000 fileinfo (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\fileinfo.sys\4A5BC48114000\fileinfo.sys Image path: fileinfo.sys Image name: fileinfo.sys Browse all global symbols functions data Timestamp: Tue Jul 14 06:34:25 2009 (4A5BC481) CheckSum: 00015644 ImageSize: 00014000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: FileInfo.sys OriginalFilename: FileInfo.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: FileInfo Filter Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`01082000 fffff880`010c6000 MpFilter (deferred)

Image path: MpFilter.sys Image name: MpFilter.sys Browse all global symbols functions data Timestamp: Fri Feb 27 07:21:20 2015 (54EFB880) CheckSum: 00049605 ImageSize: 00044000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4fffff880`010c6000 fffff880`01124000 msrpc (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\msrpc.sys\4CE793345e000\msrpc.sys Image path: msrpc.sys Image name: msrpc.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:21:56 2010 (4CE79334) CheckSum: 0005E9E7 ImageSize: 0005E000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: krpcdd.sys OriginalFilename: krpcdd.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Kernel Remote Procedure Call Provider LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`01124000 fffff880`01196000 cng (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\cng.sys\4CE79E2D72000\cng.sys Image path: cng.sys Image name: cng.sys Browse all global symbols functions data Timestamp: Sat Nov 20 17:08:45 2010 (4CE79E2D) CheckSum: 00078106 ImageSize: 00072000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: cng.sys OriginalFilename: cng.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Kernel Cryptography, Next Generation LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`01196000 fffff880`011a7000 Npfs (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\Npfs.SYS\4A5BC11411000\Npfs.SYS Image path: Npfs.SYS Image name: Npfs.SYS

Browse all global symbols functions data Timestamp: Tue Jul 14 06:19:48 2009 (4A5BC114) CheckSum: 00019AED ImageSize: 00011000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: npfs.sys OriginalFilename: npfs.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: NPFS Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`011a7000 fffff880`011d4280 usbvideo (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\usbvideo.sys\4CE7A6922d280\usbvideo.sys Image path: usbvideo.sys Image name: usbvideo.sys Browse all global symbols functions data Timestamp: Sat Nov 20 17:44:34 2010 (4CE7A692) CheckSum: 0002F4A8 ImageSize: 0002D280 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.0 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: usbvideo.sys OriginalFilename: usbvideo.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: USB Video Class Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`011d5000 fffff880`011f6000 WudfPf (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\WudfPf.sys\4CE7A62421000\WudfPf.sys Image path: WudfPf.sys Image name: WudfPf.sys Browse all global symbols functions data Timestamp: Sat Nov 20 17:42:44 2010 (4CE7A624) CheckSum: 00021FC8 ImageSize: 00021000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0000.04b0 CompanyName: Microsoft Corporation

ProductName: Microsoft Windows Operating System InternalName: WUDFPf.sys OriginalFilename: WUDFPf.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Windows Driver Foundation - User-mode Driver Framework Platform Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`01200000 fffff880`01211000 pcw (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\pcw.sys\4A5BC0FF11000\pcw.sys Image path: pcw.sys Image name: pcw.sys Browse all global symbols functions data Timestamp: Tue Jul 14 06:19:27 2009 (4A5BC0FF) CheckSum: 00014B5E ImageSize: 00011000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.8 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: pcw.sys OriginalFilename: pcw.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: Performance Counters for Windows Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`01211000 fffff880`0121b000 Fs_Rec (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\Fs_Rec.sys\4A5BC111a000\Fs_Rec.sys Image path: Fs_Rec.sys Image name: Fs_Rec.sys Browse all global symbols functions data Timestamp: Tue Jul 14 06:19:45 2009 (4A5BC111) CheckSum: 0001398A ImageSize: 0000A000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: fs_rec.sys OriginalFilename: fs_rec.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: File System Recognizer Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`0121b000 fffff880`01226000 Msfs (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\Msfs.SYS\4A5BC113b000\Msfs.SYS Image path: Msfs.SYS

Image name: Msfs.SYS Browse all global symbols functions data Timestamp: Tue Jul 14 06:19:47 2009 (4A5BC113) CheckSum: 00007126 ImageSize: 0000B000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: MSFS.SYS OriginalFilename: MSFS.SYS ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: Mailslot driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`01236000 fffff880`013d9000 Ntfs (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\Ntfs.sys\4CE792F91a3000\Ntfs.sys Image path: Ntfs.sys Image name: Ntfs.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:20:57 2010 (4CE792F9) CheckSum: 001987CC ImageSize: 001A3000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: ntfs.sys OriginalFilename: ntfs.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: NT File System Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`013d9000 fffff880`013f4000 ksecdd (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\ksecdd.sys\4CE7930B1b000\ksecdd.sys Image path: ksecdd.sys Image name: ksecdd.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:21:15 2010 (4CE7930B) CheckSum: 0001E184 ImageSize: 0001B000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0

CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: ksecdd.sys OriginalFilename: ksecdd.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Kernel Security Support Provider Interface LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`01400000 fffff880`01460000 NETIO (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\NETIO.SYS\4CE7938160000\NETIO.SYS Image path: NETIO.SYS Image name: NETIO.SYS Browse all global symbols functions data Timestamp: Sat Nov 20 16:23:13 2010 (4CE79381) CheckSum: 00066D17 ImageSize: 00060000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.6 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: netio.sys OriginalFilename: netio.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Network I/O Subsystem LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`01460000 fffff880`0148b000 ksecpkg (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\ksecpkg.sys\4CE79E9A2b000\ksecpkg.sys Image path: ksecpkg.sys Image name: ksecpkg.sys Browse all global symbols functions data Timestamp: Sat Nov 20 17:10:34 2010 (4CE79E9A) CheckSum: 00030EDB ImageSize: 0002B000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: ksecpkg.sys OriginalFilename: ksecpkg.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Kernel Security Support Provider Interface Packages LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`0148b000 fffff880`014b5000 cdrom (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\cdrom.sys\4CE792982a000\cdrom.sys Image path: cdrom.sys

Image name: cdrom.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:19:20 2010 (4CE79298) CheckSum: 0002B742 ImageSize: 0002A000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0000.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: cdrom.sys OriginalFilename: cdrom.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: SCSI CD-ROM Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`014b5000 fffff880`014be000 rdprefmp (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\rdprefmp.sys\4A5BCE639000\rdprefmp.sys Image path: rdprefmp.sys Image name: rdprefmp.sys Browse all global symbols functions data Timestamp: Tue Jul 14 07:16:35 2009 (4A5BCE63) CheckSum: 0000ABCD ImageSize: 00009000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.4 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: RDPREFMP.SYS OriginalFilename: RDPREFMP.SYS ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: RDP Reflector Driver Miniport LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`014c8000 fffff880`015bb000 ndis (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\ndis.sys\4CE79392f3000\ndis.sys Image path: ndis.sys Image name: ndis.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:23:30 2010 (4CE79392) CheckSum: 000E8AC1 ImageSize: 000F3000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.6 Driver File date: 00000000.00000000 Translations: 0409.04b0

CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: NDIS.SYS OriginalFilename: NDIS.SYS ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: NDIS 6.20 driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`015bb000 fffff880`015e0000 VIDEOPRT (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\VIDEOPRT.SYS\4A5BC58B25000\VIDEOPRT.SYS Image path: VIDEOPRT.SYS Image name: VIDEOPRT.SYS Browse all global symbols functions data Timestamp: Tue Jul 14 06:38:51 2009 (4A5BC58B) CheckSum: 00028FC7 ImageSize: 00025000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.4 Driver File date: 00000000.00000000 Translations: 0000.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: videoprt.sys OriginalFilename: videoprt.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: Video Port Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`015e0000 fffff880`015f0000 watchdog (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\watchdog.sys\4A5BC53F10000\watchdog.sys Image path: watchdog.sys Image name: watchdog.sys Browse all global symbols functions data Timestamp: Tue Jul 14 06:37:35 2009 (4A5BC53F) CheckSum: 00019CBE ImageSize: 00010000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0000.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: watchdog.sys OriginalFilename: watchdog.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: Watchdog Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`015f0000 fffff880`015f9000 rdpencdd (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\rdpencdd.sys\4A5BCE629000\rdpencdd.sys Image path: rdpencdd.sys

Image name: rdpencdd.sys Browse all global symbols functions data Timestamp: Tue Jul 14 07:16:34 2009 (4A5BCE62) CheckSum: 000074D5 ImageSize: 00009000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.4 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: RDPENCDD.SYS OriginalFilename: RDPENCDD.SYS ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: RDP Encoder Miniport LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`01613000 fffff880`0161c000 Null (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\Null.SYS\4A5BC1099000\Null.SYS Image path: Null.SYS Image name: Null.SYS Browse all global symbols functions data Timestamp: Tue Jul 14 06:19:37 2009 (4A5BC109) CheckSum: 0000E9DB ImageSize: 00009000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: null.sys OriginalFilename: null.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: NULL Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`0161c000 fffff880`01623000 Beep (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\Beep.SYS\4A5BCA8D7000\Beep.SYS Image path: Beep.SYS Image name: Beep.SYS Browse all global symbols functions data Timestamp: Tue Jul 14 07:00:13 2009 (4A5BCA8D) CheckSum: 000036EB ImageSize: 00007000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0

CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: beep.sys OriginalFilename: beep.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: BEEP Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`01623000 fffff880`0162c000 RDPCDD (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\RDPCDD.sys\4A5BCE629000\RDPCDD.sys Image path: RDPCDD.sys Image name: RDPCDD.sys Browse all global symbols functions data Timestamp: Tue Jul 14 07:16:34 2009 (4A5BCE62) CheckSum: 0000FFAC ImageSize: 00009000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.4 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: RDPCDD.SYS OriginalFilename: RDPCDD.SYS ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: RDP Miniport LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`0162d000 fffff880`01831000 tcpip (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\tcpip.sys\4CE79420204000\tcpip.sys Image path: tcpip.sys Image name: tcpip.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:25:52 2010 (4CE79420) CheckSum: 001E58E5 ImageSize: 00204000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.6 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: tcpip.sys OriginalFilename: tcpip.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: TCP/IP Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`01831000 fffff880`0187b000 fwpkclnt (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\fwpkclnt.sys\4CE793214a000\fwpkclnt.sys Image path: fwpkclnt.sys

Image name: fwpkclnt.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:21:37 2010 (4CE79321) CheckSum: 0004AB00 ImageSize: 0004A000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: fwpkclnt.sys OriginalFilename: fwpkclnt.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: FWP/IPsec Kernel-Mode API LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`0187b000 fffff880`0188b000 vmstorfl (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\vmstorfl.sys\4CE79B8A10000\vmstorfl.sys Image path: vmstorfl.sys Image name: vmstorfl.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:57:30 2010 (4CE79B8A) CheckSum: 0000ED21 ImageSize: 00010000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: vmstorfl.sys OriginalFilename: vmstorfl.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Virtual Storage Filter Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`0188b000 fffff880`01893000 wd (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\wd.sys\4A5BC11B8000\wd.sys Image path: wd.sys Image name: wd.sys Browse all global symbols functions data Timestamp: Tue Jul 14 06:19:55 2009 (4A5BC11B) CheckSum: 0000F36B ImageSize: 00008000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0000.04b0

CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: wd.sys OriginalFilename: wd.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: Microsoft Watchdog Timer Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`01893000 fffff880`018df000 volsnap (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\volsnap.sys\4CE792C84c000\volsnap.sys Image path: volsnap.sys Image name: volsnap.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:20:08 2010 (4CE792C8) CheckSum: 000527ED ImageSize: 0004C000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: volsnap.sys OriginalFilename: volsnap.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Volume Shadow Copy Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`018df000 fffff880`018e3e00 TVALZ_O (deferred) Image path: TVALZ_O.SYS Image name: TVALZ_O.SYS Browse all global symbols functions data Timestamp: Tue Jul 14 09:19:26 2009 (4A5BEB2E) CheckSum: 0000A8D5 ImageSize: 00004E00 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4fffff880`018e4000 fffff880`018ec000 spldr (deferred) Image path: spldr.sys Image name: spldr.sys Browse all global symbols functions data Timestamp: Mon May 11 23:56:27 2009 (4A0858BB) CheckSum: 0000E0E9 ImageSize: 00008000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4fffff880`018ec000 fffff880`01926000 rdyboost (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\rdyboost.sys\4CE7982E3a000\rdyboost.sys Image path: rdyboost.sys Image name: rdyboost.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:43:10 2010 (4CE7982E) CheckSum: 00037356 ImageSize: 0003A000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F)

File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0000.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: rdyboost.sys OriginalFilename: rdyboost.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: ReadyBoost Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`01926000 fffff880`01930000 nvpciflt (deferred) Image path: nvpciflt.sys Image name: nvpciflt.sys Browse all global symbols functions data Timestamp: Thu Mar 07 16:01:32 2013 (5138576C) CheckSum: 0000BB12 ImageSize: 0000A000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4fffff880`01930000 fffff880`01942000 mup (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\mup.sys\4A5BC20112000\mup.sys Image path: mup.sys Image name: mup.sys Browse all global symbols functions data Timestamp: Tue Jul 14 06:23:45 2009 (4A5BC201) CheckSum: 00015DFD ImageSize: 00012000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.6 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: MUP.SYS OriginalFilename: MUP.SYS ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: Multiple UNC Provider Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`01942000 fffff880`0194b000 hwpolicy (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\hwpolicy.sys\4CE7927E9000\hwpolicy.sys Image path: hwpolicy.sys Image name: hwpolicy.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:18:54 2010 (4CE7927E) CheckSum: 0000D9F4 ImageSize: 00009000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04b0

CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: hwpolicy.sys OriginalFilename: hwpolicy.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Hardware Policy Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`0194b000 fffff880`01985000 fvevol (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\fvevol.sys\4CE793B63a000\fvevol.sys Image path: fvevol.sys Image name: fvevol.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:24:06 2010 (4CE793B6) CheckSum: 000389BC ImageSize: 0003A000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0000.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: FVEVOL.SYS OriginalFilename: FVEVOL.SYS ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: BitLocker Drive Encryption Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`01985000 fffff880`0199b000 disk (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\disk.sys\4A5BC11D16000\disk.sys Image path: disk.sys Image name: disk.sys Browse all global symbols functions data Timestamp: Tue Jul 14 06:19:57 2009 (4A5BC11D) CheckSum: 0001FF1D ImageSize: 00016000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0000.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: disk.sys OriginalFilename: disk.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: PnP Disk Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`0199b000 fffff880`019cb000 CLASSPNP (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\CLASSPNP.SYS\4CE7929B30000\CLASSPNP.SYS Image path: CLASSPNP.SYS

Image name: CLASSPNP.SYS Browse all global symbols functions data Timestamp: Sat Nov 20 16:19:23 2010 (4CE7929B) CheckSum: 000318BE ImageSize: 00030000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0000.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: Classpnp.sys OriginalFilename: Classpnp.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: SCSI Class System Dll LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`019cb000 fffff880`019ee000 luafv (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\luafv.sys\4A5BC29523000\luafv.sys Image path: luafv.sys Image name: luafv.sys Browse all global symbols functions data Timestamp: Tue Jul 14 06:26:13 2009 (4A5BC295) CheckSum: 00027BF1 ImageSize: 00023000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: luafv.sys OriginalFilename: luafv.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: LUA File Virtualization Filter Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`019f0000 fffff880`019fe000 vga (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\vga.sys\4A5BC587e000\vga.sys Image path: vga.sys Image name: vga.sys Browse all global symbols functions data Timestamp: Tue Jul 14 06:38:47 2009 (4A5BC587) CheckSum: 00013E6F ImageSize: 0000E000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.4 Driver File date: 00000000.00000000 Translations: 0000.04b0

CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: vga.sys OriginalFilename: vga.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: VGA/Super VGA Video Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`02c00000 fffff880`02c5d000 iusb3hub (deferred) Image path: iusb3hub.sys Image name: iusb3hub.sys Browse all global symbols functions data Timestamp: Tue Dec 04 20:17:56 2012 (50BDF804) CheckSum: 0005D3FD ImageSize: 0005D000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4fffff880`02c5d000 fffff880`02cb3000 IntcDAud (deferred) Image path: IntcDAud.sys Image name: IntcDAud.sys Browse all global symbols functions data Timestamp: Tue Dec 06 18:23:07 2011 (4EDDFB1B) CheckSum: 00057CF8 ImageSize: 00056000 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4fffff880`02cb3000 fffff880`02cc6000 dump_dumpfve (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\dumpfve.sys\4A5BC18F13000\dumpfve.sys Image path: dump_dumpfve.sys Image name: dump_dumpfve.sys Browse all global symbols functions data Timestamp: Tue Jul 14 06:21:51 2009 (4A5BC18F) CheckSum: 00010DEA ImageSize: 00013000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0000.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: dumpfve.sys OriginalFilename: dumpfve.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: Bitlocker Drive Encryption Crashdump Filter LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`02cc7000 fffff880`02d4a000 csc (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\csc.sys\4CE7947083000\csc.sys Image path: csc.sys Image name: csc.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:27:12 2010 (4CE79470) CheckSum: 0008519D ImageSize: 00083000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F)

File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: csc.sys OriginalFilename: CSC.Sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Windows Client Side Caching Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`02d4a000 fffff880`02d68000 dfsc (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\dfsc.sys\4CE794471e000\dfsc.sys Image path: dfsc.sys Image name: dfsc.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:26:31 2010 (4CE79447) CheckSum: 0001D647 ImageSize: 0001E000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: dfsclient.sys OriginalFilename: dfsclient.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: DFS Namespace Client Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`02d68000 fffff880`02d79000 blbdrive (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\blbdrive.sys\4A5BC4DF11000\blbdrive.sys Image path: blbdrive.sys Image name: blbdrive.sys Browse all global symbols functions data Timestamp: Tue Jul 14 06:35:59 2009 (4A5BC4DF) CheckSum: 00019567 ImageSize: 00011000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: blbdrive.sys OriginalFilename: blbdrive.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: BLB Drive Driver LegalCopyright: Microsoft Corporation. All rights reserved.

fffff880`02d79000 fffff880`02d9f000 tunnel (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\tunnel.sys\4CE7A84626000\tunnel.sys Image path: tunnel.sys Image name: tunnel.sys Browse all global symbols functions data Timestamp: Sat Nov 20 17:51:50 2010 (4CE7A846) CheckSum: 0002CD96 ImageSize: 00026000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.6 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: tunnel.sys OriginalFilename: tunnel.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Microsoft Tunnel Interface Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`02d9f000 fffff880`02de7880 aksusb (deferred) Image path: aksusb.sys Image name: aksusb.sys Browse all global symbols functions data Timestamp: Thu Jun 20 16:43:54 2013 (51C2CEDA) CheckSum: 0004FF70 ImageSize: 00048880 Translations: 0000.04b0 0000.04e4 0409.04b0 0409.04e4fffff880`02de8000 fffff880`02df6000 monitor (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\monitor.sys\4A5BC58Ce000\monitor.sys Image path: monitor.sys Image name: monitor.sys Browse all global symbols functions data Timestamp: Tue Jul 14 06:38:52 2009 (4A5BC58C) CheckSum: 000092BF ImageSize: 0000E000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: monitor.sys OriginalFilename: monitor.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: Monitor Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`03a00000 fffff880`03a16000 vwififlt (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\vwififlt.sys\4A5BCC3A16000\vwififlt.sys Image path: vwififlt.sys

Image name: vwififlt.sys Browse all global symbols functions data Timestamp: Tue Jul 14 07:07:22 2009 (4A5BCC3A) CheckSum: 0001A7DC ImageSize: 00016000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.6 Driver File date: 00000000.00000000 Translations: 0000.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: vwififlt.sys OriginalFilename: vwififlt.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: Virtual WiFi Filter Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`03a16000 fffff880`03a25000 netbios (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\netbios.sys\4A5BCCB6f000\netbios.sys Image path: netbios.sys Image name: netbios.sys Browse all global symbols functions data Timestamp: Tue Jul 14 07:09:26 2009 (4A5BCCB6) CheckSum: 00011668 ImageSize: 0000F000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.6 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: NETBIOS.SYS OriginalFilename: NETBIOS.SYS ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: NetBIOS interface driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`03a25000 fffff880`03a40000 wanarp (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\wanarp.sys\4CE7A8741b000\wanarp.sys Image path: wanarp.sys Image name: wanarp.sys Browse all global symbols functions data Timestamp: Sat Nov 20 17:52:36 2010 (4CE7A874) CheckSum: 00017CCC ImageSize: 0001B000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.6 Driver File date: 00000000.00000000 Translations: 0409.04b0

CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: WANARP.SYS OriginalFilename: WANARP.SYS ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: MS Remote Access and Routing ARP Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`03a40000 fffff880`03a54000 termdd (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\termdd.sys\4CE7AB0C14000\termdd.sys Image path: termdd.sys Image name: termdd.sys Browse all global symbols functions data Timestamp: Sat Nov 20 18:03:40 2010 (4CE7AB0C) CheckSum: 00019E15 ImageSize: 00014000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: termdd.sys OriginalFilename: termdd.sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Remote Desktop Server Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`03a54000 fffff880`03aa5000 rdbss (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\rdbss.sys\4CE7949751000\rdbss.sys Image path: rdbss.sys Image name: rdbss.sys Browse all global symbols functions data Timestamp: Sat Nov 20 16:27:51 2010 (4CE79497) CheckSum: 0004D76F ImageSize: 00051000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: rdbss.sys OriginalFilename: RDBSS.Sys ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: Redirected Drive Buffering SubSystem Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`03aa5000 fffff880`03ab1000 nsiproxy (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\nsiproxy.sys\4A5BC15Ec000\nsiproxy.sys Image path: nsiproxy.sys

Image name: nsiproxy.sys Browse all global symbols functions data Timestamp: Tue Jul 14 06:21:02 2009 (4A5BC15E) CheckSum: 00013ED5 ImageSize: 0000C000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.6 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: nsiproxy.sys OriginalFilename: nsiproxy.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: NSI Proxy LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`03ab1000 fffff880`03abc000 mssmbios (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\mssmbios.sys\4A5BC3BEb000\mssmbios.sys Image path: mssmbios.sys Image name: mssmbios.sys Browse all global symbols functions data Timestamp: Tue Jul 14 06:31:10 2009 (4A5BC3BE) CheckSum: 0000F474 ImageSize: 0000B000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 3.7 Driver File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: smbios.sys OriginalFilename: smbios.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: System Management BIOS Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`03abc000 fffff880`03acb000 discache (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\discache.sys\4A5BC52Ef000\discache.sys Image path: discache.sys Image name: discache.sys Browse all global symbols functions data Timestamp: Tue Jul 14 06:37:18 2009 (4A5BC52E) CheckSum: 00015F3F ImageSize: 0000F000 File version: 6.1.7600.16385 Product version: 6.1.7600.16385 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04b0

CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: syscache.sys OriginalFilename: syscache.sys ProductVersion: 6.1.7600.16385 FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255) FileDescription: System Indexer/Cache Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`03acb000 fffff880`03ae8000 usbccgp (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\usbccgp.sys\4CE7A6731d000\usbccgp.sys Image path: usbccgp.sys Image name: usbccgp.sys Browse all global symbols functions data Timestamp: Sat Nov 20 17:44:03 2010 (4CE7A673) CheckSum: 00018A13 ImageSize: 0001D000 File version: 6.1.7601.17514 Product version: 6.1.7601.17514 File flags: 0 (Mask 3F) File OS: 40004 NT Win32 File type: 2.0 Dll File date: 00000000.00000000 Translations: 0409.04b0 CompanyName: Microsoft Corporation ProductName: Microsoft Windows Operating System InternalName: USBCCGP.SYS OriginalFilename: USBCCGP.SYS ProductVersion: 6.1.7601.17514 FileVersion: 6.1.7601.17514 (win7sp1_rtm.101119-1850) FileDescription: USB Common Class Generic Parent Driver LegalCopyright: Microsoft Corporation. All rights reserved.fffff880`03aef000 fffff880`03b78000 afd (deferred) Mapped memory image file: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\sym\afd.sys\4CE7938F89000\afd.sys Ima