D
DeepBlueDiver
Hi everyone,
Wonder if anyone can give me any advise on a bugcheck we have started to experience. We have 4 domain controllers, two physical and two virtual. All are 2012R2 and patched monthly with the Quality Rollup patch. Although one of the physicals has experienced the same issue once, the two virtual DC's have crashed nine times since March with a bugcheck code of 0xC0000244. I understand this to be due to the fact that the server cannot write to the security event log but don't understand why. The event logs are set to overwrite events as needed so in theory this should not happen. The events occur at random times and the event logs don't show any other issues around the times of the crashes. I have ran a perfmon to see if their was any resource issues at the time of the crash and the servers appeared pretty idle at the time. I have also used the kernel debugger , albeit ran on a windows 8 machine, to analyze the memory dump and the output is below if anyone can go any further in analyzing that than I can. The bug check for that dump was 0xc0000244 (0xffffffffc0000017, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000). Not sure if the references to mvagtdrv.sys at the bottom are pointing me to AV but hopefully someone can tell me what they think. Thanks in advance for any help or suggestions
Opened log file 'c:\temp\debuglog.txt'
1: kd> .sympath srv*Symbol information
Symbol search path is: srv*Symbol information
Expanded Symbol search path is: srv*Symbol information
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*Symbol information
1: kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q
Loading Kernel Symbols
...............................................................
................................................................
.......
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Unknown bugcheck code (c0000244)
Unknown bugcheck description
Arguments:
Arg1: ffffffffc0000017
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
DUMP_CLASS: 1
DUMP_QUALIFIER: 401
BUILD_VERSION_STRING: 9600.18895.amd64fre.winblue_ltsb.180101-1800
SYSTEM_MANUFACTURER: VMware, Inc.
VIRTUAL_MACHINE: VMware
SYSTEM_PRODUCT_NAME: VMware Virtual Platform
SYSTEM_VERSION: None
BIOS_VENDOR: Phoenix Technologies LTD
BIOS_VERSION: 6.00
BIOS_DATE: 09/21/2015
BASEBOARD_MANUFACTURER: Intel Corporation
BASEBOARD_PRODUCT: 440BX Desktop Reference Platform
BASEBOARD_VERSION: None
DUMP_TYPE: 1
BUGCHECK_P1: ffffffffc0000017
BUGCHECK_P2: 0
BUGCHECK_P3: 0
BUGCHECK_P4: 0
CPU_COUNT: 2
CPU_MHZ: a28
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 3a
CPU_STEPPING: 0
CPU_MICROCODE: 6,3a,0,0 (F,M,S,R) SIG: 428'00000000 (cache) 428'00000000 (init)
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0xC0000244
PROCESS_NAME: System
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: xxxxxxxxxx
ANALYSIS_SESSION_TIME: 05-01-2018 10:57:43.0812
ANALYSIS_VERSION: 10.0.16299.91 x86fre
LAST_CONTROL_TRANSFER: from fffff8001488dcec to fffff800143c4ea0
STACK_TEXT:
ffffd000`231b1a48 fffff800`1488dcec : 00000000`c0000244 ffffffff`c0000017 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
ffffd000`231b1a50 fffff800`1448212f : fffff800`00000000 fffff800`00000002 fffff800`14554c90 00000000`00000001 : nt!SepAuditFailed+0xbc
ffffd000`231b1aa0 fffff800`1431492f : fffff800`142a4100 fffff800`14481f54 ffffe000`ef1ac880 00000000`00000000 : nt!SepRmCallLsa+0x1db
ffffd000`231b1b50 fffff800`14367764 : ffffe000`eabea0d0 fffff800`14559180 00000000`00000080 ffffe000`e92cb040 : nt!ExpWorkerThread+0x69f
ffffd000`231b1c00 fffff800`143cd1d6 : fffff800`14559180 ffffe000`ef1ac880 ffffe000`f639a880 00000000`00002000 : nt!PspSystemThreadStartup+0x178
ffffd000`231b1c60 00000000`00000000 : ffffd000`231b2000 ffffd000`231ac000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
THREAD_SHA1_HASH_MOD_FUNC: 47f7304011381033630433dd288e904b975fb666
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 2b089b6c4b6f8d98c384a05cde3e070602bbd091
THREAD_SHA1_HASH_MOD: ee8fcf1fb60cb6e3e2f60ddbed2ec02b5748a693
FOLLOWUP_IP:
nt!SepAuditFailed+bc
fffff800`1488dcec cc int 3
FAULT_INSTR_CODE: cccccccc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!SepAuditFailed+bc
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5a4b0308
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: bc
FAILURE_BUCKET_ID: 0xC0000244_nt!SepAuditFailed
BUCKET_ID: 0xC0000244_nt!SepAuditFailed
PRIMARY_PROBLEM_CLASS: 0xC0000244_nt!SepAuditFailed
TARGET_TIME: 2018-03-11T11:13:18.000Z
OSBUILD: 9600
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 400
PRODUCT_TYPE: 2
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 LanManNt TerminalServer DataCenter SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2018-01-02 03:56:56
BUILDDATESTAMP_STR: 180101-1800
BUILDLAB_STR: winblue_ltsb
BUILDOSVER_STR: 6.3.9600.18895.amd64fre.winblue_ltsb.180101-1800
ANALYSIS_SESSION_ELAPSED_TIME: bd6
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xc0000244_nt!sepauditfailed
FAILURE_ID_HASH: {179f170d-f6f7-5aab-df6b-17b465b80f49}
Followup: MachineOwner
---------
rax=0000000000000000 rbx=ffffffffc0000017 rcx=00000000c0000244
rdx=ffffffffc0000017 rsi=0000000000000001 rdi=ffffc000f930a470
rip=fffff800143c4ea0 rsp=ffffd000231b1a48 rbp=ffffe000ef1ac880
r8=0000000000000000 r9=0000000000000000 r10=fffff8001454d300
r11=ffffe000ef1ac880 r12=fffff80014516340 r13=00000000ffffffff
r14=fffff80014516401 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000246
nt!KeBugCheckEx:
fffff800`143c4ea0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffd000`231b1a50=00000000c0000244
# Child-SP RetAddr : Args to Child : Call Site
00 ffffd000`231b1a48 fffff800`1488dcec : 00000000`c0000244 ffffffff`c0000017 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
01 ffffd000`231b1a50 fffff800`1448212f : fffff800`00000000 fffff800`00000002 fffff800`14554c90 00000000`00000001 : nt!SepAuditFailed+0xbc
02 ffffd000`231b1aa0 fffff800`1431492f : fffff800`142a4100 fffff800`14481f54 ffffe000`ef1ac880 00000000`00000000 : nt!SepRmCallLsa+0x1db
03 ffffd000`231b1b50 fffff800`14367764 : ffffe000`eabea0d0 fffff800`14559180 00000000`00000080 ffffe000`e92cb040 : nt!ExpWorkerThread+0x69f
04 ffffd000`231b1c00 fffff800`143cd1d6 : fffff800`14559180 ffffe000`ef1ac880 ffffe000`f639a880 00000000`00002000 : nt!PspSystemThreadStartup+0x178
05 ffffd000`231b1c60 00000000`00000000 : ffffd000`231b2000 ffffd000`231ac000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
start end module name
fffff800`13342000 fffff800`1334b000 kd kd.dll Thu Aug 22 12:40:43 2013 (5215F8BB)
fffff800`14201000 fffff800`14270000 hal hal.dll Tue Jan 2 05:40:18 2018 (5A4B1B42)
fffff800`14270000 fffff800`149f8000 nt ntkrnlmp.exe Tue Jan 2 03:56:56 2018 (5A4B0308)
fffff801`f4012000 fffff801`f408f000 mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Fri Jul 4 13:59:36 2014 (53B6A538)
fffff801`f408f000 fffff801`f409d000 werkernel werkernel.sys Thu Aug 22 12:40:24 2013 (5215F8A8)
fffff801`f409d000 fffff801`f40ff000 CLFS CLFS.SYS Sat Jul 8 20:13:23 2017 (59612ED3)
fffff801`f40ff000 fffff801`f4121000 tm tm.sys Mon May 15 16:55:45 2017 (5919CF81)
fffff801`f4121000 fffff801`f4136000 PSHED PSHED.dll Sat Sep 14 14:57:19 2013 (52346B3F)
fffff801`f4136000 fffff801`f4140000 BOOTVID BOOTVID.dll Thu Aug 22 12:40:26 2013 (5215F8AA)
fffff801`f4140000 fffff801`f414b000 cmimcext cmimcext.sys Sun Oct 9 15:08:50 2016 (57FA4F72)
fffff801`f414b000 fffff801`f41d3000 CI CI.dll Sat Dec 6 03:23:28 2014 (548276B0)
fffff801`f41d3000 fffff801`f41f1000 intelppm intelppm.sys Thu Aug 22 09:46:35 2013 (5215CFEB)
fffff801`f4200000 fffff801`f4218000 acpiex acpiex.sys Thu Aug 22 12:37:47 2013 (5215F80B)
fffff801`f4218000 fffff801`f4223000 WppRecorder WppRecorder.sys Thu Aug 22 12:39:40 2013 (5215F87C)
fffff801`f4223000 fffff801`f42ab000 ACPI ACPI.sys Tue Oct 7 04:29:50 2014 (54335E2E)
fffff801`f42ae000 fffff801`f430b000 msrpc msrpc.sys Thu Aug 22 12:39:22 2013 (5215F86A)
fffff801`f430b000 fffff801`f43da000 Wdf01000 Wdf01000.sys Thu Aug 22 12:38:56 2013 (5215F850)
fffff801`f43da000 fffff801`f43eb000 WDFLDR WDFLDR.SYS Thu Aug 22 12:39:03 2013 (5215F857)
fffff801`f43eb000 fffff801`f43f5000 WMILIB WMILIB.SYS Thu Aug 22 12:40:23 2013 (5215F8A7)
fffff801`f4400000 fffff801`f446b000 spaceport spaceport.sys Tue Jan 10 22:37:47 2017 (5875623B)
fffff801`f446b000 fffff801`f4492000 VirtFile VirtFile.sys Wed Jan 29 17:33:03 2014 (52E93B4F)
fffff801`f4492000 fffff801`f44a2000 mouclass mouclass.sys Tue Nov 4 06:54:47 2014 (54587837)
fffff801`f44a2000 fffff801`f44bb000 vmxnet3 vmxnet3.sys Mon Apr 24 23:07:31 2017 (58FE7723)
fffff801`f44bb000 fffff801`f44c5000 vmgencounter vmgencounter.sys Thu Aug 22 12:38:23 2013 (5215F82F)
fffff801`f44c8000 fffff801`f4555000 cng cng.sys Tue Jan 2 05:39:08 2018 (5A4B1AFC)
fffff801`f4555000 fffff801`f4561000 BATTC BATTC.SYS Thu Aug 22 12:40:04 2013 (5215F894)
fffff801`f4561000 fffff801`f456b000 pnpmem pnpmem.sys Thu Aug 22 12:40:18 2013 (5215F8A2)
fffff801`f4570000 fffff801`f45b8000 pci pci.sys Thu Jul 24 12:45:24 2014 (53D0F1D4)
fffff801`f45b8000 fffff801`f45f0000 vm3dmp vm3dmp.sys Thu May 4 09:21:39 2017 (590AE493)
fffff801`f4600000 fffff801`f4616000 volmgr volmgr.sys Sat Apr 9 22:31:30 2016 (570974B2)
fffff801`f4616000 fffff801`f4624000 fdc fdc.sys Thu Aug 22 12:40:18 2013 (5215F8A2)
fffff801`f4624000 fffff801`f473b000 NDIS NDIS.SYS Sat Jan 14 19:29:40 2017 (587A7C24)
fffff801`f473b000 fffff801`f47b2000 NETIO NETIO.SYS Sat May 27 19:29:31 2017 (5929C58B)
fffff801`f47b2000 fffff801`f47bc000 msisadrv msisadrv.sys Thu Aug 22 12:39:03 2013 (5215F857)
fffff801`f47bc000 fffff801`f47c9000 vdrvroot vdrvroot.sys Thu Aug 22 12:38:49 2013 (5215F849)
fffff801`f47c9000 fffff801`f47e5000 pdc pdc.sys Thu Jul 6 07:19:51 2017 (595DD687)
fffff801`f47e5000 fffff801`f47fd000 partmgr partmgr.sys Wed Oct 8 08:34:42 2014 (5434E912)
fffff801`f4800000 fffff801`f480e000 pvscsi pvscsi.sys Tue Jan 26 12:18:30 2016 (56A76416)
fffff801`f480e000 fffff801`f486f000 storport storport.sys Sun Sep 17 19:52:55 2017 (59BEC487)
fffff801`f486f000 fffff801`f48cb000 fltmgr fltmgr.sys Tue Jan 2 05:40:16 2018 (5A4B1B40)
fffff801`f48cb000 fffff801`f48df000 dfsrro dfsrro.sys Thu Aug 22 12:39:34 2013 (5215F876)
fffff801`f48df000 fffff801`f48f1000 kbdclass kbdclass.sys Tue Nov 4 06:54:54 2014 (5458783E)
fffff801`f48f1000 fffff801`f48fb000 vmmouse vmmouse.sys Sat Feb 20 11:57:44 2016 (56C854B8)
fffff801`f48fb000 fffff801`f495a000 volmgrx volmgrx.sys Fri Jul 7 15:19:15 2017 (595F9863)
fffff801`f495a000 fffff801`f4963000 intelide intelide.sys Thu Aug 22 12:40:03 2013 (5215F893)
fffff801`f4963000 fffff801`f4972000 PCIIDEX PCIIDEX.SYS Thu Aug 22 12:39:41 2013 (5215F87D)
fffff801`f4972000 fffff801`f4989000 vsock vsock.sys Wed Jun 22 09:09:14 2016 (576A47AA)
fffff801`f4989000 fffff801`f49a3000 vmci vmci.sys Sat Jun 4 09:08:00 2016 (57528C60)
fffff801`f49a3000 fffff801`f49be000 mountmgr mountmgr.sys Sat May 6 19:34:28 2017 (590E1734)
fffff801`f49be000 fffff801`f49c8000 atapi atapi.sys Thu Aug 22 12:40:39 2013 (5215F8B7)
fffff801`f49c8000 fffff801`f49fd000 ataport ataport.SYS Thu Aug 22 12:39:38 2013 (5215F87A)
fffff801`f4a00000 fffff801`f4a0b000 kdnic kdnic.sys Thu Aug 22 12:38:26 2013 (5215F832)
fffff801`f4a0b000 fffff801`f4a1c000 umbus umbus.sys Thu Aug 22 12:38:59 2013 (5215F853)
fffff801`f4a1c000 fffff801`f4a3b000 i8042prt i8042prt.sys Tue Nov 4 06:54:54 2014 (5458783E)
fffff801`f4a41000 fffff801`f4c38000 Ntfs Ntfs.sys Tue Jan 2 03:55:02 2018 (5A4B0296)
fffff801`f4c38000 fffff801`f4c54000 ksecdd ksecdd.sys Wed Oct 29 02:47:36 2014 (54505548)
fffff801`f4c54000 fffff801`f4c64000 pcw pcw.sys Thu Aug 22 09:46:34 2013 (5215CFEA)
fffff801`f4c64000 fffff801`f4c6f000 Fs_Rec Fs_Rec.sys Thu Aug 22 09:46:33 2013 (5215CFE9)
fffff801`f4c6f000 fffff801`f4ca0000 ksecpkg ksecpkg.sys Wed May 18 23:11:05 2016 (573CE879)
fffff801`f4ca0000 fffff801`f4cf4000 CLASSPNP CLASSPNP.SYS Fri May 6 16:18:22 2016 (572CB5BE)
fffff801`f4cf4000 fffff801`f4d22000 cdrom cdrom.sys Thu Aug 22 09:46:35 2013 (5215CFEB)
fffff801`f4d22000 fffff801`f4d2e000 mssmbios mssmbios.sys Thu Aug 22 12:39:41 2013 (5215F87D)
fffff801`f4d2e000 fffff801`f4d55000 dfsc dfsc.sys Tue Jan 2 05:38:50 2018 (5A4B1AEA)
fffff801`f4d55000 fffff801`f4d6c000 ahcache ahcache.sys Fri Dec 12 00:51:20 2014 (548A3C08)
fffff801`f4d6c000 fffff801`f4d78000 ndistapi ndistapi.sys Sat Nov 8 04:00:40 2014 (545D9568)
fffff801`f4d78000 fffff801`f4db1000 ndiswan ndiswan.sys Tue Apr 5 23:37:23 2016 (57043E23)
fffff801`f4db1000 fffff801`f4dce000 rassstp rassstp.sys Wed Oct 29 02:45:50 2014 (545054DE)
fffff801`f4dce000 fffff801`f4ded000 AgileVpn AgileVpn.sys Thu Jul 7 23:32:00 2016 (577ED860)
fffff801`f4ded000 fffff801`f4dfc000 CompositeBus CompositeBus.sys Thu Aug 22 12:38:48 2013 (5215F848)
fffff801`f4e00000 fffff801`f4e0d000 BasicRender BasicRender.sys Wed Nov 8 15:55:00 2017 (5A0328D4)
fffff801`f4e0d000 fffff801`f4e26000 wanarp wanarp.sys Tue Jan 2 05:37:52 2018 (5A4B1AB0)
fffff801`f4e27000 fffff801`f508b000 tcpip tcpip.sys Tue Dec 5 16:56:52 2017 (5A26CFD4)
fffff801`f508b000 fffff801`f50f7000 fwpkclnt fwpkclnt.sys Tue Jun 6 21:39:35 2017 (59371307)
fffff801`f50f7000 fffff801`f511c000 wfplwfs wfplwfs.sys Tue Jan 2 05:38:17 2018 (5A4B1AC9)
fffff801`f511c000 fffff801`f516d000 volsnap volsnap.sys Fri Mar 11 14:44:06 2016 (56E2D9B6)
fffff801`f516d000 fffff801`f518d000 mup mup.sys Wed Apr 6 19:22:23 2016 (570553DF)
fffff801`f518d000 fffff801`f5199000 npsvctrig npsvctrig.sys Thu Aug 22 12:38:22 2013 (5215F82E)
fffff801`f5199000 fffff801`f51b5000 disk disk.sys Thu Jul 6 09:55:00 2017 (595DFAE4)
fffff801`f51b5000 fffff801`f51ca000 crashdmp crashdmp.sys Thu Aug 22 12:40:03 2013 (5215F893)
fffff801`f51e4000 fffff801`f51f4000 dfs dfs.sys Thu Aug 22 12:38:48 2013 (5215F848)
fffff801`f51f4000 fffff801`f51fd000 Null Null.SYS Thu Aug 22 12:40:24 2013 (5215F8A8)
fffff801`f5400000 fffff801`f5490000 afd afd.sys Tue Jan 2 05:38:33 2018 (5A4B1AD9)
fffff801`f5490000 fffff801`f54ba000 pacer pacer.sys Tue Jan 2 05:37:59 2018 (5A4B1AB7)
fffff801`f54ba000 fffff801`f54cb000 netbios netbios.sys Tue Jan 2 05:39:30 2018 (5A4B1B12)
fffff801`f54d1000 fffff801`f5650000 dxgkrnl dxgkrnl.sys Sat Oct 14 09:21:09 2017 (59E1C8F5)
fffff801`f5650000 fffff801`f5662000 watchdog watchdog.sys Sat Feb 22 12:14:39 2014 (530894AF)
fffff801`f5662000 fffff801`f56c5000 dxgmms1 dxgmms1.sys Sun Apr 9 21:38:11 2017 (58EA9BB3)
fffff801`f56c5000 fffff801`f56d7000 BasicDisplay BasicDisplay.sys Thu Aug 22 12:39:31 2013 (5215F873)
fffff801`f56d7000 fffff801`f56eb000 Npfs Npfs.SYS Thu Aug 22 12:40:25 2013 (5215F8A9)
fffff801`f56eb000 fffff801`f56f7000 Msfs Msfs.SYS Thu Aug 22 12:40:24 2013 (5215F8A8)
fffff801`f56f7000 fffff801`f5717000 tdx tdx.sys Wed Aug 2 04:17:15 2017 (5981443B)
fffff801`f5717000 fffff801`f5725000 TDI TDI.SYS Thu Aug 22 12:39:01 2013 (5215F855)
fffff801`f5725000 fffff801`f5730000 ws2ifsl ws2ifsl.sys Thu Aug 22 12:40:03 2013 (5215F893)
fffff801`f5730000 fffff801`f577b000 netbt netbt.sys Fri Aug 11 04:27:54 2017 (598D243A)
fffff801`f577b000 fffff801`f57e9000 rdbss rdbss.sys Tue Jan 2 05:38:59 2018 (5A4B1AF3)
fffff801`f57e9000 fffff801`f57f8000 nsiproxy nsiproxy.sys Sun Aug 13 18:19:15 2017 (59908A13)
fffff801`f57f8000 fffff801`f57fe380 CmBatt CmBatt.sys Thu Aug 22 12:39:43 2013 (5215F87F)
fffff801`f5854000 fffff801`f5875000 raspptp raspptp.sys Thu Aug 22 12:35:51 2013 (5215F797)
fffff801`f5875000 fffff801`f5895000 rasl2tp rasl2tp.sys Tue Feb 2 18:16:20 2016 (56B0F274)
fffff801`f5895000 fffff801`f58a0000 NdisVirtualBus NdisVirtualBus.sys Thu Aug 22 12:36:25 2013 (5215F7B9)
fffff801`f58a0000 fffff801`f58bb000 raspppoe raspppoe.sys Thu Aug 22 12:36:37 2013 (5215F7C5)
fffff801`f58bb000 fffff801`f58bc600 swenum swenum.sys Wed Oct 29 02:47:41 2014 (5450554D)
fffff801`f58bd000 fffff801`f590b000 ks ks.sys Fri Jul 4 13:58:59 2014 (53B6A513)
fffff801`f590b000 fffff801`f5916000 rdpbus rdpbus.sys Thu Aug 22 12:38:52 2013 (5215F84C)
fffff801`f5916000 fffff801`f592d000 NDProxy NDProxy.SYS Tue Jan 2 05:39:05 2018 (5A4B1AF9)
fffff801`f592d000 fffff801`f5939000 flpydisk flpydisk.sys Thu Aug 22 12:40:18 2013 (5215F8A2)
fffff801`f5939000 fffff801`f5945000 dump_diskdump dump_diskdump.sys Thu Aug 22 12:40:18 2013 (5215F8A2)
fffff801`f5945000 fffff801`f5953000 dump_pvscsi dump_pvscsi.sys Tue Jan 26 12:18:30 2016 (56A76416)
fffff801`f5953000 fffff801`f595af00 HIDPARSE HIDPARSE.SYS Sat May 14 00:08:58 2016 (57365E8A)
fffff801`f595b000 fffff801`f5969000 monitor monitor.sys Thu Aug 22 12:36:37 2013 (5215F7C5)
fffff801`f5969000 fffff801`f598d000 luafv luafv.sys Tue Oct 10 17:36:39 2017 (59DCF717)
fffff801`f598d000 fffff801`f59a1000 lltdio lltdio.sys Thu Aug 22 12:36:18 2013 (5215F7B2)
fffff801`f59a1000 fffff801`f59b9000 rspndr rspndr.sys Thu Aug 22 12:36:34 2013 (5215F7C2)
fffff801`f59b9000 fffff801`f59d9000 bowser bowser.sys Tue Oct 4 21:39:40 2016 (57F4138C)
fffff801`f59d9000 fffff801`f59f0000 mpsdrv mpsdrv.sys Wed Oct 29 02:45:31 2014 (545054CB)
fffff801`f5a00000 fffff801`f5aaf000 srv2 srv2.sys Tue Jan 2 05:39:19 2018 (5A4B1B07)
fffff801`f5abe000 fffff801`f5b2a000 mrxsmb mrxsmb.sys Tue Jan 2 05:38:07 2018 (5A4B1ABF)
fffff801`f5b2a000 fffff801`f5b61000 mrxsmb20 mrxsmb20.sys Wed Feb 1 19:44:06 2017 (58923A86)
fffff801`f5b61000 fffff801`f5ba3000 srvnet srvnet.sys Tue Jan 2 05:38:20 2018 (5A4B1ACC)
fffff801`f5c00000 fffff801`f5c4c000 mrxsmb10 mrxsmb10.sys Thu Sep 7 22:32:10 2017 (59B1BADA)
fffff801`f5cc0000 fffff801`f5db9000 HTTP HTTP.sys Tue Jan 2 05:38:55 2018 (5A4B1AEF)
fffff801`f5db9000 fffff801`f5dc4000 vmmemctl vmmemctl.sys Sat Jul 8 10:19:20 2017 (5960A398)
fffff801`f5dc4000 fffff801`f5dd4000 condrv condrv.sys Thu Aug 22 12:40:17 2013 (5215F8A1)
fffff801`f5e00000 fffff801`f5ed9480 mvagtdrv mvagtdrv.sys Wed May 3 12:28:04 2017 (5909BEC4)
fffff801`f5f49000 fffff801`f5ff2000 peauth peauth.sys Sat Feb 22 12:09:37 2014 (53089381)
fffff801`f60a6000 fffff801`f6134000 srv srv.sys Tue Jan 2 05:38:44 2018 (5A4B1AE4)
fffff801`f6134000 fffff801`f6146000 tcpipreg tcpipreg.sys Thu Mar 6 09:19:59 2014 (53183DBF)
fffff801`f6146000 fffff801`f6152000 vstor2_mntapi20_shared vstor2-mntapi20-shared.sys Wed Jan 15 12:11:38 2014 (52D67AFA)
fffff801`f6152000 fffff801`f617f000 tunnel tunnel.sys Fri Sep 4 20:24:03 2015 (55E9EFD3)
fffff801`f617f000 fffff801`f618a000 rdpvideominiport rdpvideominiport.sys Wed Oct 29 02:47:25 2014 (5450553D)
fffff801`f618a000 fffff801`f61be000 rdpdr rdpdr.sys Thu Aug 22 12:36:46 2013 (5215F7CE)
fffff801`f61be000 fffff801`f61cb000 terminpt terminpt.sys Thu Aug 22 12:39:16 2013 (5215F864)
fffff960`00055000 fffff960`00469000 win32k win32k.sys Tue Dec 5 16:57:28 2017 (5A26CFF8)
fffff960`0078d000 fffff960`00796000 TSDDD TSDDD.dll Thu Aug 22 12:40:32 2013 (5215F8B0)
fffff960`00988000 fffff960`009c2000 cdd cdd.dll Wed Oct 29 03:51:32 2014 (54506444)
Unloaded modules:
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
Closing open log file c:\temp\debuglog.txt
Continue reading...
Wonder if anyone can give me any advise on a bugcheck we have started to experience. We have 4 domain controllers, two physical and two virtual. All are 2012R2 and patched monthly with the Quality Rollup patch. Although one of the physicals has experienced the same issue once, the two virtual DC's have crashed nine times since March with a bugcheck code of 0xC0000244. I understand this to be due to the fact that the server cannot write to the security event log but don't understand why. The event logs are set to overwrite events as needed so in theory this should not happen. The events occur at random times and the event logs don't show any other issues around the times of the crashes. I have ran a perfmon to see if their was any resource issues at the time of the crash and the servers appeared pretty idle at the time. I have also used the kernel debugger , albeit ran on a windows 8 machine, to analyze the memory dump and the output is below if anyone can go any further in analyzing that than I can. The bug check for that dump was 0xc0000244 (0xffffffffc0000017, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000). Not sure if the references to mvagtdrv.sys at the bottom are pointing me to AV but hopefully someone can tell me what they think. Thanks in advance for any help or suggestions
Opened log file 'c:\temp\debuglog.txt'
1: kd> .sympath srv*Symbol information
Symbol search path is: srv*Symbol information
Expanded Symbol search path is: srv*Symbol information
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*Symbol information
1: kd> .reload;!analyze -v;r;kv;lmnt;.logclose;q
Loading Kernel Symbols
...............................................................
................................................................
.......
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Unknown bugcheck code (c0000244)
Unknown bugcheck description
Arguments:
Arg1: ffffffffc0000017
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
DUMP_CLASS: 1
DUMP_QUALIFIER: 401
BUILD_VERSION_STRING: 9600.18895.amd64fre.winblue_ltsb.180101-1800
SYSTEM_MANUFACTURER: VMware, Inc.
VIRTUAL_MACHINE: VMware
SYSTEM_PRODUCT_NAME: VMware Virtual Platform
SYSTEM_VERSION: None
BIOS_VENDOR: Phoenix Technologies LTD
BIOS_VERSION: 6.00
BIOS_DATE: 09/21/2015
BASEBOARD_MANUFACTURER: Intel Corporation
BASEBOARD_PRODUCT: 440BX Desktop Reference Platform
BASEBOARD_VERSION: None
DUMP_TYPE: 1
BUGCHECK_P1: ffffffffc0000017
BUGCHECK_P2: 0
BUGCHECK_P3: 0
BUGCHECK_P4: 0
CPU_COUNT: 2
CPU_MHZ: a28
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 3a
CPU_STEPPING: 0
CPU_MICROCODE: 6,3a,0,0 (F,M,S,R) SIG: 428'00000000 (cache) 428'00000000 (init)
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0xC0000244
PROCESS_NAME: System
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: xxxxxxxxxx
ANALYSIS_SESSION_TIME: 05-01-2018 10:57:43.0812
ANALYSIS_VERSION: 10.0.16299.91 x86fre
LAST_CONTROL_TRANSFER: from fffff8001488dcec to fffff800143c4ea0
STACK_TEXT:
ffffd000`231b1a48 fffff800`1488dcec : 00000000`c0000244 ffffffff`c0000017 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
ffffd000`231b1a50 fffff800`1448212f : fffff800`00000000 fffff800`00000002 fffff800`14554c90 00000000`00000001 : nt!SepAuditFailed+0xbc
ffffd000`231b1aa0 fffff800`1431492f : fffff800`142a4100 fffff800`14481f54 ffffe000`ef1ac880 00000000`00000000 : nt!SepRmCallLsa+0x1db
ffffd000`231b1b50 fffff800`14367764 : ffffe000`eabea0d0 fffff800`14559180 00000000`00000080 ffffe000`e92cb040 : nt!ExpWorkerThread+0x69f
ffffd000`231b1c00 fffff800`143cd1d6 : fffff800`14559180 ffffe000`ef1ac880 ffffe000`f639a880 00000000`00002000 : nt!PspSystemThreadStartup+0x178
ffffd000`231b1c60 00000000`00000000 : ffffd000`231b2000 ffffd000`231ac000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
THREAD_SHA1_HASH_MOD_FUNC: 47f7304011381033630433dd288e904b975fb666
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 2b089b6c4b6f8d98c384a05cde3e070602bbd091
THREAD_SHA1_HASH_MOD: ee8fcf1fb60cb6e3e2f60ddbed2ec02b5748a693
FOLLOWUP_IP:
nt!SepAuditFailed+bc
fffff800`1488dcec cc int 3
FAULT_INSTR_CODE: cccccccc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!SepAuditFailed+bc
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5a4b0308
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: bc
FAILURE_BUCKET_ID: 0xC0000244_nt!SepAuditFailed
BUCKET_ID: 0xC0000244_nt!SepAuditFailed
PRIMARY_PROBLEM_CLASS: 0xC0000244_nt!SepAuditFailed
TARGET_TIME: 2018-03-11T11:13:18.000Z
OSBUILD: 9600
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 400
PRODUCT_TYPE: 2
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 LanManNt TerminalServer DataCenter SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2018-01-02 03:56:56
BUILDDATESTAMP_STR: 180101-1800
BUILDLAB_STR: winblue_ltsb
BUILDOSVER_STR: 6.3.9600.18895.amd64fre.winblue_ltsb.180101-1800
ANALYSIS_SESSION_ELAPSED_TIME: bd6
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xc0000244_nt!sepauditfailed
FAILURE_ID_HASH: {179f170d-f6f7-5aab-df6b-17b465b80f49}
Followup: MachineOwner
---------
rax=0000000000000000 rbx=ffffffffc0000017 rcx=00000000c0000244
rdx=ffffffffc0000017 rsi=0000000000000001 rdi=ffffc000f930a470
rip=fffff800143c4ea0 rsp=ffffd000231b1a48 rbp=ffffe000ef1ac880
r8=0000000000000000 r9=0000000000000000 r10=fffff8001454d300
r11=ffffe000ef1ac880 r12=fffff80014516340 r13=00000000ffffffff
r14=fffff80014516401 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000246
nt!KeBugCheckEx:
fffff800`143c4ea0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffd000`231b1a50=00000000c0000244
# Child-SP RetAddr : Args to Child : Call Site
00 ffffd000`231b1a48 fffff800`1488dcec : 00000000`c0000244 ffffffff`c0000017 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
01 ffffd000`231b1a50 fffff800`1448212f : fffff800`00000000 fffff800`00000002 fffff800`14554c90 00000000`00000001 : nt!SepAuditFailed+0xbc
02 ffffd000`231b1aa0 fffff800`1431492f : fffff800`142a4100 fffff800`14481f54 ffffe000`ef1ac880 00000000`00000000 : nt!SepRmCallLsa+0x1db
03 ffffd000`231b1b50 fffff800`14367764 : ffffe000`eabea0d0 fffff800`14559180 00000000`00000080 ffffe000`e92cb040 : nt!ExpWorkerThread+0x69f
04 ffffd000`231b1c00 fffff800`143cd1d6 : fffff800`14559180 ffffe000`ef1ac880 ffffe000`f639a880 00000000`00002000 : nt!PspSystemThreadStartup+0x178
05 ffffd000`231b1c60 00000000`00000000 : ffffd000`231b2000 ffffd000`231ac000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
start end module name
fffff800`13342000 fffff800`1334b000 kd kd.dll Thu Aug 22 12:40:43 2013 (5215F8BB)
fffff800`14201000 fffff800`14270000 hal hal.dll Tue Jan 2 05:40:18 2018 (5A4B1B42)
fffff800`14270000 fffff800`149f8000 nt ntkrnlmp.exe Tue Jan 2 03:56:56 2018 (5A4B0308)
fffff801`f4012000 fffff801`f408f000 mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Fri Jul 4 13:59:36 2014 (53B6A538)
fffff801`f408f000 fffff801`f409d000 werkernel werkernel.sys Thu Aug 22 12:40:24 2013 (5215F8A8)
fffff801`f409d000 fffff801`f40ff000 CLFS CLFS.SYS Sat Jul 8 20:13:23 2017 (59612ED3)
fffff801`f40ff000 fffff801`f4121000 tm tm.sys Mon May 15 16:55:45 2017 (5919CF81)
fffff801`f4121000 fffff801`f4136000 PSHED PSHED.dll Sat Sep 14 14:57:19 2013 (52346B3F)
fffff801`f4136000 fffff801`f4140000 BOOTVID BOOTVID.dll Thu Aug 22 12:40:26 2013 (5215F8AA)
fffff801`f4140000 fffff801`f414b000 cmimcext cmimcext.sys Sun Oct 9 15:08:50 2016 (57FA4F72)
fffff801`f414b000 fffff801`f41d3000 CI CI.dll Sat Dec 6 03:23:28 2014 (548276B0)
fffff801`f41d3000 fffff801`f41f1000 intelppm intelppm.sys Thu Aug 22 09:46:35 2013 (5215CFEB)
fffff801`f4200000 fffff801`f4218000 acpiex acpiex.sys Thu Aug 22 12:37:47 2013 (5215F80B)
fffff801`f4218000 fffff801`f4223000 WppRecorder WppRecorder.sys Thu Aug 22 12:39:40 2013 (5215F87C)
fffff801`f4223000 fffff801`f42ab000 ACPI ACPI.sys Tue Oct 7 04:29:50 2014 (54335E2E)
fffff801`f42ae000 fffff801`f430b000 msrpc msrpc.sys Thu Aug 22 12:39:22 2013 (5215F86A)
fffff801`f430b000 fffff801`f43da000 Wdf01000 Wdf01000.sys Thu Aug 22 12:38:56 2013 (5215F850)
fffff801`f43da000 fffff801`f43eb000 WDFLDR WDFLDR.SYS Thu Aug 22 12:39:03 2013 (5215F857)
fffff801`f43eb000 fffff801`f43f5000 WMILIB WMILIB.SYS Thu Aug 22 12:40:23 2013 (5215F8A7)
fffff801`f4400000 fffff801`f446b000 spaceport spaceport.sys Tue Jan 10 22:37:47 2017 (5875623B)
fffff801`f446b000 fffff801`f4492000 VirtFile VirtFile.sys Wed Jan 29 17:33:03 2014 (52E93B4F)
fffff801`f4492000 fffff801`f44a2000 mouclass mouclass.sys Tue Nov 4 06:54:47 2014 (54587837)
fffff801`f44a2000 fffff801`f44bb000 vmxnet3 vmxnet3.sys Mon Apr 24 23:07:31 2017 (58FE7723)
fffff801`f44bb000 fffff801`f44c5000 vmgencounter vmgencounter.sys Thu Aug 22 12:38:23 2013 (5215F82F)
fffff801`f44c8000 fffff801`f4555000 cng cng.sys Tue Jan 2 05:39:08 2018 (5A4B1AFC)
fffff801`f4555000 fffff801`f4561000 BATTC BATTC.SYS Thu Aug 22 12:40:04 2013 (5215F894)
fffff801`f4561000 fffff801`f456b000 pnpmem pnpmem.sys Thu Aug 22 12:40:18 2013 (5215F8A2)
fffff801`f4570000 fffff801`f45b8000 pci pci.sys Thu Jul 24 12:45:24 2014 (53D0F1D4)
fffff801`f45b8000 fffff801`f45f0000 vm3dmp vm3dmp.sys Thu May 4 09:21:39 2017 (590AE493)
fffff801`f4600000 fffff801`f4616000 volmgr volmgr.sys Sat Apr 9 22:31:30 2016 (570974B2)
fffff801`f4616000 fffff801`f4624000 fdc fdc.sys Thu Aug 22 12:40:18 2013 (5215F8A2)
fffff801`f4624000 fffff801`f473b000 NDIS NDIS.SYS Sat Jan 14 19:29:40 2017 (587A7C24)
fffff801`f473b000 fffff801`f47b2000 NETIO NETIO.SYS Sat May 27 19:29:31 2017 (5929C58B)
fffff801`f47b2000 fffff801`f47bc000 msisadrv msisadrv.sys Thu Aug 22 12:39:03 2013 (5215F857)
fffff801`f47bc000 fffff801`f47c9000 vdrvroot vdrvroot.sys Thu Aug 22 12:38:49 2013 (5215F849)
fffff801`f47c9000 fffff801`f47e5000 pdc pdc.sys Thu Jul 6 07:19:51 2017 (595DD687)
fffff801`f47e5000 fffff801`f47fd000 partmgr partmgr.sys Wed Oct 8 08:34:42 2014 (5434E912)
fffff801`f4800000 fffff801`f480e000 pvscsi pvscsi.sys Tue Jan 26 12:18:30 2016 (56A76416)
fffff801`f480e000 fffff801`f486f000 storport storport.sys Sun Sep 17 19:52:55 2017 (59BEC487)
fffff801`f486f000 fffff801`f48cb000 fltmgr fltmgr.sys Tue Jan 2 05:40:16 2018 (5A4B1B40)
fffff801`f48cb000 fffff801`f48df000 dfsrro dfsrro.sys Thu Aug 22 12:39:34 2013 (5215F876)
fffff801`f48df000 fffff801`f48f1000 kbdclass kbdclass.sys Tue Nov 4 06:54:54 2014 (5458783E)
fffff801`f48f1000 fffff801`f48fb000 vmmouse vmmouse.sys Sat Feb 20 11:57:44 2016 (56C854B8)
fffff801`f48fb000 fffff801`f495a000 volmgrx volmgrx.sys Fri Jul 7 15:19:15 2017 (595F9863)
fffff801`f495a000 fffff801`f4963000 intelide intelide.sys Thu Aug 22 12:40:03 2013 (5215F893)
fffff801`f4963000 fffff801`f4972000 PCIIDEX PCIIDEX.SYS Thu Aug 22 12:39:41 2013 (5215F87D)
fffff801`f4972000 fffff801`f4989000 vsock vsock.sys Wed Jun 22 09:09:14 2016 (576A47AA)
fffff801`f4989000 fffff801`f49a3000 vmci vmci.sys Sat Jun 4 09:08:00 2016 (57528C60)
fffff801`f49a3000 fffff801`f49be000 mountmgr mountmgr.sys Sat May 6 19:34:28 2017 (590E1734)
fffff801`f49be000 fffff801`f49c8000 atapi atapi.sys Thu Aug 22 12:40:39 2013 (5215F8B7)
fffff801`f49c8000 fffff801`f49fd000 ataport ataport.SYS Thu Aug 22 12:39:38 2013 (5215F87A)
fffff801`f4a00000 fffff801`f4a0b000 kdnic kdnic.sys Thu Aug 22 12:38:26 2013 (5215F832)
fffff801`f4a0b000 fffff801`f4a1c000 umbus umbus.sys Thu Aug 22 12:38:59 2013 (5215F853)
fffff801`f4a1c000 fffff801`f4a3b000 i8042prt i8042prt.sys Tue Nov 4 06:54:54 2014 (5458783E)
fffff801`f4a41000 fffff801`f4c38000 Ntfs Ntfs.sys Tue Jan 2 03:55:02 2018 (5A4B0296)
fffff801`f4c38000 fffff801`f4c54000 ksecdd ksecdd.sys Wed Oct 29 02:47:36 2014 (54505548)
fffff801`f4c54000 fffff801`f4c64000 pcw pcw.sys Thu Aug 22 09:46:34 2013 (5215CFEA)
fffff801`f4c64000 fffff801`f4c6f000 Fs_Rec Fs_Rec.sys Thu Aug 22 09:46:33 2013 (5215CFE9)
fffff801`f4c6f000 fffff801`f4ca0000 ksecpkg ksecpkg.sys Wed May 18 23:11:05 2016 (573CE879)
fffff801`f4ca0000 fffff801`f4cf4000 CLASSPNP CLASSPNP.SYS Fri May 6 16:18:22 2016 (572CB5BE)
fffff801`f4cf4000 fffff801`f4d22000 cdrom cdrom.sys Thu Aug 22 09:46:35 2013 (5215CFEB)
fffff801`f4d22000 fffff801`f4d2e000 mssmbios mssmbios.sys Thu Aug 22 12:39:41 2013 (5215F87D)
fffff801`f4d2e000 fffff801`f4d55000 dfsc dfsc.sys Tue Jan 2 05:38:50 2018 (5A4B1AEA)
fffff801`f4d55000 fffff801`f4d6c000 ahcache ahcache.sys Fri Dec 12 00:51:20 2014 (548A3C08)
fffff801`f4d6c000 fffff801`f4d78000 ndistapi ndistapi.sys Sat Nov 8 04:00:40 2014 (545D9568)
fffff801`f4d78000 fffff801`f4db1000 ndiswan ndiswan.sys Tue Apr 5 23:37:23 2016 (57043E23)
fffff801`f4db1000 fffff801`f4dce000 rassstp rassstp.sys Wed Oct 29 02:45:50 2014 (545054DE)
fffff801`f4dce000 fffff801`f4ded000 AgileVpn AgileVpn.sys Thu Jul 7 23:32:00 2016 (577ED860)
fffff801`f4ded000 fffff801`f4dfc000 CompositeBus CompositeBus.sys Thu Aug 22 12:38:48 2013 (5215F848)
fffff801`f4e00000 fffff801`f4e0d000 BasicRender BasicRender.sys Wed Nov 8 15:55:00 2017 (5A0328D4)
fffff801`f4e0d000 fffff801`f4e26000 wanarp wanarp.sys Tue Jan 2 05:37:52 2018 (5A4B1AB0)
fffff801`f4e27000 fffff801`f508b000 tcpip tcpip.sys Tue Dec 5 16:56:52 2017 (5A26CFD4)
fffff801`f508b000 fffff801`f50f7000 fwpkclnt fwpkclnt.sys Tue Jun 6 21:39:35 2017 (59371307)
fffff801`f50f7000 fffff801`f511c000 wfplwfs wfplwfs.sys Tue Jan 2 05:38:17 2018 (5A4B1AC9)
fffff801`f511c000 fffff801`f516d000 volsnap volsnap.sys Fri Mar 11 14:44:06 2016 (56E2D9B6)
fffff801`f516d000 fffff801`f518d000 mup mup.sys Wed Apr 6 19:22:23 2016 (570553DF)
fffff801`f518d000 fffff801`f5199000 npsvctrig npsvctrig.sys Thu Aug 22 12:38:22 2013 (5215F82E)
fffff801`f5199000 fffff801`f51b5000 disk disk.sys Thu Jul 6 09:55:00 2017 (595DFAE4)
fffff801`f51b5000 fffff801`f51ca000 crashdmp crashdmp.sys Thu Aug 22 12:40:03 2013 (5215F893)
fffff801`f51e4000 fffff801`f51f4000 dfs dfs.sys Thu Aug 22 12:38:48 2013 (5215F848)
fffff801`f51f4000 fffff801`f51fd000 Null Null.SYS Thu Aug 22 12:40:24 2013 (5215F8A8)
fffff801`f5400000 fffff801`f5490000 afd afd.sys Tue Jan 2 05:38:33 2018 (5A4B1AD9)
fffff801`f5490000 fffff801`f54ba000 pacer pacer.sys Tue Jan 2 05:37:59 2018 (5A4B1AB7)
fffff801`f54ba000 fffff801`f54cb000 netbios netbios.sys Tue Jan 2 05:39:30 2018 (5A4B1B12)
fffff801`f54d1000 fffff801`f5650000 dxgkrnl dxgkrnl.sys Sat Oct 14 09:21:09 2017 (59E1C8F5)
fffff801`f5650000 fffff801`f5662000 watchdog watchdog.sys Sat Feb 22 12:14:39 2014 (530894AF)
fffff801`f5662000 fffff801`f56c5000 dxgmms1 dxgmms1.sys Sun Apr 9 21:38:11 2017 (58EA9BB3)
fffff801`f56c5000 fffff801`f56d7000 BasicDisplay BasicDisplay.sys Thu Aug 22 12:39:31 2013 (5215F873)
fffff801`f56d7000 fffff801`f56eb000 Npfs Npfs.SYS Thu Aug 22 12:40:25 2013 (5215F8A9)
fffff801`f56eb000 fffff801`f56f7000 Msfs Msfs.SYS Thu Aug 22 12:40:24 2013 (5215F8A8)
fffff801`f56f7000 fffff801`f5717000 tdx tdx.sys Wed Aug 2 04:17:15 2017 (5981443B)
fffff801`f5717000 fffff801`f5725000 TDI TDI.SYS Thu Aug 22 12:39:01 2013 (5215F855)
fffff801`f5725000 fffff801`f5730000 ws2ifsl ws2ifsl.sys Thu Aug 22 12:40:03 2013 (5215F893)
fffff801`f5730000 fffff801`f577b000 netbt netbt.sys Fri Aug 11 04:27:54 2017 (598D243A)
fffff801`f577b000 fffff801`f57e9000 rdbss rdbss.sys Tue Jan 2 05:38:59 2018 (5A4B1AF3)
fffff801`f57e9000 fffff801`f57f8000 nsiproxy nsiproxy.sys Sun Aug 13 18:19:15 2017 (59908A13)
fffff801`f57f8000 fffff801`f57fe380 CmBatt CmBatt.sys Thu Aug 22 12:39:43 2013 (5215F87F)
fffff801`f5854000 fffff801`f5875000 raspptp raspptp.sys Thu Aug 22 12:35:51 2013 (5215F797)
fffff801`f5875000 fffff801`f5895000 rasl2tp rasl2tp.sys Tue Feb 2 18:16:20 2016 (56B0F274)
fffff801`f5895000 fffff801`f58a0000 NdisVirtualBus NdisVirtualBus.sys Thu Aug 22 12:36:25 2013 (5215F7B9)
fffff801`f58a0000 fffff801`f58bb000 raspppoe raspppoe.sys Thu Aug 22 12:36:37 2013 (5215F7C5)
fffff801`f58bb000 fffff801`f58bc600 swenum swenum.sys Wed Oct 29 02:47:41 2014 (5450554D)
fffff801`f58bd000 fffff801`f590b000 ks ks.sys Fri Jul 4 13:58:59 2014 (53B6A513)
fffff801`f590b000 fffff801`f5916000 rdpbus rdpbus.sys Thu Aug 22 12:38:52 2013 (5215F84C)
fffff801`f5916000 fffff801`f592d000 NDProxy NDProxy.SYS Tue Jan 2 05:39:05 2018 (5A4B1AF9)
fffff801`f592d000 fffff801`f5939000 flpydisk flpydisk.sys Thu Aug 22 12:40:18 2013 (5215F8A2)
fffff801`f5939000 fffff801`f5945000 dump_diskdump dump_diskdump.sys Thu Aug 22 12:40:18 2013 (5215F8A2)
fffff801`f5945000 fffff801`f5953000 dump_pvscsi dump_pvscsi.sys Tue Jan 26 12:18:30 2016 (56A76416)
fffff801`f5953000 fffff801`f595af00 HIDPARSE HIDPARSE.SYS Sat May 14 00:08:58 2016 (57365E8A)
fffff801`f595b000 fffff801`f5969000 monitor monitor.sys Thu Aug 22 12:36:37 2013 (5215F7C5)
fffff801`f5969000 fffff801`f598d000 luafv luafv.sys Tue Oct 10 17:36:39 2017 (59DCF717)
fffff801`f598d000 fffff801`f59a1000 lltdio lltdio.sys Thu Aug 22 12:36:18 2013 (5215F7B2)
fffff801`f59a1000 fffff801`f59b9000 rspndr rspndr.sys Thu Aug 22 12:36:34 2013 (5215F7C2)
fffff801`f59b9000 fffff801`f59d9000 bowser bowser.sys Tue Oct 4 21:39:40 2016 (57F4138C)
fffff801`f59d9000 fffff801`f59f0000 mpsdrv mpsdrv.sys Wed Oct 29 02:45:31 2014 (545054CB)
fffff801`f5a00000 fffff801`f5aaf000 srv2 srv2.sys Tue Jan 2 05:39:19 2018 (5A4B1B07)
fffff801`f5abe000 fffff801`f5b2a000 mrxsmb mrxsmb.sys Tue Jan 2 05:38:07 2018 (5A4B1ABF)
fffff801`f5b2a000 fffff801`f5b61000 mrxsmb20 mrxsmb20.sys Wed Feb 1 19:44:06 2017 (58923A86)
fffff801`f5b61000 fffff801`f5ba3000 srvnet srvnet.sys Tue Jan 2 05:38:20 2018 (5A4B1ACC)
fffff801`f5c00000 fffff801`f5c4c000 mrxsmb10 mrxsmb10.sys Thu Sep 7 22:32:10 2017 (59B1BADA)
fffff801`f5cc0000 fffff801`f5db9000 HTTP HTTP.sys Tue Jan 2 05:38:55 2018 (5A4B1AEF)
fffff801`f5db9000 fffff801`f5dc4000 vmmemctl vmmemctl.sys Sat Jul 8 10:19:20 2017 (5960A398)
fffff801`f5dc4000 fffff801`f5dd4000 condrv condrv.sys Thu Aug 22 12:40:17 2013 (5215F8A1)
fffff801`f5e00000 fffff801`f5ed9480 mvagtdrv mvagtdrv.sys Wed May 3 12:28:04 2017 (5909BEC4)
fffff801`f5f49000 fffff801`f5ff2000 peauth peauth.sys Sat Feb 22 12:09:37 2014 (53089381)
fffff801`f60a6000 fffff801`f6134000 srv srv.sys Tue Jan 2 05:38:44 2018 (5A4B1AE4)
fffff801`f6134000 fffff801`f6146000 tcpipreg tcpipreg.sys Thu Mar 6 09:19:59 2014 (53183DBF)
fffff801`f6146000 fffff801`f6152000 vstor2_mntapi20_shared vstor2-mntapi20-shared.sys Wed Jan 15 12:11:38 2014 (52D67AFA)
fffff801`f6152000 fffff801`f617f000 tunnel tunnel.sys Fri Sep 4 20:24:03 2015 (55E9EFD3)
fffff801`f617f000 fffff801`f618a000 rdpvideominiport rdpvideominiport.sys Wed Oct 29 02:47:25 2014 (5450553D)
fffff801`f618a000 fffff801`f61be000 rdpdr rdpdr.sys Thu Aug 22 12:36:46 2013 (5215F7CE)
fffff801`f61be000 fffff801`f61cb000 terminpt terminpt.sys Thu Aug 22 12:39:16 2013 (5215F864)
fffff960`00055000 fffff960`00469000 win32k win32k.sys Tue Dec 5 16:57:28 2017 (5A26CFF8)
fffff960`0078d000 fffff960`00796000 TSDDD TSDDD.dll Thu Aug 22 12:40:32 2013 (5215F8B0)
fffff960`00988000 fffff960`009c2000 cdd cdd.dll Wed Oct 29 03:51:32 2014 (54506444)
Unloaded modules:
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
fffff801`f5e00000 fffff801`f5eda000 mvagtdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 000DA000
Closing open log file c:\temp\debuglog.txt
Continue reading...