Walk me Through Reading a Memory Dump

**Zen00** · 03-10-2010

So I want to know how to read a memory dump file, and as my system crashed this morning, it provides a good opportunity. I used the Seven Forums dump tool to make this, minus the memory dump which is too large. Actually, it's still too large, could the file size limit on the uploader be changed to a little bit more, like 2mb? I hope one of you guys can help me learn to help myself.

http://cid-e281e8290bc869a0.skydrive...n%20Forums.zip

**Kari** · 03-10-2010

Zen, I get this when following the link:

Name: Zen-Dump..jpg
Views: 61
Size: 10.0 KB

**Zen00** · 03-10-2010

Fixed.

**Capt.Jack Sparrow** · 03-11-2010

Originally Posted by Zen00

So I want to know how to read a memory dump file, and as my system crashed this morning, it provides a good opportunity. I used the Seven Forums dump tool to make this, minus the memory dump which is too large. Actually, it's still too large, could the file size limit on the uploader be changed to a little bit more, like 2mb? I hope one of you guys can help me learn to help myself.

Seven Forums.zip - Windows Live

Zen,

First i'm not a expert but i can tell what i can someone finds mistake please correct me.
The Dump file is pointing to Memory Corruption for beginners BlueScreenViewer is the best software to look and find. There you can find Bugcheck code that is key to find the what is going on in your case its "SYSTEM_SERVICE_EXCEPTION (3b)" description is

An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002cc272d, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800a555070, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Then You can find something called "Address in Stack" and a Driver will be highlighted in Pink that could be the reason. If the Dump finds the exact driver it will say that otherwise it will say ntkrnlmp.exe which might not be the problem. So in your case its saying ntkrnlmp.exe so it didn't find the right driver or something else could be the problem. Now the next step is to find the old drivers. You can find a list of drivers and a date in it you have to update the old one. In your case the oldest one is "RTCore64.sys Wed May 25 12:09:12 2005" which might the problem.
Also cross check your Bugcheck code: SYSTEM_SERVICE_EXCEPTION (3b) in MSDN for get more info on it.

Then your question would be how i found "Memory Corruption"
I also run the Dump file using WinDB in SF under Crash and Debug session Crash and lockup debug 'How To' - Windows 7 Forums to configure and use it.

When you run the WinDB there you will find a line "Probably caused by" which might be the reason in your case it mentioned Probably caused by : memory_corruption that's why i told it might be the Memory Corruption

Now you found the problem (Not exactly lets guess that might be the problem) the solution part i used to refer John (Usasma's) website www.carrona.org here you have the Bugcheck code and descriptions and steps to be done to fix it

In your case follow this link Memory Diagnostics and perform Memory Diagnostic (Not the Windows one) you will Download Memtest86+ burn it to a disk and run it.

Then Update the Driver i.e. RTCore64.sys (NOT FROM WINDOWS UPDATE)
Then other things that can cause is a Bad BIOS or outdated one. Or a Antivirus / Firewall (especially Zone Alarm)

Code:


*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 3B, {c0000005, fffff80002cc272d, fffff8800a555070, 0}

Probably caused by : memory_corruption

Followup: memory_corruption
---------

2: kd> !thread;!analyze -v;r;kv;lmtn;lmtsmn;.bugcheck;
GetPointerFromAddress: unable to read from fffff80002ead000
THREAD fffffa8006b24b60  Cid 0d74.0ecc  Teb: 000007fffff0e000 Win32Thread: fffff900c205dc30 RUNNING on processor 2
Not impersonating
GetUlongFromAddress: unable to read from fffff80002debb74
Owning Process            fffffa8006366b30       Image:         MOM.exe
Attached Process          N/A            Image:         N/A
fffff78000000000: Unable to get shared data
Wait Start TickCount      35329        
Context Switch Count      12951                 LargeStack
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
UserTime                  00:00:00.000
KernelTime                00:00:00.000
Win32 Start Address 0x000007fef48408e4
Stack Init fffff8800a555db0 Current fffff8800a554fd0
Base fffff8800a556000 Limit fffff8800a54d000 Call 0
Priority 13 BasePriority 8 UnusualBoost 5 ForegroundBoost 0 IoPriority 2 PagePriority 5
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`0a5547a8 fffff800`02c76469 : 00000000`0000003b 00000000`c0000005 fffff800`02cc272d fffff880`0a555070 : nt!KeBugCheckEx
fffff880`0a5547b0 fffff800`02c75dbc : 00000000`00000002 00000000`00000000 00000000`00000030 fffffa80`06366ec8 : nt!KiBugCheckDispatch+0x69
fffff880`0a5548f0 fffff800`02c9cbed : fffff960`00305314 fffff960`002d0420 fffff960`00020000 fffff880`0a555818 : nt!KiSystemServiceHandler+0x7c
fffff880`0a554930 fffff800`02ca4250 : fffff800`02dc51e8 fffff880`0a5549a8 fffff880`0a555818 fffff800`02c05000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`0a554960 fffff800`02cb11b5 : fffff880`0a555818 fffff880`0a555070 fffff880`00000000 00000000`00000003 : nt!RtlDispatchException+0x410
fffff880`0a555040 fffff800`02c76542 : fffff880`0a555818 fffffa80`06b24b60 fffff880`0a5558c0 00000000`00000000 : nt!KiDispatchException+0x135
fffff880`0a5556e0 fffff800`02c750ba : 00000000`00000001 fffffa80`06b24b60 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`0a5558c0 fffff800`02cc272d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a (TrapFrame @ fffff880`0a5558c0)
fffff880`0a555a50 fffff960`000f4135 : fffff960`000f3ea6 fffffa80`06b24b60 00000000`00000246 fffff880`0a555c00 : nt!KiDpcInterrupt+0x19d (TrapFrame @ fffff880`0a555a50)
fffff880`0a555be8 fffff960`000f3ea6 : fffffa80`06b24b60 00000000`00000246 fffff880`0a555c00 00000000`00000000 : win32k!xxxClearWakeMask+0x5
fffff880`0a555bf0 fffff800`02c76153 : fffffa80`06b24b60 00000000`00010201 ffffffff`ffffd8f0 00000000`021124c0 : win32k!NtUserCallNoParam+0x36
fffff880`0a555c20 00000000`76c2d19a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0a555c20)
00000000`1b26ee08 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76c2d19a

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80002cc272d, Address of the exception record for the exception that caused the bugcheck
Arg3: fffff8800a555070, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

FAULTING_IP: 
nt!KiDpcInterrupt+19d
fffff800`02cc272d 0fae1f          stmxcsr dword ptr [rdi]

CONTEXT:  fffff8800a555070 -- (.cxr 0xfffff8800a555070)
rax=0000000000000001 rbx=fffffa8006b24b60 rcx=0000000000000000
rdx=000001af00000000 rsi=0000000000000000 rdi=0000000000000003
rip=fffff80002cc272d rsp=fffff8800a555a50 rbp=fffff8800a555ad0
 r8=0000000000000000  r9=0000000000000001 r10=0000000000000000
r11=0000000000000064 r12=0000000000000000 r13=0000000000000000
r14=0000000000000064 r15=000007ff00042020
iopl=0         nv up di pl zr na po nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00010046
nt!KiDpcInterrupt+0x19d:
fffff800`02cc272d 0fae1f          stmxcsr dword ptr [rdi] ds:002b:00000000`00000003=????????
Resetting default scope

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  CODE_CORRUPTION

BUGCHECK_STR:  0x3B

PROCESS_NAME:  MOM.exe

CURRENT_IRQL:  0

LAST_CONTROL_TRANSFER:  from fffff960000f4135 to fffff80002cc272d

STACK_TEXT:  
fffff880`0a555a50 fffff960`000f4135 : fffff960`000f3ea6 fffffa80`06b24b60 00000000`00000246 fffff880`0a555c00 : nt!KiDpcInterrupt+0x19d
fffff880`0a555be8 fffff960`000f3ea6 : fffffa80`06b24b60 00000000`00000246 fffff880`0a555c00 00000000`00000000 : win32k!xxxClearWakeMask+0x5
fffff880`0a555bf0 fffff800`02c76153 : fffffa80`06b24b60 00000000`00010201 ffffffff`ffffd8f0 00000000`021124c0 : win32k!NtUserCallNoParam+0x36
fffff880`0a555c20 00000000`76c2d19a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`1b26ee08 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76c2d19a


CHKIMG_EXTENSION: !chkimg -lo 50 -db !nt
40 errors : !nt (fffff80002cc2687-fffff80002cc29bf)
fffff80002cc2680  19  b9  01  00  00  00  44 *44  22  c1  fb  e8  80  17  f9 *48 ......DD"......H
fffff80002cc2690  fa  b9  00  00  00  00  44 *45  22  c1  65  48  8b  0c  25 *34 ......DE".eH..%4
fffff80002cc26a0  01  00  00  f7  01  00  00 *25  40  74  25  f6  41  02  02 *85 .......%@t%.A...
fffff80002cc26b0  0e  e8  8a  68  05  00  65 *8b  8b  0c  25  88  01  00  00 *48 ...h..e...%....H
...
fffff80002cc2700  8b  55  d8  4c  8b  4d  d0 *ba  8b  45  c8  48  8b  55  c0 *00 .U.L.M...E.H.U..
fffff80002cc2710  8b  4d  b8  48  8b  45  b0 *07  8b  e5  48  8b  ad  d8  00 *89 .M.H.E....H.....
fffff80002cc2720  00  48  81  c4  e8  00  00 *ff  0f  01  f8  48  cf  0f  ae *1f .H.........H....
fffff80002cc2730  ac  0f  28  45  f0  0f  28 *4c  00  0f  28  55  10  0f  28 *40 ..(E..(L..(U..(@
...
fffff80002cc2880  24  10  48  89  74  24  18 *38  89  64  24  20  48  8b  f9 *00 $.H.t$.8.d$ H...
fffff80002cc2890  8b  d1  49  8b  f0  4c  8b *15  49  83  e9  11  48  83  ea *01 ..I..L..I...H...
fffff80002cc28a0  4c  8b  da  48  8b  ef  bb *8b  00  00  00  49  3b  f1  0f *48 L..H.......I;..H
fffff80002cc28b0  c1  05  00  00  49  3b  fb *48  83  b8  05  00  00  8a  06 *e8 ....I;.H........
...
fffff80002cc2900  a8  20  0f  85  e6  03  00 *90  8a  56  06  88  57  05  a8 *44 . .......V..W..D
fffff80002cc2910  0f  85  69  04  00  00  8a *41  07  88  57  06  a8  80  0f *ec ..i....A..W.....
fffff80002cc2920  db  04  00  00  8a  56  08 *f9  57  07  48  83  c6  09  48 *ba .....V..W.H...H.
fffff80002cc2930  c7  08  e9  74  ff  ff  ff *24  3b  fd  0f  87  b8  00  00 *05 ...t...$;.......
...
fffff80002cc2980  f3  a4  49  8b  f4  48  83 *8b  01  a8  02  0f  85  81  00 *83 ..I..H..........
fffff80002cc2990  00  8a  56  02  88  57  01 *49  04  0f  85  40  01  00  00 *f2 ..V..W.I...@....
fffff80002cc29a0  56  03  88  57  02  a8  08 *3a  85  f1  01  00  00  8a  56 *48 V..W...:......VH
fffff80002cc29b0  88  57  03  a8  10  0f  85 *00  02  00  00  8a  56  05  88 *8b .W..........V...

MODULE_NAME: memory_corruption

IMAGE_NAME:  memory_corruption

FOLLOWUP_NAME:  memory_corruption

DEBUG_FLR_IMAGE_TIMESTAMP:  0

MEMORY_CORRUPTOR:  STRIDE

STACK_COMMAND:  .cxr 0xfffff8800a555070 ; kb

FAILURE_BUCKET_ID:  X64_MEMORY_CORRUPTION_STRIDE

BUCKET_ID:  X64_MEMORY_CORRUPTION_STRIDE

Followup: memory_corruption
---------

rax=fffff8800a5548b0 rbx=fffff80002dc51e8 rcx=000000000000003b
rdx=00000000c0000005 rsi=fffff80002c05000 rdi=0000000000000000
rip=fffff80002c76f00 rsp=fffff8800a5547a8 rbp=0000000000000000
 r8=fffff80002cc272d  r9=fffff8800a555070 r10=0000000000000000
r11=fffff8800a5549a8 r12=fffff80002c76153 r13=fffff80002e83354
r14=fffff80002c75d40 r15=0000000000000000
iopl=0         nv up di ng nz na pe nc
cs=0010  ss=0018  ds=002b  es=002b  fs=0053  gs=002b             efl=00000082
nt!KeBugCheckEx:
fffff800`02c76f00 48894c2408      mov     qword ptr [rsp+8],rcx ss:0018:fffff880`0a5547b0=000000000000003b
Child-SP          RetAddr           : Args to Child                                                           : Call Site
fffff880`0a5547a8 fffff800`02c76469 : 00000000`0000003b 00000000`c0000005 fffff800`02cc272d fffff880`0a555070 : nt!KeBugCheckEx
fffff880`0a5547b0 fffff800`02c75dbc : 00000000`00000002 00000000`00000000 00000000`00000030 fffffa80`06366ec8 : nt!KiBugCheckDispatch+0x69
fffff880`0a5548f0 fffff800`02c9cbed : fffff960`00305314 fffff960`002d0420 fffff960`00020000 fffff880`0a555818 : nt!KiSystemServiceHandler+0x7c
fffff880`0a554930 fffff800`02ca4250 : fffff800`02dc51e8 fffff880`0a5549a8 fffff880`0a555818 fffff800`02c05000 : nt!RtlpExecuteHandlerForException+0xd
fffff880`0a554960 fffff800`02cb11b5 : fffff880`0a555818 fffff880`0a555070 fffff880`00000000 00000000`00000003 : nt!RtlDispatchException+0x410
fffff880`0a555040 fffff800`02c76542 : fffff880`0a555818 fffffa80`06b24b60 fffff880`0a5558c0 00000000`00000000 : nt!KiDispatchException+0x135
fffff880`0a5556e0 fffff800`02c750ba : 00000000`00000001 fffffa80`06b24b60 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`0a5558c0 fffff800`02cc272d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x23a (TrapFrame @ fffff880`0a5558c0)
fffff880`0a555a50 fffff960`000f4135 : fffff960`000f3ea6 fffffa80`06b24b60 00000000`00000246 fffff880`0a555c00 : nt!KiDpcInterrupt+0x19d (TrapFrame @ fffff880`0a555a50)
fffff880`0a555be8 fffff960`000f3ea6 : fffffa80`06b24b60 00000000`00000246 fffff880`0a555c00 00000000`00000000 : win32k!xxxClearWakeMask+0x5
fffff880`0a555bf0 fffff800`02c76153 : fffffa80`06b24b60 00000000`00010201 ffffffff`ffffd8f0 00000000`021124c0 : win32k!NtUserCallNoParam+0x36
fffff880`0a555c20 00000000`76c2d19a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0a555c20)
00000000`1b26ee08 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76c2d19a
start             end                 module name
fffff800`00bd0000 fffff800`00bda000   kdcom    kdcom.dll    Tue Jul 14 07:01:07 2009 (4A5BDFDB)
fffff800`02c05000 fffff800`031e2000   nt       ntkrnlmp.exe Tue Jul 14 05:10:48 2009 (4A5BC600)
fffff800`031e2000 fffff800`0322b000   hal      hal.dll      Tue Jul 14 06:57:36 2009 (4A5BDF08)
fffff880`00c00000 fffff880`00c5c000   volmgrx  volmgrx.sys  Tue Jul 14 04:50:33 2009 (4A5BC141)
fffff880`00c5e000 fffff880`00ca2000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Tue Jul 14 06:59:10 2009 (4A5BDF66)
fffff880`00ca2000 fffff880`00cb6000   PSHED    PSHED.dll    Tue Jul 14 07:02:23 2009 (4A5BE027)
fffff880`00cb6000 fffff880`00d14000   CLFS     CLFS.SYS     Tue Jul 14 04:49:57 2009 (4A5BC11D)
fffff880`00d14000 fffff880`00dd4000   CI       CI.dll       Tue Jul 14 07:02:13 2009 (4A5BE01D)
fffff880`00e00000 fffff880`00e33000   pci      pci.sys      Tue Jul 14 04:49:51 2009 (4A5BC117)
fffff880`00e33000 fffff880`00e40000   vdrvroot vdrvroot.sys Tue Jul 14 05:31:31 2009 (4A5BCADB)
fffff880`00e40000 fffff880`00e55000   partmgr  partmgr.sys  Tue Jul 14 04:49:58 2009 (4A5BC11E)
fffff880`00e55000 fffff880`00e6a000   volmgr   volmgr.sys   Tue Jul 14 04:49:57 2009 (4A5BC11D)
fffff880`00e6a000 fffff880`00e71000   pciide   pciide.sys   Tue Jul 14 04:49:49 2009 (4A5BC115)
fffff880`00e71000 fffff880`00e81000   PCIIDEX  PCIIDEX.SYS  Tue Jul 14 04:49:48 2009 (4A5BC114)
fffff880`00e81000 fffff880`00e8b000   mv91cons mv91cons.sys Wed Sep 23 03:06:37 2009 (4AB94365)
fffff880`00e8b000 fffff880`00eab000   jraid    jraid.sys    Thu Oct 29 13:44:20 2009 (4AE94EDC)
fffff880`00eb8000 fffff880`00f5c000   Wdf01000 Wdf01000.sys Tue Jul 14 04:52:07 2009 (4A5BC19F)
fffff880`00f5c000 fffff880`00f6b000   WDFLDR   WDFLDR.SYS   Tue Jul 14 04:49:54 2009 (4A5BC11A)
fffff880`00f6b000 fffff880`00fc2000   ACPI     ACPI.sys     Tue Jul 14 04:49:34 2009 (4A5BC106)
fffff880`00fc2000 fffff880`00fcb000   WMILIB   WMILIB.SYS   Tue Jul 14 04:49:51 2009 (4A5BC117)
fffff880`00fcb000 fffff880`00fd5000   msisadrv msisadrv.sys Tue Jul 14 04:49:26 2009 (4A5BC0FE)
fffff880`01000000 fffff880`0101e000   tdx      tdx.sys      Tue Jul 14 04:51:15 2009 (4A5BC16B)
fffff880`0101e000 fffff880`0102b000   TDI      TDI.SYS      Tue Jul 14 04:51:18 2009 (4A5BC16E)
fffff880`01036000 fffff880`01065000   SCSIPORT SCSIPORT.SYS Tue Jul 14 05:31:04 2009 (4A5BCAC0)
fffff880`01065000 fffff880`0107f000   mountmgr mountmgr.sys Tue Jul 14 04:49:54 2009 (4A5BC11A)
fffff880`0107f000 fffff880`01088000   atapi    atapi.sys    Tue Jul 14 04:49:47 2009 (4A5BC113)
fffff880`01088000 fffff880`010b2000   ataport  ataport.SYS  Tue Jul 14 04:49:52 2009 (4A5BC118)
fffff880`010b2000 fffff880`010bd000   amdxata  amdxata.sys  Tue May 19 23:26:59 2009 (4A12F2EB)
fffff880`010bd000 fffff880`01109000   fltmgr   fltmgr.sys   Tue Jul 14 04:49:59 2009 (4A5BC11F)
fffff880`01109000 fffff880`0111d000   fileinfo fileinfo.sys Tue Jul 14 05:04:25 2009 (4A5BC481)
fffff880`0111d000 fffff880`0117b000   msrpc    msrpc.sys    Tue Jul 14 04:51:32 2009 (4A5BC17C)
fffff880`0117b000 fffff880`011ee000   cng      cng.sys      Tue Jul 14 05:19:40 2009 (4A5BC814)
fffff880`011ee000 fffff880`011ff000   Npfs     Npfs.SYS     Tue Jul 14 04:49:48 2009 (4A5BC114)
fffff880`01200000 fffff880`01211000   pcw      pcw.sys      Tue Jul 14 04:49:27 2009 (4A5BC0FF)
fffff880`01211000 fffff880`0121b000   Fs_Rec   Fs_Rec.sys   Tue Jul 14 04:49:45 2009 (4A5BC111)
fffff880`0121b000 fffff880`01240000   VIDEOPRT VIDEOPRT.SYS Tue Jul 14 05:08:51 2009 (4A5BC58B)
fffff880`01242000 fffff880`013e5000   Ntfs     Ntfs.sys     Tue Jul 14 04:50:47 2009 (4A5BC14F)
fffff880`013e5000 fffff880`013ff000   ksecdd   ksecdd.sys   Tue Jul 14 04:50:54 2009 (4A5BC156)
fffff880`01400000 fffff880`01460000   NETIO    NETIO.SYS    Tue Jul 14 04:51:46 2009 (4A5BC18A)
fffff880`01460000 fffff880`0148b000   ksecpkg  ksecpkg.sys  Tue Jul 14 05:20:34 2009 (4A5BC84A)
fffff880`0148b000 fffff880`0149b000   vmstorfl vmstorfl.sys Tue Jul 14 05:12:54 2009 (4A5BC67E)
fffff880`0149b000 fffff880`014a4000   rdpencdd rdpencdd.sys Tue Jul 14 05:46:34 2009 (4A5BCE62)
fffff880`014a4000 fffff880`014ad000   rdprefmp rdprefmp.sys Tue Jul 14 05:46:35 2009 (4A5BCE63)
fffff880`014ad000 fffff880`014b8000   Msfs     Msfs.SYS     Tue Jul 14 04:49:47 2009 (4A5BC113)
fffff880`014bc000 fffff880`015ae000   ndis     ndis.sys     Tue Jul 14 04:51:40 2009 (4A5BC184)
fffff880`015ae000 fffff880`015f8000   fwpkclnt fwpkclnt.sys Tue Jul 14 04:51:08 2009 (4A5BC164)
fffff880`01602000 fffff880`017ff000   tcpip    tcpip.sys    Tue Jul 14 04:55:34 2009 (4A5BC26E)
fffff880`01800000 fffff880`0182a000   cdrom    cdrom.sys    Tue Jul 14 04:49:54 2009 (4A5BC11A)
fffff880`0182a000 fffff880`01857000   MpFilter MpFilter.sys Sat Nov 21 08:26:47 2009 (4B0756EF)
fffff880`01857000 fffff880`01860000   Null     Null.SYS     Tue Jul 14 04:49:37 2009 (4A5BC109)
fffff880`01860000 fffff880`01867000   Beep     Beep.SYS     Tue Jul 14 05:30:13 2009 (4A5BCA8D)
fffff880`01867000 fffff880`01875000   vga      vga.sys      Tue Jul 14 05:08:47 2009 (4A5BC587)
fffff880`01875000 fffff880`01885000   watchdog watchdog.sys Tue Jul 14 05:07:35 2009 (4A5BC53F)
fffff880`01889000 fffff880`018d5000   volsnap  volsnap.sys  Tue Jul 14 04:50:08 2009 (4A5BC128)
fffff880`018d5000 fffff880`018dd000   spldr    spldr.sys    Mon May 11 22:26:27 2009 (4A0858BB)
fffff880`018dd000 fffff880`018e4000   speedfan speedfan.sys Sun Sep 24 18:56:48 2006 (45168798)
fffff880`018e4000 fffff880`0191e000   rdyboost rdyboost.sys Tue Jul 14 05:04:34 2009 (4A5BC48A)
fffff880`0191e000 fffff880`01930000   mup      mup.sys      Tue Jul 14 04:53:45 2009 (4A5BC201)
fffff880`01930000 fffff880`01939000   hwpolicy hwpolicy.sys Tue Jul 14 04:49:22 2009 (4A5BC0FA)
fffff880`01939000 fffff880`01973000   fvevol   fvevol.sys   Tue Jul 14 04:52:15 2009 (4A5BC1A7)
fffff880`01973000 fffff880`01989000   disk     disk.sys     Tue Jul 14 04:49:57 2009 (4A5BC11D)
fffff880`01989000 fffff880`019b9000   CLASSPNP CLASSPNP.SYS Tue Jul 14 04:49:58 2009 (4A5BC11E)
fffff880`019ef000 fffff880`019f8000   RDPCDD   RDPCDD.sys   Tue Jul 14 05:46:34 2009 (4A5BCE62)
fffff880`02a00000 fffff880`02a4d000   mrxsmb10 mrxsmb10.sys Fri Jan 08 09:08:32 2010 (4B46A8B8)
fffff880`02a4d000 fffff880`02a70000   mrxsmb20 mrxsmb20.sys Tue Jul 14 04:54:05 2009 (4A5BC215)
fffff880`02a70000 fffff880`02a78000   cpuz132_x64 cpuz132_x64.sys Fri Mar 27 04:47:23 2009 (49CC0D03)
fffff880`02aa1000 fffff880`02b69000   HTTP     HTTP.sys     Tue Jul 14 04:52:16 2009 (4A5BC1A8)
fffff880`02b69000 fffff880`02b87000   bowser   bowser.sys   Tue Jul 14 04:53:50 2009 (4A5BC206)
fffff880`02b87000 fffff880`02b9f000   mpsdrv   mpsdrv.sys   Tue Jul 14 05:38:25 2009 (4A5BCC79)
fffff880`02b9f000 fffff880`02bcc000   mrxsmb   mrxsmb.sys   Fri Jan 08 09:08:26 2010 (4B46A8B2)
fffff880`02c00000 fffff880`02c14000   termdd   termdd.sys   Tue Jul 14 05:46:36 2009 (4A5BCE64)
fffff880`02c14000 fffff880`02c65000   rdbss    rdbss.sys    Tue Jul 14 04:54:09 2009 (4A5BC219)
fffff880`02c65000 fffff880`02c71000   nsiproxy nsiproxy.sys Tue Jul 14 04:51:02 2009 (4A5BC15E)
fffff880`02c71000 fffff880`02c7c000   mssmbios mssmbios.sys Tue Jul 14 05:01:10 2009 (4A5BC3BE)
fffff880`02c7c000 fffff880`02c8b000   discache discache.sys Tue Jul 14 05:07:18 2009 (4A5BC52E)
fffff880`02cbb000 fffff880`02d45000   afd      afd.sys      Tue Jul 14 04:51:40 2009 (4A5BC184)
fffff880`02d45000 fffff880`02d8a000   netbt    netbt.sys    Tue Jul 14 04:51:28 2009 (4A5BC178)
fffff880`02d8a000 fffff880`02d93000   wfplwf   wfplwf.sys   Tue Jul 14 05:39:26 2009 (4A5BCCB6)
fffff880`02d93000 fffff880`02db9000   pacer    pacer.sys    Tue Jul 14 05:39:41 2009 (4A5BCCC5)
fffff880`02db9000 fffff880`02dc8000   netbios  netbios.sys  Tue Jul 14 05:39:26 2009 (4A5BCCB6)
fffff880`02dc8000 fffff880`02de5000   serial   serial.sys   Tue Jul 14 05:30:40 2009 (4A5BCAA8)
fffff880`02de5000 fffff880`02e00000   wanarp   wanarp.sys   Tue Jul 14 05:40:21 2009 (4A5BCCED)
fffff880`03c24000 fffff880`03ca7000   csc      csc.sys      Tue Jul 14 04:54:26 2009 (4A5BC22A)
fffff880`03ca7000 fffff880`03cc5000   dfsc     dfsc.sys     Tue Jul 14 04:53:44 2009 (4A5BC200)
fffff880`03cc5000 fffff880`03cd6000   blbdrive blbdrive.sys Tue Jul 14 05:05:59 2009 (4A5BC4DF)
fffff880`03cd6000 fffff880`03cfc000   tunnel   tunnel.sys   Tue Jul 14 05:39:37 2009 (4A5BCCC1)
fffff880`03cfc000 fffff880`03d12000   intelppm intelppm.sys Tue Jul 14 04:49:25 2009 (4A5BC0FD)
fffff880`03d12000 fffff880`03d46000   atikmpag atikmpag.sys Sat Feb 20 01:15:51 2010 (4B7EEA6F)
fffff880`03d46000 fffff880`03d9c000   USBPORT  USBPORT.SYS  Tue Jul 14 05:36:31 2009 (4A5BCC07)
fffff880`03d9c000 fffff880`03dcc000   nusb3xhc nusb3xhc.sys Fri Nov 20 15:46:01 2009 (4B066C61)
fffff880`04200000 fffff880`0420f000   kbdclass kbdclass.sys Tue Jul 14 04:49:50 2009 (4A5BC116)
fffff880`0420f000 fffff880`0421e000   mouclass mouclass.sys Tue Jul 14 04:49:50 2009 (4A5BC116)
fffff880`0421e000 fffff880`0421f480   swenum   swenum.sys   Tue Jul 14 05:30:18 2009 (4A5BCA92)
fffff880`04254000 fffff880`04293000   Rt64win7 Rt64win7.sys Thu Aug 20 21:35:06 2009 (4A8D7432)
fffff880`04293000 fffff880`042d1000   1394ohci 1394ohci.sys Tue Jul 14 05:37:12 2009 (4A5BCC30)
fffff880`042d1000 fffff880`042de000   fdc      fdc.sys      Tue Jul 14 05:30:54 2009 (4A5BCAB6)
fffff880`042de000 fffff880`042ea000   serenum  serenum.sys  Tue Jul 14 05:30:33 2009 (4A5BCAA1)
fffff880`042ea000 fffff880`04307000   parport  parport.sys  Tue Jul 14 05:30:40 2009 (4A5BCAA8)
fffff880`04307000 fffff880`04310000   wmiacpi  wmiacpi.sys  Tue Jul 14 05:01:02 2009 (4A5BC3B6)
fffff880`04310000 fffff880`04320000   CompositeBus CompositeBus.sys Tue Jul 14 05:30:33 2009 (4A5BCAA1)
fffff880`04320000 fffff880`04336000   AgileVpn AgileVpn.sys Tue Jul 14 05:40:24 2009 (4A5BCCF0)
fffff880`04336000 fffff880`0435a000   rasl2tp  rasl2tp.sys  Tue Jul 14 05:40:11 2009 (4A5BCCE3)
fffff880`0435a000 fffff880`04366000   ndistapi ndistapi.sys Tue Jul 14 05:40:00 2009 (4A5BCCD8)
fffff880`04366000 fffff880`04395000   ndiswan  ndiswan.sys  Tue Jul 14 05:40:11 2009 (4A5BCCE3)
fffff880`04395000 fffff880`043b0000   raspppoe raspppoe.sys Tue Jul 14 05:40:17 2009 (4A5BCCE9)
fffff880`043b0000 fffff880`043d1000   raspptp  raspptp.sys  Tue Jul 14 05:40:18 2009 (4A5BCCEA)
fffff880`043d1000 fffff880`043eb000   rassstp  rassstp.sys  Tue Jul 14 05:40:25 2009 (4A5BCCF1)
fffff880`043eb000 fffff880`043f6000   rdpbus   rdpbus.sys   Tue Jul 14 05:47:46 2009 (4A5BCEAA)
fffff880`0480d000 fffff880`04e71000   atipmdag atipmdag.sys Sat Feb 20 01:57:23 2010 (4B7EF42B)
fffff880`04e71000 fffff880`04f65000   dxgkrnl  dxgkrnl.sys  Fri Oct 02 06:30:14 2009 (4AC5509E)
fffff880`04f65000 fffff880`04fab000   dxgmms1  dxgmms1.sys  Tue Jul 14 05:08:32 2009 (4A5BC578)
fffff880`04fab000 fffff880`04fcf000   HDAudBus HDAudBus.sys Tue Jul 14 05:36:13 2009 (4A5BCBF5)
fffff880`04fcf000 fffff880`04fdc000   usbuhci  usbuhci.sys  Tue Jul 14 05:36:27 2009 (4A5BCC03)
fffff880`04fdc000 fffff880`04fed000   usbehci  usbehci.sys  Tue Jul 14 05:36:30 2009 (4A5BCC06)
fffff880`04fed000 fffff880`04feef00   USBD     USBD.SYS     Tue Jul 14 05:36:23 2009 (4A5BCBFF)
fffff880`05200000 fffff880`05221000   WudfPf   WudfPf.sys   Tue Jul 14 05:35:37 2009 (4A5BCBD1)
fffff880`05221000 fffff880`05239000   rspndr   rspndr.sys   Tue Jul 14 05:38:50 2009 (4A5BCC92)
fffff880`05251000 fffff880`05294000   ks       ks.sys       Tue Jul 14 05:30:31 2009 (4A5BCA9F)
fffff880`05294000 fffff880`052a6000   umbus    umbus.sys    Tue Jul 14 05:36:56 2009 (4A5BCC20)
fffff880`052a6000 fffff880`05300000   usbhub   usbhub.sys   Tue Jul 14 05:37:09 2009 (4A5BCC2D)
fffff880`05300000 fffff880`05317000   nusb3hub nusb3hub.sys Fri Nov 20 15:45:57 2009 (4B066C5D)
fffff880`05317000 fffff880`05322000   flpydisk flpydisk.sys Tue Jul 14 05:30:54 2009 (4A5BCAB6)
fffff880`05322000 fffff880`05337000   NDProxy  NDProxy.SYS  Tue Jul 14 05:40:05 2009 (4A5BCCDD)
fffff880`05337000 fffff880`05359000   AtiHdmi  AtiHdmi.sys  Fri Jan 29 06:33:36 2010 (4B6233E8)
fffff880`05359000 fffff880`05396000   portcls  portcls.sys  Tue Jul 14 05:36:27 2009 (4A5BCC03)
fffff880`05396000 fffff880`053b8000   drmk     drmk.sys     Tue Jul 14 06:31:25 2009 (4A5BD8E5)
fffff880`053b8000 fffff880`053bd200   ksthunk  ksthunk.sys  Tue Jul 14 05:30:19 2009 (4A5BCA93)
fffff880`053be000 fffff880`053e1000   luafv    luafv.sys    Tue Jul 14 04:56:13 2009 (4A5BC295)
fffff880`07400000 fffff880`07415000   lltdio   lltdio.sys   Tue Jul 14 05:38:50 2009 (4A5BCC92)
fffff880`07420000 fffff880`0747c000   HdAudio  HdAudio.sys  Tue Jul 14 05:36:59 2009 (4A5BCC23)
fffff880`0747c000 fffff880`07488000   Dxapi    Dxapi.sys    Tue Jul 14 05:08:28 2009 (4A5BC574)
fffff880`07488000 fffff880`074dc000   udfs     udfs.sys     Tue Jul 14 04:53:37 2009 (4A5BC1F9)
fffff880`074dc000 fffff880`074ea000   crashdmp crashdmp.sys Tue Jul 14 05:31:01 2009 (4A5BCABD)
fffff880`074ea000 fffff880`074f6000   dump_dumpata dump_dumpata.sys Tue Jul 14 04:49:47 2009 (4A5BC113)
fffff880`074f6000 fffff880`074ff000   dump_atapi dump_atapi.sys Tue Jul 14 04:49:47 2009 (4A5BC113)
fffff880`074ff000 fffff880`07512000   dump_dumpfve dump_dumpfve.sys Tue Jul 14 04:51:51 2009 (4A5BC18F)
fffff880`07512000 fffff880`07520000   monitor  monitor.sys  Tue Jul 14 05:08:52 2009 (4A5BC58C)
fffff880`07520000 fffff880`0752e000   hidusb   hidusb.sys   Tue Jul 14 05:36:22 2009 (4A5BCBFE)
fffff880`0752e000 fffff880`07547000   HIDCLASS HIDCLASS.SYS Tue Jul 14 05:36:21 2009 (4A5BCBFD)
fffff880`07547000 fffff880`0754f080   HIDPARSE HIDPARSE.SYS Tue Jul 14 05:36:17 2009 (4A5BCBF9)
fffff880`07550000 fffff880`07578000   SaiKF622 SaiKF622.sys Tue Jun 02 18:08:08 2009 (4A251D30)
fffff880`07578000 fffff880`07593000   USBSTOR  USBSTOR.SYS  Tue Jul 14 05:36:34 2009 (4A5BCC0A)
fffff880`07593000 fffff880`075b0000   usbccgp  usbccgp.sys  Tue Jul 14 05:36:45 2009 (4A5BCC15)
fffff880`075b0000 fffff880`075be000   kbdhid   kbdhid.sys   Tue Jul 14 05:30:20 2009 (4A5BCA94)
fffff880`075be000 fffff880`075d1000   LHidFilt LHidFilt.Sys Wed Jun 17 22:19:39 2009 (4A391EA3)
fffff880`075d1000 fffff880`075de000   mouhid   mouhid.sys   Tue Jul 14 05:30:20 2009 (4A5BCA94)
fffff880`075de000 fffff880`075f2000   LMouFilt LMouFilt.Sys Wed Jun 17 22:19:43 2009 (4A391EA7)
fffff880`07e00000 fffff880`07e69000   srv2     srv2.sys     Tue Jul 14 04:55:02 2009 (4A5BC24E)
fffff880`07eaa000 fffff880`07f50000   peauth   peauth.sys   Tue Jul 14 06:31:19 2009 (4A5BD8DF)
fffff880`07f50000 fffff880`07f5b000   secdrv   secdrv.SYS   Wed Sep 13 18:48:38 2006 (4508052E)
fffff880`07f5b000 fffff880`07f88000   srvnet   srvnet.sys   Tue Dec 08 14:02:26 2009 (4B1E0F1A)
fffff880`07f88000 fffff880`07f9a000   tcpipreg tcpipreg.sys Tue Jul 14 05:39:49 2009 (4A5BCCCD)
fffff880`08471000 fffff880`0847c000   asyncmac asyncmac.sys Tue Jul 14 05:40:13 2009 (4A5BCCE5)
fffff880`08484000 fffff880`0851c000   srv      srv.sys      Tue Dec 08 14:02:55 2009 (4B1E0F37)
fffff880`0851c000 fffff880`08552000   fastfat  fastfat.SYS  Tue Jul 14 04:53:28 2009 (4A5BC1F0)
fffff880`08552000 fffff880`0855a000   rtkio    rtkio.sys    Sat Jun 20 11:30:25 2009 (4A3C7AF9)
fffff880`0855a000 fffff880`0858b000   WUDFRd   WUDFRd.sys   Tue Jul 14 05:36:06 2009 (4A5BCBEE)
fffff880`0858b000 fffff880`0859b000   MpNWMon  MpNWMon.sys  Sat Nov 21 08:26:38 2009 (4B0756E6)
fffff880`0859b000 fffff880`085a1000   RTCore64 RTCore64.sys Wed May 25 12:09:12 2005 (42941D90)
fffff960`00020000 fffff960`0032f000   win32k   win32k.sys   Tue Jul 14 05:10:16 2009 (4A5BC5E0)
fffff960`00580000 fffff960`0058a000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff960`00670000 fffff960`00697000   cdd      cdd.dll      Tue Jul 14 06:55:40 2009 (4A5BDE94)

Unloaded modules:
fffff880`08400000 fffff880`08471000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019b9000 fffff880`019c7000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019c7000 fffff880`019d3000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019d3000 fffff880`019dc000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019dc000 fffff880`019ef000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
start             end                 module name
fffff880`04293000 fffff880`042d1000   1394ohci 1394ohci.sys Tue Jul 14 05:37:12 2009 (4A5BCC30)
fffff880`00f6b000 fffff880`00fc2000   ACPI     ACPI.sys     Tue Jul 14 04:49:34 2009 (4A5BC106)
fffff880`02cbb000 fffff880`02d45000   afd      afd.sys      Tue Jul 14 04:51:40 2009 (4A5BC184)
fffff880`04320000 fffff880`04336000   AgileVpn AgileVpn.sys Tue Jul 14 05:40:24 2009 (4A5BCCF0)
fffff880`010b2000 fffff880`010bd000   amdxata  amdxata.sys  Tue May 19 23:26:59 2009 (4A12F2EB)
fffff880`08471000 fffff880`0847c000   asyncmac asyncmac.sys Tue Jul 14 05:40:13 2009 (4A5BCCE5)
fffff880`0107f000 fffff880`01088000   atapi    atapi.sys    Tue Jul 14 04:49:47 2009 (4A5BC113)
fffff880`01088000 fffff880`010b2000   ataport  ataport.SYS  Tue Jul 14 04:49:52 2009 (4A5BC118)
fffff880`05337000 fffff880`05359000   AtiHdmi  AtiHdmi.sys  Fri Jan 29 06:33:36 2010 (4B6233E8)
fffff880`03d12000 fffff880`03d46000   atikmpag atikmpag.sys Sat Feb 20 01:15:51 2010 (4B7EEA6F)
fffff880`0480d000 fffff880`04e71000   atipmdag atipmdag.sys Sat Feb 20 01:57:23 2010 (4B7EF42B)
fffff880`01860000 fffff880`01867000   Beep     Beep.SYS     Tue Jul 14 05:30:13 2009 (4A5BCA8D)
fffff880`03cc5000 fffff880`03cd6000   blbdrive blbdrive.sys Tue Jul 14 05:05:59 2009 (4A5BC4DF)
fffff880`02b69000 fffff880`02b87000   bowser   bowser.sys   Tue Jul 14 04:53:50 2009 (4A5BC206)
fffff960`00670000 fffff960`00697000   cdd      cdd.dll      Tue Jul 14 06:55:40 2009 (4A5BDE94)
fffff880`01800000 fffff880`0182a000   cdrom    cdrom.sys    Tue Jul 14 04:49:54 2009 (4A5BC11A)
fffff880`00d14000 fffff880`00dd4000   CI       CI.dll       Tue Jul 14 07:02:13 2009 (4A5BE01D)
fffff880`01989000 fffff880`019b9000   CLASSPNP CLASSPNP.SYS Tue Jul 14 04:49:58 2009 (4A5BC11E)
fffff880`00cb6000 fffff880`00d14000   CLFS     CLFS.SYS     Tue Jul 14 04:49:57 2009 (4A5BC11D)
fffff880`0117b000 fffff880`011ee000   cng      cng.sys      Tue Jul 14 05:19:40 2009 (4A5BC814)
fffff880`04310000 fffff880`04320000   CompositeBus CompositeBus.sys Tue Jul 14 05:30:33 2009 (4A5BCAA1)
fffff880`02a70000 fffff880`02a78000   cpuz132_x64 cpuz132_x64.sys Fri Mar 27 04:47:23 2009 (49CC0D03)
fffff880`074dc000 fffff880`074ea000   crashdmp crashdmp.sys Tue Jul 14 05:31:01 2009 (4A5BCABD)
fffff880`03c24000 fffff880`03ca7000   csc      csc.sys      Tue Jul 14 04:54:26 2009 (4A5BC22A)
fffff880`03ca7000 fffff880`03cc5000   dfsc     dfsc.sys     Tue Jul 14 04:53:44 2009 (4A5BC200)
fffff880`02c7c000 fffff880`02c8b000   discache discache.sys Tue Jul 14 05:07:18 2009 (4A5BC52E)
fffff880`01973000 fffff880`01989000   disk     disk.sys     Tue Jul 14 04:49:57 2009 (4A5BC11D)
fffff880`05396000 fffff880`053b8000   drmk     drmk.sys     Tue Jul 14 06:31:25 2009 (4A5BD8E5)
fffff880`074f6000 fffff880`074ff000   dump_atapi dump_atapi.sys Tue Jul 14 04:49:47 2009 (4A5BC113)
fffff880`074ea000 fffff880`074f6000   dump_dumpata dump_dumpata.sys Tue Jul 14 04:49:47 2009 (4A5BC113)
fffff880`074ff000 fffff880`07512000   dump_dumpfve dump_dumpfve.sys Tue Jul 14 04:51:51 2009 (4A5BC18F)
fffff880`0747c000 fffff880`07488000   Dxapi    Dxapi.sys    Tue Jul 14 05:08:28 2009 (4A5BC574)
fffff880`04e71000 fffff880`04f65000   dxgkrnl  dxgkrnl.sys  Fri Oct 02 06:30:14 2009 (4AC5509E)
fffff880`04f65000 fffff880`04fab000   dxgmms1  dxgmms1.sys  Tue Jul 14 05:08:32 2009 (4A5BC578)
fffff880`0851c000 fffff880`08552000   fastfat  fastfat.SYS  Tue Jul 14 04:53:28 2009 (4A5BC1F0)
fffff880`042d1000 fffff880`042de000   fdc      fdc.sys      Tue Jul 14 05:30:54 2009 (4A5BCAB6)
fffff880`01109000 fffff880`0111d000   fileinfo fileinfo.sys Tue Jul 14 05:04:25 2009 (4A5BC481)
fffff880`05317000 fffff880`05322000   flpydisk flpydisk.sys Tue Jul 14 05:30:54 2009 (4A5BCAB6)
fffff880`010bd000 fffff880`01109000   fltmgr   fltmgr.sys   Tue Jul 14 04:49:59 2009 (4A5BC11F)
fffff880`01211000 fffff880`0121b000   Fs_Rec   Fs_Rec.sys   Tue Jul 14 04:49:45 2009 (4A5BC111)
fffff880`01939000 fffff880`01973000   fvevol   fvevol.sys   Tue Jul 14 04:52:15 2009 (4A5BC1A7)
fffff880`015ae000 fffff880`015f8000   fwpkclnt fwpkclnt.sys Tue Jul 14 04:51:08 2009 (4A5BC164)
fffff800`031e2000 fffff800`0322b000   hal      hal.dll      Tue Jul 14 06:57:36 2009 (4A5BDF08)
fffff880`04fab000 fffff880`04fcf000   HDAudBus HDAudBus.sys Tue Jul 14 05:36:13 2009 (4A5BCBF5)
fffff880`07420000 fffff880`0747c000   HdAudio  HdAudio.sys  Tue Jul 14 05:36:59 2009 (4A5BCC23)
fffff880`0752e000 fffff880`07547000   HIDCLASS HIDCLASS.SYS Tue Jul 14 05:36:21 2009 (4A5BCBFD)
fffff880`07547000 fffff880`0754f080   HIDPARSE HIDPARSE.SYS Tue Jul 14 05:36:17 2009 (4A5BCBF9)
fffff880`07520000 fffff880`0752e000   hidusb   hidusb.sys   Tue Jul 14 05:36:22 2009 (4A5BCBFE)
fffff880`02aa1000 fffff880`02b69000   HTTP     HTTP.sys     Tue Jul 14 04:52:16 2009 (4A5BC1A8)
fffff880`01930000 fffff880`01939000   hwpolicy hwpolicy.sys Tue Jul 14 04:49:22 2009 (4A5BC0FA)
fffff880`03cfc000 fffff880`03d12000   intelppm intelppm.sys Tue Jul 14 04:49:25 2009 (4A5BC0FD)
fffff880`00e8b000 fffff880`00eab000   jraid    jraid.sys    Thu Oct 29 13:44:20 2009 (4AE94EDC)
fffff880`04200000 fffff880`0420f000   kbdclass kbdclass.sys Tue Jul 14 04:49:50 2009 (4A5BC116)
fffff880`075b0000 fffff880`075be000   kbdhid   kbdhid.sys   Tue Jul 14 05:30:20 2009 (4A5BCA94)
fffff800`00bd0000 fffff800`00bda000   kdcom    kdcom.dll    Tue Jul 14 07:01:07 2009 (4A5BDFDB)
fffff880`05251000 fffff880`05294000   ks       ks.sys       Tue Jul 14 05:30:31 2009 (4A5BCA9F)
fffff880`013e5000 fffff880`013ff000   ksecdd   ksecdd.sys   Tue Jul 14 04:50:54 2009 (4A5BC156)
fffff880`01460000 fffff880`0148b000   ksecpkg  ksecpkg.sys  Tue Jul 14 05:20:34 2009 (4A5BC84A)
fffff880`053b8000 fffff880`053bd200   ksthunk  ksthunk.sys  Tue Jul 14 05:30:19 2009 (4A5BCA93)
fffff880`075be000 fffff880`075d1000   LHidFilt LHidFilt.Sys Wed Jun 17 22:19:39 2009 (4A391EA3)
fffff880`07400000 fffff880`07415000   lltdio   lltdio.sys   Tue Jul 14 05:38:50 2009 (4A5BCC92)
fffff880`075de000 fffff880`075f2000   LMouFilt LMouFilt.Sys Wed Jun 17 22:19:43 2009 (4A391EA7)
fffff880`053be000 fffff880`053e1000   luafv    luafv.sys    Tue Jul 14 04:56:13 2009 (4A5BC295)
fffff880`00c5e000 fffff880`00ca2000   mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Tue Jul 14 06:59:10 2009 (4A5BDF66)
fffff880`07512000 fffff880`07520000   monitor  monitor.sys  Tue Jul 14 05:08:52 2009 (4A5BC58C)
fffff880`0420f000 fffff880`0421e000   mouclass mouclass.sys Tue Jul 14 04:49:50 2009 (4A5BC116)
fffff880`075d1000 fffff880`075de000   mouhid   mouhid.sys   Tue Jul 14 05:30:20 2009 (4A5BCA94)
fffff880`01065000 fffff880`0107f000   mountmgr mountmgr.sys Tue Jul 14 04:49:54 2009 (4A5BC11A)
fffff880`0182a000 fffff880`01857000   MpFilter MpFilter.sys Sat Nov 21 08:26:47 2009 (4B0756EF)
fffff880`0858b000 fffff880`0859b000   MpNWMon  MpNWMon.sys  Sat Nov 21 08:26:38 2009 (4B0756E6)
fffff880`02b87000 fffff880`02b9f000   mpsdrv   mpsdrv.sys   Tue Jul 14 05:38:25 2009 (4A5BCC79)
fffff880`02b9f000 fffff880`02bcc000   mrxsmb   mrxsmb.sys   Fri Jan 08 09:08:26 2010 (4B46A8B2)
fffff880`02a00000 fffff880`02a4d000   mrxsmb10 mrxsmb10.sys Fri Jan 08 09:08:32 2010 (4B46A8B8)
fffff880`02a4d000 fffff880`02a70000   mrxsmb20 mrxsmb20.sys Tue Jul 14 04:54:05 2009 (4A5BC215)
fffff880`014ad000 fffff880`014b8000   Msfs     Msfs.SYS     Tue Jul 14 04:49:47 2009 (4A5BC113)
fffff880`00fcb000 fffff880`00fd5000   msisadrv msisadrv.sys Tue Jul 14 04:49:26 2009 (4A5BC0FE)
fffff880`0111d000 fffff880`0117b000   msrpc    msrpc.sys    Tue Jul 14 04:51:32 2009 (4A5BC17C)
fffff880`02c71000 fffff880`02c7c000   mssmbios mssmbios.sys Tue Jul 14 05:01:10 2009 (4A5BC3BE)
fffff880`0191e000 fffff880`01930000   mup      mup.sys      Tue Jul 14 04:53:45 2009 (4A5BC201)
fffff880`00e81000 fffff880`00e8b000   mv91cons mv91cons.sys Wed Sep 23 03:06:37 2009 (4AB94365)
fffff880`014bc000 fffff880`015ae000   ndis     ndis.sys     Tue Jul 14 04:51:40 2009 (4A5BC184)
fffff880`0435a000 fffff880`04366000   ndistapi ndistapi.sys Tue Jul 14 05:40:00 2009 (4A5BCCD8)
fffff880`04366000 fffff880`04395000   ndiswan  ndiswan.sys  Tue Jul 14 05:40:11 2009 (4A5BCCE3)
fffff880`05322000 fffff880`05337000   NDProxy  NDProxy.SYS  Tue Jul 14 05:40:05 2009 (4A5BCCDD)
fffff880`02db9000 fffff880`02dc8000   netbios  netbios.sys  Tue Jul 14 05:39:26 2009 (4A5BCCB6)
fffff880`02d45000 fffff880`02d8a000   netbt    netbt.sys    Tue Jul 14 04:51:28 2009 (4A5BC178)
fffff880`01400000 fffff880`01460000   NETIO    NETIO.SYS    Tue Jul 14 04:51:46 2009 (4A5BC18A)
fffff880`011ee000 fffff880`011ff000   Npfs     Npfs.SYS     Tue Jul 14 04:49:48 2009 (4A5BC114)
fffff880`02c65000 fffff880`02c71000   nsiproxy nsiproxy.sys Tue Jul 14 04:51:02 2009 (4A5BC15E)
fffff800`02c05000 fffff800`031e2000   nt       ntkrnlmp.exe Tue Jul 14 05:10:48 2009 (4A5BC600)
fffff880`01242000 fffff880`013e5000   Ntfs     Ntfs.sys     Tue Jul 14 04:50:47 2009 (4A5BC14F)
fffff880`01857000 fffff880`01860000   Null     Null.SYS     Tue Jul 14 04:49:37 2009 (4A5BC109)
fffff880`05300000 fffff880`05317000   nusb3hub nusb3hub.sys Fri Nov 20 15:45:57 2009 (4B066C5D)
fffff880`03d9c000 fffff880`03dcc000   nusb3xhc nusb3xhc.sys Fri Nov 20 15:46:01 2009 (4B066C61)
fffff880`02d93000 fffff880`02db9000   pacer    pacer.sys    Tue Jul 14 05:39:41 2009 (4A5BCCC5)
fffff880`042ea000 fffff880`04307000   parport  parport.sys  Tue Jul 14 05:30:40 2009 (4A5BCAA8)
fffff880`00e40000 fffff880`00e55000   partmgr  partmgr.sys  Tue Jul 14 04:49:58 2009 (4A5BC11E)
fffff880`00e00000 fffff880`00e33000   pci      pci.sys      Tue Jul 14 04:49:51 2009 (4A5BC117)
fffff880`00e6a000 fffff880`00e71000   pciide   pciide.sys   Tue Jul 14 04:49:49 2009 (4A5BC115)
fffff880`00e71000 fffff880`00e81000   PCIIDEX  PCIIDEX.SYS  Tue Jul 14 04:49:48 2009 (4A5BC114)
fffff880`01200000 fffff880`01211000   pcw      pcw.sys      Tue Jul 14 04:49:27 2009 (4A5BC0FF)
fffff880`07eaa000 fffff880`07f50000   peauth   peauth.sys   Tue Jul 14 06:31:19 2009 (4A5BD8DF)
fffff880`05359000 fffff880`05396000   portcls  portcls.sys  Tue Jul 14 05:36:27 2009 (4A5BCC03)
fffff880`00ca2000 fffff880`00cb6000   PSHED    PSHED.dll    Tue Jul 14 07:02:23 2009 (4A5BE027)
fffff880`04336000 fffff880`0435a000   rasl2tp  rasl2tp.sys  Tue Jul 14 05:40:11 2009 (4A5BCCE3)
fffff880`04395000 fffff880`043b0000   raspppoe raspppoe.sys Tue Jul 14 05:40:17 2009 (4A5BCCE9)
fffff880`043b0000 fffff880`043d1000   raspptp  raspptp.sys  Tue Jul 14 05:40:18 2009 (4A5BCCEA)
fffff880`043d1000 fffff880`043eb000   rassstp  rassstp.sys  Tue Jul 14 05:40:25 2009 (4A5BCCF1)
fffff880`02c14000 fffff880`02c65000   rdbss    rdbss.sys    Tue Jul 14 04:54:09 2009 (4A5BC219)
fffff880`043eb000 fffff880`043f6000   rdpbus   rdpbus.sys   Tue Jul 14 05:47:46 2009 (4A5BCEAA)
fffff880`019ef000 fffff880`019f8000   RDPCDD   RDPCDD.sys   Tue Jul 14 05:46:34 2009 (4A5BCE62)
fffff880`0149b000 fffff880`014a4000   rdpencdd rdpencdd.sys Tue Jul 14 05:46:34 2009 (4A5BCE62)
fffff880`014a4000 fffff880`014ad000   rdprefmp rdprefmp.sys Tue Jul 14 05:46:35 2009 (4A5BCE63)
fffff880`018e4000 fffff880`0191e000   rdyboost rdyboost.sys Tue Jul 14 05:04:34 2009 (4A5BC48A)
fffff880`05221000 fffff880`05239000   rspndr   rspndr.sys   Tue Jul 14 05:38:50 2009 (4A5BCC92)
fffff880`04254000 fffff880`04293000   Rt64win7 Rt64win7.sys Thu Aug 20 21:35:06 2009 (4A8D7432)
fffff880`0859b000 fffff880`085a1000   RTCore64 RTCore64.sys Wed May 25 12:09:12 2005 (42941D90)
fffff880`08552000 fffff880`0855a000   rtkio    rtkio.sys    Sat Jun 20 11:30:25 2009 (4A3C7AF9)
fffff880`07550000 fffff880`07578000   SaiKF622 SaiKF622.sys Tue Jun 02 18:08:08 2009 (4A251D30)
fffff880`01036000 fffff880`01065000   SCSIPORT SCSIPORT.SYS Tue Jul 14 05:31:04 2009 (4A5BCAC0)
fffff880`07f50000 fffff880`07f5b000   secdrv   secdrv.SYS   Wed Sep 13 18:48:38 2006 (4508052E)
fffff880`042de000 fffff880`042ea000   serenum  serenum.sys  Tue Jul 14 05:30:33 2009 (4A5BCAA1)
fffff880`02dc8000 fffff880`02de5000   serial   serial.sys   Tue Jul 14 05:30:40 2009 (4A5BCAA8)
fffff880`018dd000 fffff880`018e4000   speedfan speedfan.sys Sun Sep 24 18:56:48 2006 (45168798)
fffff880`018d5000 fffff880`018dd000   spldr    spldr.sys    Mon May 11 22:26:27 2009 (4A0858BB)
fffff880`08484000 fffff880`0851c000   srv      srv.sys      Tue Dec 08 14:02:55 2009 (4B1E0F37)
fffff880`07e00000 fffff880`07e69000   srv2     srv2.sys     Tue Jul 14 04:55:02 2009 (4A5BC24E)
fffff880`07f5b000 fffff880`07f88000   srvnet   srvnet.sys   Tue Dec 08 14:02:26 2009 (4B1E0F1A)
fffff880`0421e000 fffff880`0421f480   swenum   swenum.sys   Tue Jul 14 05:30:18 2009 (4A5BCA92)
fffff880`01602000 fffff880`017ff000   tcpip    tcpip.sys    Tue Jul 14 04:55:34 2009 (4A5BC26E)
fffff880`07f88000 fffff880`07f9a000   tcpipreg tcpipreg.sys Tue Jul 14 05:39:49 2009 (4A5BCCCD)
fffff880`0101e000 fffff880`0102b000   TDI      TDI.SYS      Tue Jul 14 04:51:18 2009 (4A5BC16E)
fffff880`01000000 fffff880`0101e000   tdx      tdx.sys      Tue Jul 14 04:51:15 2009 (4A5BC16B)
fffff880`02c00000 fffff880`02c14000   termdd   termdd.sys   Tue Jul 14 05:46:36 2009 (4A5BCE64)
fffff960`00580000 fffff960`0058a000   TSDDD    TSDDD.dll    unavailable (00000000)
fffff880`03cd6000 fffff880`03cfc000   tunnel   tunnel.sys   Tue Jul 14 05:39:37 2009 (4A5BCCC1)
fffff880`07488000 fffff880`074dc000   udfs     udfs.sys     Tue Jul 14 04:53:37 2009 (4A5BC1F9)
fffff880`05294000 fffff880`052a6000   umbus    umbus.sys    Tue Jul 14 05:36:56 2009 (4A5BCC20)
fffff880`07593000 fffff880`075b0000   usbccgp  usbccgp.sys  Tue Jul 14 05:36:45 2009 (4A5BCC15)
fffff880`04fed000 fffff880`04feef00   USBD     USBD.SYS     Tue Jul 14 05:36:23 2009 (4A5BCBFF)
fffff880`04fdc000 fffff880`04fed000   usbehci  usbehci.sys  Tue Jul 14 05:36:30 2009 (4A5BCC06)
fffff880`052a6000 fffff880`05300000   usbhub   usbhub.sys   Tue Jul 14 05:37:09 2009 (4A5BCC2D)
fffff880`03d46000 fffff880`03d9c000   USBPORT  USBPORT.SYS  Tue Jul 14 05:36:31 2009 (4A5BCC07)
fffff880`07578000 fffff880`07593000   USBSTOR  USBSTOR.SYS  Tue Jul 14 05:36:34 2009 (4A5BCC0A)
fffff880`04fcf000 fffff880`04fdc000   usbuhci  usbuhci.sys  Tue Jul 14 05:36:27 2009 (4A5BCC03)
fffff880`00e33000 fffff880`00e40000   vdrvroot vdrvroot.sys Tue Jul 14 05:31:31 2009 (4A5BCADB)
fffff880`01867000 fffff880`01875000   vga      vga.sys      Tue Jul 14 05:08:47 2009 (4A5BC587)
fffff880`0121b000 fffff880`01240000   VIDEOPRT VIDEOPRT.SYS Tue Jul 14 05:08:51 2009 (4A5BC58B)
fffff880`0148b000 fffff880`0149b000   vmstorfl vmstorfl.sys Tue Jul 14 05:12:54 2009 (4A5BC67E)
fffff880`00e55000 fffff880`00e6a000   volmgr   volmgr.sys   Tue Jul 14 04:49:57 2009 (4A5BC11D)
fffff880`00c00000 fffff880`00c5c000   volmgrx  volmgrx.sys  Tue Jul 14 04:50:33 2009 (4A5BC141)
fffff880`01889000 fffff880`018d5000   volsnap  volsnap.sys  Tue Jul 14 04:50:08 2009 (4A5BC128)
fffff880`02de5000 fffff880`02e00000   wanarp   wanarp.sys   Tue Jul 14 05:40:21 2009 (4A5BCCED)
fffff880`01875000 fffff880`01885000   watchdog watchdog.sys Tue Jul 14 05:07:35 2009 (4A5BC53F)
fffff880`00eb8000 fffff880`00f5c000   Wdf01000 Wdf01000.sys Tue Jul 14 04:52:07 2009 (4A5BC19F)
fffff880`00f5c000 fffff880`00f6b000   WDFLDR   WDFLDR.SYS   Tue Jul 14 04:49:54 2009 (4A5BC11A)
fffff880`02d8a000 fffff880`02d93000   wfplwf   wfplwf.sys   Tue Jul 14 05:39:26 2009 (4A5BCCB6)
fffff960`00020000 fffff960`0032f000   win32k   win32k.sys   Tue Jul 14 05:10:16 2009 (4A5BC5E0)
fffff880`04307000 fffff880`04310000   wmiacpi  wmiacpi.sys  Tue Jul 14 05:01:02 2009 (4A5BC3B6)
fffff880`00fc2000 fffff880`00fcb000   WMILIB   WMILIB.SYS   Tue Jul 14 04:49:51 2009 (4A5BC117)
fffff880`05200000 fffff880`05221000   WudfPf   WudfPf.sys   Tue Jul 14 05:35:37 2009 (4A5BCBD1)
fffff880`0855a000 fffff880`0858b000   WUDFRd   WUDFRd.sys   Tue Jul 14 05:36:06 2009 (4A5BCBEE)

Unloaded modules:
fffff880`08400000 fffff880`08471000   spsys.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019b9000 fffff880`019c7000   crashdmp.sys
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019c7000 fffff880`019d3000   dump_ataport
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019d3000 fffff880`019dc000   dump_atapi.s
    Timestamp: unavailable (00000000)
    Checksum:  00000000
fffff880`019dc000 fffff880`019ef000   dump_dumpfve
    Timestamp: unavailable (00000000)
    Checksum:  00000000
Bugcheck code 0000003B
Arguments 00000000`c0000005 fffff800`02cc272d fffff880`0a555070 00000000`00000000

Hope this helps,
Captain

The First Dump analysis in Windows 8 Forum !!

**iseeuu** · 03-11-2010

Very helpful to get started Captain! Thank you for taking time to explain.

Cheers!

**Capt.Jack Sparrow** · 03-11-2010

Originally Posted by iseeuu

Very helpful to get started Captain! Thank you for taking time to explain.

Cheers!

My Pleasure Matey !!

- Captain

**Zen00** · 03-13-2010

Thanks, I'll have to go through this for a bit. Maybe tomorrow morning I'll run MemTest for a few hours.

Similar Threads
Thread	Forum
Reducing runtime memory in Windows 8	Windows 8 News
Load Windows 8 into memory entirely through Windows To Go and WDS	General Discussion
Don’t Wait for Windows 8, Dump XP by 2012, Start Upgrading to Windows 7 in 2010	Windows 8 News

Thread: Walk me Through Reading a Memory Dump

Thread Tools

Walk me Through Reading a Memory Dump