00000001	6:10:42 AM	[GoodEye]Installed ImageNotifyRoutine... 0xFFFFF8007ADF1260	
00000002	6:10:50 AM	[GoodEye]> ============= Driver \Device\HarddiskVolume2\Program Files (x86)\Common Files\BattlEye\BEDaisy.sys ================	
00000003	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: _stricmp is 0xFFFFF8007BF9E700	
00000004	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: _strnicmp is 0xFFFFF8007BF9E7B0	
00000005	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: wcsncmp is 0xFFFFF8007BFA0C00	
00000006	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: _wcsnicmp is 0xFFFFF8007BF9EDF0	
00000007	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: wcsncat is 0xFFFFF8007BFA0BB0	
00000008	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: wcsstr is 0xFFFFF8007BFA0D50	
00000009	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: _wcsicmp is 0xFFFFF8007BF9ECB0	
00000010	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: _wcslwr is 0xFFFFF8007BF9ED10	
00000011	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: RtlInitAnsiString is 0xFFFFF8007BED57A0	
00000012	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: RtlInitUnicodeString is 0xFFFFF8007BEA6560	
00000013	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: RtlAnsiStringToUnicodeString is 0xFFFFF8007C4DCB50	
00000014	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: RtlUnicodeStringToAnsiString is 0xFFFFF8007C41FFC0	
00000015	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: RtlFreeUnicodeString is 0xFFFFF8007C424760	
00000016	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: RtlFreeAnsiString is 0xFFFFF8007C424760	
00000017	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: RtlGetVersion is 0xFFFFF8007C4ACD40	
00000018	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: KeInitializeEvent is 0xFFFFF8007BE98F10	
00000019	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: KeSetEvent is 0xFFFFF8007BEB03C0	
00000020	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: KeInitializeMutex is 0xFFFFF8007BE06450	
00000021	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: KeReleaseMutex is 0xFFFFF8007BEB4690	
00000022	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: KeWaitForSingleObject is 0xFFFFF8007BEA2A60	
00000023	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ExAllocatePoolWithTag is 0xFFFFF8007C16F010	
00000024	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ExAllocatePool is 0xFFFFF8007BF25F40	
00000025	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ExFreePoolWithTag is 0xFFFFF8007C16F0A0	
00000026	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ProbeForRead is 0xFFFFF8007C4922D0	
00000027	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ProbeForWrite is 0xFFFFF8007C405C30	
00000028	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsCreateSystemThread is 0xFFFFF8007C3B7E00	
00000029	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsTerminateSystemThread is 0xFFFFF8007C48DDA0	
00000030	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: IofCompleteRequest is 0xFFFFF8007BEAF560	
00000031	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: IoCreateDevice is 0xFFFFF8007C474B50	
00000032	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: IoCreateSymbolicLink is 0xFFFFF8007C51AD00	
00000033	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: IoDeleteDevice is 0xFFFFF8007BEE0F20	
00000034	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: IoDeleteSymbolicLink is 0xFFFFF8007C53A2E0	
00000035	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: IoGetCurrentProcess is 0xFFFFF8007BE92220	
00000036	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: IoGetTopLevelIrp is 0xFFFFF8007BE95540	
00000037	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ObReferenceObjectByHandle is 0xFFFFF8007C40F8B0	
00000038	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ObfReferenceObject is 0xFFFFF8007BEA1030	
00000039	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ObfDereferenceObject is 0xFFFFF8007BEA0F60	
00000040	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ObRegisterCallbacks is 0xFFFFF8007C580FF0	
00000041	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ObUnRegisterCallbacks is 0xFFFFF8007C6A0F00	
00000042	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ObGetFilterVersion is 0xFFFFF8007C6A0EF0	
00000043	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ZwOpenFile is 0xFFFFF8007BFBEFB0	
00000044	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ZwQueryInformationFile is 0xFFFFF8007BFBEB70	
00000045	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ZwReadFile is 0xFFFFF8007BFBEA10	
00000046	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ZwClose is 0xFFFFF8007BFBEB30	
00000047	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: MmIsAddressValid is 0xFFFFF8007C0C57D0	
00000048	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsSetCreateProcessNotifyRoutineEx is 0xFFFFF8007C5533D0	
00000049	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsSetCreateThreadNotifyRoutine is 0xFFFFF8007C5533F0	
00000050	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsRemoveCreateThreadNotifyRoutine is 0xFFFFF8007C6CCC70	
00000051	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsSetLoadImageNotifyRoutine is 0xFFFFF8007C553410	
00000052	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsRemoveLoadImageNotifyRoutine is 0xFFFFF8007C6CCD60	
00000053	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsGetCurrentProcessId is 0xFFFFF8007BEE0F00	
00000054	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsGetCurrentThreadId is 0xFFFFF8007BF06380	
00000055	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsGetProcessId is 0xFFFFF8007BE927A0	
00000056	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsGetThreadId is 0xFFFFF8007BF0BEC0	
00000057	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsGetThreadProcessId is 0xFFFFF8007BF11A70	
00000058	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ZwDeviceIoControlFile is 0xFFFFF8007BFBEA30	
00000059	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: RtlRandomEx is 0xFFFFF8007BED44A0	
00000060	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsLookupProcessByProcessId is 0xFFFFF8007C3F0630	
00000061	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsLookupThreadByThreadId is 0xFFFFF8007C3F08C0	
00000062	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsGetThreadProcess is 0xFFFFF8007BE1B010	
00000063	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: IoQueryFileDosDeviceName is 0xFFFFF8007C4C7BE0	
00000064	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ObOpenObjectByPointer is 0xFFFFF8007C3FF420	
00000065	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ObQueryNameString is 0xFFFFF8007C4C7BC0	
00000066	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ZwOpenDirectoryObject is 0xFFFFF8007BFBF450	
00000067	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsGetProcessImageFileName is 0xFFFFF8007BF16680	
00000068	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsGetProcessInheritedFromUniqueProcessId is 0xFFFFF8007BE19E30	
00000069	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ZwQueryInformationThread is 0xFFFFF8007BFBEDF0	
00000070	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ZwQuerySystemInformation is 0xFFFFF8007BFBF010	
00000071	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsAcquireProcessExitSynchronization is 0xFFFFF8007C4D8DC0	
00000072	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsReleaseProcessExitSynchronization is 0xFFFFF8007C49FF60	
00000073	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ExfUnblockPushLock is 0xFFFFF8007BFBE570	
00000074	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ExEnumHandleTable is 0xFFFFF8007C488ED0	
00000075	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ZwQueryDirectoryObject is 0xFFFFF8007BFC10F0	
00000076	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ObOpenObjectByName is 0xFFFFF8007C4133E0	
00000077	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: CmUnRegisterCallback is 0xFFFFF8007C627D50	
00000078	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: MmProbeAndLockPages is 0xFFFFF8007BEBCA90	
00000079	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: MmUnlockPages is 0xFFFFF8007BEB3030	
00000080	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: IoAllocateMdl is 0xFFFFF8007BE99330	
00000081	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: IoFreeMdl is 0xFFFFF8007BEEFB20	
00000082	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ObReferenceObjectByName is 0xFFFFF8007C3F44A0	
00000083	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ZwOpenSection is 0xFFFFF8007BFBF030	
00000084	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: KeStackAttachProcess is 0xFFFFF8007BE920E0	
00000085	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: KeUnstackDetachProcess is 0xFFFFF8007BE9D3B0	
00000086	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsGetProcessPeb is 0xFFFFF8007BF138F0	
00000087	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsGetProcessWow64Process is 0xFFFFF8007BEF8FD0	
00000088	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: RtlWalkFrameChain is 0xFFFFF8007BE09DC0	
00000089	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: KeInitializeApc is 0xFFFFF8007BEC7A50	
00000090	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: KeInsertQueueApc is 0xFFFFF8007BEC5F50	
00000091	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ZwTerminateProcess is 0xFFFFF8007BFBEED0	
00000092	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: MmUnmapViewOfSection is 0xFFFFF8007C3CE0D0	
00000093	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsSuspendProcess is 0xFFFFF8007C6CD140	
00000094	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsResumeProcess is 0xFFFFF8007C4A00D0	
00000095	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ZwCreateSection is 0xFFFFF8007BFBF290	
00000096	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ZwMapViewOfSection is 0xFFFFF8007BFBEE50	
00000097	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ZwUnmapViewOfSection is 0xFFFFF8007BFBEE90	
00000098	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: IoThreadToProcess is 0xFFFFF8007BE1B010	
00000099	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ZwAllocateVirtualMemory is 0xFFFFF8007BFBEC50	
00000100	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ZwFreeVirtualMemory is 0xFFFFF8007BFBED10	
00000101	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsGetContextThread is 0xFFFFF8007C6CBF30	
00000102	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: MmCopyVirtualMemory is 0xFFFFF8007C419850	
00000103	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ZwOpenThread is 0xFFFFF8007BFC0E70	
00000104	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: MmMapIoSpace is 0xFFFFF8007BF051E0	
00000105	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: MmUnmapIoSpace is 0xFFFFF8007BF03BE0	
00000106	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: MmGetPhysicalAddress is 0xFFFFF8007BF10580	
00000107	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: KeDelayExecutionThread is 0xFFFFF8007BE9DE80	
00000108	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: RtlCompareUnicodeString is 0xFFFFF8007C41FE90	
00000109	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsGetProcessSessionId is 0xFFFFF8007BED04D0	
00000110	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: MmCopyMemory is 0xFFFFF8007BF2A060	
00000111	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ZwTraceControl is 0xFFFFF8007BFC20F0	
00000112	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: RtlImageNtHeader is 0xFFFFF8007BE88E20	
00000113	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: IoFileObjectType is 0xFFFFF8007C3743C8	
00000114	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsProcessType is 0xFFFFF8007C374390	
00000115	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsThreadType is 0xFFFFF8007C3743B8	
00000116	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: PsInitialSystemProcess is 0xFFFFF8007C3743A0	
00000117	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: IoDriverObjectType is 0xFFFFF8007C374518	
00000118	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: NtBuildNumber is 0xFFFFF8007C196238	
00000127	6:10:50 AM	[GoodEye]MmGetSystemRoutineAddress: ObGetObjectType is 0xFFFFF8007C3DE960	
00000128	6:10:54 AM	[GoodEye]MmGetSystemRoutineAddress: MmIsAddressValid is 0xFFFFF8007C0C57D0	
00000129	6:10:54 AM	[GoodEye]MmGetSystemRoutineAddress: ZwQuerySystemInformation is 0xFFFFF8007BFBF010	
00000130	6:10:54 AM	[GoodEye]MmGetSystemRoutineAddress: NtQuerySystemInformation is 0xFFFFF8007C3FFDE0	
00000131	6:10:54 AM	[GoodEye]MmGetSystemRoutineAddress: ZwClose is 0xFFFFF8007BFBEB30	
00000132	6:10:54 AM	[GoodEye]MmGetSystemRoutineAddress: ZwClose is 0xFFFFF8007BFBEB30	
00000133	6:10:54 AM	[GoodEye]MmGetSystemRoutineAddress: ZwClose is 0xFFFFF8007BFBEB30	
00000134	6:10:54 AM	[GoodEye]MmGetSystemRoutineAddress: ZwClose is 0xFFFFF8007BFBEB30	

//
// file system imports
//

[GoodEye]FltGetRoutineAddress: FltRegisterFilter, 0xFFFFF8007FB5B590
[GoodEye]FltGetRoutineAddress: FltUnregisterFilter, 0xFFFFF8007FB5D0E0
[GoodEye]FltGetRoutineAddress: FltStartFiltering, 0xFFFFF8007FB5CE00
[GoodEye]FltGetRoutineAddress: FltGetFileNameInformation, 0xFFFFF8007FB18190
[GoodEye]FltGetRoutineAddress: FltReleaseFileNameInformation, 0xFFFFF8007FB4EC80
[GoodEye]FltGetRoutineAddress: FltReadFile, 0xFFFFF8007FB28100
[GoodEye]FltGetRoutineAddress: FltQueryInformationFile, 0xFFFFF8007FB4C3B0
[GoodEye]FltGetRoutineAddress: FltGetRequestorProcess, 0xFFFFF8007FB1C0E0


//
// loaded drivers at the time of dump (windows 10 2004)
//

win32k.sys, 0xffff84384c090000, 560 kB, Full/Desktop Multi-User Win32 Driver
win32kfull.sys, 0xffff84384c2c0000, 3.63 MB, Full/Desktop Win32k Kernel Driver
win32kbase.sys, 0xffff84384ca50000, 2.65 MB, Base Win32k Kernel Driver
cdd.dll, 0xffff84384cd00000, 288 kB, Canonical Display Driver
peauth.sys, 0xfffff8007a600000, 856 kB, Protected Environment Authentication and Authorization Export Driver
srv2.sys, 0xfffff8007a6e0000, 788 kB, Smb 2.0 Server driver
tcpipreg.sys, 0xfffff8007a7b0000, 80 kB, TCP/IP Registry Compatibility Driver
tdevmonc.sys, 0xfffff8007a7d0000, 56 kB, Tibbo Device Monitor core driver
rassstp.sys, 0xfffff8007a7e0000, 116 kB, RAS SSTP Miniport Call Manager
NDProxy.sys, 0xfffff8007a800000, 260 kB, NDIS Proxy
AgileVpn.sys, 0xfffff8007a850000, 156 kB, RAS Agile Vpn Miniport Call Manager
rasl2tp.sys, 0xfffff8007a880000, 136 kB, RAS L2TP mini-port/call-manager driver
raspptp.sys, 0xfffff8007a8b0000, 128 kB, Peer-to-Peer Tunneling Protocol
raspppoe.sys, 0xfffff8007a8e0000, 112 kB, RAS PPPoE mini-port/call-manager driver
ndistapi.sys, 0xfffff8007a900000, 60 kB, NDIS 3.0 connection wrapper driver
ndiswan.sys, 0xfffff8007a910000, 232 kB, MS PPP Framing Driver (Strong Encryption)
condrv.sys, 0xfffff8007a950000, 76 kB, Console Driver
p9rdr.sys, 0xfffff8007a970000, 104 kB, Plan 9 redirector
bindflt.sys, 0xfffff8007a990000, 132 kB, Windows Bind Filter Driver
asyncmac.sys, 0xfffff8007ab20000, 56 kB, MS Remote Access serial network driver
ssudbus.sys, 0xfffff8007ab30000, 128 kB, SAMSUNG USB Composite Device Driver
WinUsb.sys, 0xfffff8007ab60000, 128 kB, Windows WinUSB Class Driver
WUDFRd.sys, 0xfffff8007ab90000, 320 kB, Windows Driver Foundation - User-mode Driver Framework Reflector
WpdUpFltr.sys, 0xfffff8007abf0000, 56 kB, Windows Portable Device Upper Class Filter Driver
VMMR0.r0, 0xfffff8007ac00000, 1.59 MB, VirtualBox VMM - ring-0 context parts
VBoxDDR0.r0, 0xfffff8007ada0000, 200 kB, VirtualBox VMM Devices and Drivers, ring-0
Dbgv.sys, 0xfffff8007ade0000, 36 kB, Windows Debug Monitor
GoodEye.sys, 0xfffff8007adf0000, 28 kB, 
HTTP.sys, 0xfffff8007af20000, 1.27 MB, HTTP Protocol Stack
mpsdrv.sys, 0xfffff8007b070000, 104 kB, Microsoft Protection Service Driver
vwifimp.sys, 0xfffff8007b090000, 76 kB, Virtual WiFi Miniport Driver
IntelHaxm.sys, 0xfffff8007b0b0000, 188 kB, HAXM_Driver
srvnet.sys, 0xfffff8007b0e0000, 332 kB, Server Network driver
Ndu.sys, 0xfffff8007b140000, 156 kB, Windows Network Data Usage Monitoring Driver
npf.sys, 0xfffff8007b170000, 48 kB, npf.sys (NT5/6 AMD64) Kernel Driver
hal.dll, 0xfffff8007bd5c000, 656 kB, Hardware Abstraction Layer DLL
ntoskrnl.exe, 0xfffff8007be00000, 10.71 MB, NT Kernel & System
kprocesshacker.sys, 0xfffff8007e420000, 44 kB, KProcessHacker
kd.dll, 0xfffff8007f600000, 44 kB, Local Kernel Debugger
mcupdate_GenuineIntel.dll, 0xfffff8007f610000, 2.3 MB, Intel Microcode Update Library
werkernel.sys, 0xfffff8007f860000, 68 kB, Windows Error Reporting Kernel Driver
ksecdd.sys, 0xfffff8007f880000, 168 kB, Kernel Security Support Provider Interface
msrpc.sys, 0xfffff8007f8b0000, 384 kB, Kernel Remote Procedure Call Provider
tm.sys, 0xfffff8007f920000, 156 kB, Kernel Transaction Manager Driver
CLFS.SYS, 0xfffff8007f950000, 416 kB, Common Log File System Driver
PSHED.dll, 0xfffff8007f9c0000, 104 kB, Platform Specific Hardware Error Driver
BOOTVID.dll, 0xfffff8007f9e0000, 44 kB, VGA Boot Driver
cmimcext.sys, 0xfffff8007f9f0000, 56 kB, Kernel Configuration Manager Initial Configuration Extension Host Export Driver
clipsp.sys, 0xfffff8007fa00000, 1.02 MB, CLIP Service
FLTMGR.SYS, 0xfffff8007fb10000, 452 kB, Microsoft Filesystem Filter Manager
ntosext.sys, 0xfffff8007fb90000, 48 kB, NTOS extension host driver
CI.dll, 0xfffff8007fba0000, 884 kB, Code Integrity Module
cng.sys, 0xfffff8007fc80000, 752 kB, Kernel Cryptography, Next Generation
Wdf01000.sys, 0xfffff8007fd40000, 852 kB, Kernel Mode Driver Framework Runtime
WDFLDR.SYS, 0xfffff8007fe20000, 76 kB, Kernel Mode Driver Framework Loader
SleepStudyHelper.sys, 0xfffff8007fe40000, 60 kB, Sleep Study Helper
WppRecorder.sys, 0xfffff8007fe50000, 64 kB, WPP Trace Recorder
acpiex.sys, 0xfffff8007fe70000, 148 kB, ACPIEx Driver
mssecflt.sys, 0xfffff8007fea0000, 264 kB, Microsoft Security Events Component file system filter driver
SgrmAgent.sys, 0xfffff8007fef0000, 104 kB, System Guard Runtime Monitor Agent Driver
lxss.sys, 0xfffff8007ff10000, 40 kB, LXSS
LXCORE.SYS, 0xfffff8007ff20000, 1.09 MB, LX Core
ACPI.sys, 0xfffff80080040000, 816 kB, ACPI Driver for NT
WMILIB.SYS, 0xfffff80080110000, 48 kB, WMILIB WMI support library Dll
msisadrv.sys, 0xfffff80080120000, 44 kB, ISA Driver
pci.sys, 0xfffff80080130000, 444 kB, NT Plug and Play PCI Enumerator
tpm.sys, 0xfffff800801a0000, 256 kB, TPM Device Driver
WindowsTrustedRTProxy.sys, 0xfffff800801f0000, 44 kB, Windows Trusted Runtime Service Proxy Driver
intelpep.sys, 0xfffff80080220000, 364 kB, Intel Power Engine Plugin
WindowsTrustedRT.sys, 0xfffff80080280000, 92 kB, Windows Trusted Runtime Interface Driver
pcw.sys, 0xfffff800802a0000, 84 kB, Performance Counters for Windows Driver
vdrvroot.sys, 0xfffff800802c0000, 76 kB, Virtual Drive Root Enumerator
pdc.sys, 0xfffff800802e0000, 204 kB, Power Dependency Coordinator Driver
CEA.sys, 0xfffff80080320000, 100 kB, Event Aggregation Kernel Mode Library
partmgr.sys, 0xfffff80080340000, 192 kB, Partition driver
spaceport.sys, 0xfffff80080380000, 660 kB, Storage Spaces Driver
volmgr.sys, 0xfffff80080430000, 104 kB, Volume Manager Driver
volmgrx.sys, 0xfffff80080450000, 396 kB, Volume Manager Extension Driver
mountmgr.sys, 0xfffff800804c0000, 124 kB, Mount Point Manager
iaStorA.sys, 0xfffff800804e0000, 5.46 MB, Intel(R) Rapid Storage Technology driver - x64
storport.sys, 0xfffff80080a60000, 648 kB, Microsoft Storage Port Driver
EhStorClass.sys, 0xfffff80080b10000, 108 kB, Enhanced Storage Class driver for IEEE 1667 devices
fileinfo.sys, 0xfffff80080b30000, 104 kB, FileInfo Filter Driver
pmdrvs.sys, 0xfffff80080b50000, 40 kB, Lenovo Power Management Driver
Fs_Rec.sys, 0xfffff80080b60000, 52 kB, File System Recognizer Driver
Wof.sys, 0xfffff80080b80000, 244 kB, Windows Overlay Filter
WdFilter.sys, 0xfffff80080bc0000, 336 kB, Microsoft antimalware file system filter driver
Ntfs.sys, 0xfffff80080c20000, 2.61 MB, NT File System Driver
ndis.sys, 0xfffff80080ec0000, 1.45 MB, Network Driver Interface Specification (NDIS)
NETIO.SYS, 0xfffff80081040000, 592 kB, Network I/O Subsystem
ksecpkg.sys, 0xfffff800810e0000, 200 kB, Kernel Security Support Provider Interface Packages
tcpip.sys, 0xfffff80081120000, 2.91 MB, TCP/IP Driver
fwpkclnt.sys, 0xfffff80081410000, 488 kB, FWP/IPsec Kernel-Mode API
wfplwfs.sys, 0xfffff80081490000, 192 kB, WFP NDIS 6.30 Lightweight Filter Driver
VmsProxy.sys, 0xfffff800814d0000, 64 kB, VMSWITCH Proxy Driver
vmbkmclr.sys, 0xfffff800814f0000, 128 kB, Hyper-V VMBus Root KMCL
VmsProxyHNic.sys, 0xfffff80081520000, 60 kB, VmSwitch NIC Proxy Driver
fvevol.sys, 0xfffff80081530000, 804 kB, BitLocker Drive Encryption Driver
volume.sys, 0xfffff80081600000, 44 kB, Volume driver
volsnap.sys, 0xfffff80081610000, 436 kB, Volume Shadow Copy driver
rdyboost.sys, 0xfffff80081680000, 312 kB, ReadyBoost Driver
mup.sys, 0xfffff800816d0000, 148 kB, Multiple UNC Provider Driver
iorate.sys, 0xfffff80081700000, 72 kB, I/O rate control Filter
IntelPcc.sys, 0xfffff80081720000, 88 kB, Intel Collaborative Processor Performance Control (CPPC) Driver
disk.sys, 0xfffff80081760000, 112 kB, PnP Disk Driver
CLASSPNP.SYS, 0xfffff80081780000, 428 kB, SCSI Class System Dll
VBoxDrv.sys, 0xfffff80c57020000, 1.07 MB, VirtualBox Support Driver
npsvctrig.sys, 0xfffff80c57140000, 52 kB, Named pipe service triggers
mssmbios.sys, 0xfffff80c57150000, 64 kB, System Management BIOS Driver
HWiNFO64A.SYS, 0xfffff80c57170000, 40 kB, HWiNFO AMD64 Kernel Driver
gpuenergydrv.sys, 0xfffff80c57180000, 40 kB, GPU Energy Kernel Driver
dfsc.sys, 0xfffff80c57190000, 176 kB, DFS Namespace Client Driver
umbus.sys, 0xfffff80c571c0000, 84 kB, User-Mode Bus Enumerator
bam.sys, 0xfffff80c571e0000, 88 kB, BAM Kernel Driver
ahcache.sys, 0xfffff80c57200000, 316 kB, Application Compatibility Cache
tap0901.sys, 0xfffff80c57250000, 48 kB, TAP-Windows Virtual Network Driver (NDIS 6.0)
VBoxNetAdp6.sys, 0xfffff80c57260000, 328 kB, VirtualBox NDIS 6.0 Host-Only Network Adapter Driver
tapprotonvpn.sys, 0xfffff80c572c0000, 48 kB, TAP-Windows Virtual Network Driver (NDIS 6.0)
Vid.sys, 0xfffff80c572d0000, 560 kB, Microsoft Hyper-V Virtualization Infrastructure Driver
winhvr.sys, 0xfffff80c57360000, 124 kB, Windows Hypervisor Root Interface Driver
CompositeBus.sys, 0xfffff80c57380000, 68 kB, Multi-Transport Composite Bus Enumerator
kdnic.sys, 0xfffff80c573a0000, 52 kB, Microsoft Kernel Debugger Network Miniport
crashdmp.sys, 0xfffff80c573e0000, 116 kB, Crash Dump Driver
dump_iaStorA.sys, 0xfffff80c57a00000, 5.46 MB, 
cdrom.sys, 0xfffff80c57fc0000, 192 kB, SCSI CD-ROM Driver
filecrypt.sys, 0xfffff80c58000000, 84 kB, Windows sandboxing and encryption filter
tbs.sys, 0xfffff80c58020000, 56 kB, Export driver for kernel mode TPM API
Null.SYS, 0xfffff80c58030000, 40 kB, NULL Driver
Beep.SYS, 0xfffff80c58040000, 40 kB, BEEP Driver
dxgkrnl.sys, 0xfffff80c58050000, 3.44 MB, DirectX Graphics Kernel
watchdog.sys, 0xfffff80c583d0000, 88 kB, Watchdog Driver
BasicDisplay.sys, 0xfffff80c583f0000, 88 kB, Microsoft Basic Display Driver
BasicRender.sys, 0xfffff80c58410000, 68 kB, Microsoft Basic Render Driver
Npfs.SYS, 0xfffff80c58430000, 112 kB, NPFS Driver
Msfs.SYS, 0xfffff80c58450000, 68 kB, Mailslot driver
tdx.sys, 0xfffff80c58470000, 152 kB, TDI Translation Driver
TDI.SYS, 0xfffff80c584a0000, 64 kB, TDI Wrapper
netbt.sys, 0xfffff80c584c0000, 356 kB, MBT Transport driver
afunix.sys, 0xfffff80c58520000, 76 kB, AF_UNIX socket provider
afd.sys, 0xfffff80c58540000, 668 kB, Ancillary Function Driver for WinSock
npcap.sys, 0xfffff80c585f0000, 76 kB, npcap.sys (NT6 AMD64) Kernel Filter Driver
VBoxNetLwf.sys, 0xfffff80c58610000, 344 kB, VirtualBox NDIS 6.0 Lightweight Filter Driver
vwififlt.sys, 0xfffff80c58670000, 104 kB, Virtual WiFi Filter Driver
pacer.sys, 0xfffff80c58690000, 172 kB, QoS Packet Scheduler
netbios.sys, 0xfffff80c586c0000, 80 kB, NetBIOS interface driver
smi.sys, 0xfffff80c586e0000, 40 kB, SSO SMI Kernel Mode Driver
rdbss.sys, 0xfffff80c586f0000, 492 kB, Redirected Drive Buffering SubSystem Driver
nsiproxy.sys, 0xfffff80c58770000, 72 kB, NSI Proxy
csc.sys, 0xfffff80c58d10000, 592 kB, Windows Client Side Caching Driver
VBoxUSBMon.sys, 0xfffff80c58db0000, 220 kB, VirtualBox USB Monitor Driver
Tppwr64v.sys, 0xfffff80c58df0000, 36 kB, Power Manager
igdkmd64.sys, 0xfffff80c58e00000, 7.77 MB, Intel Graphics Kernel Mode Driver
USBXHCI.SYS, 0xfffff80c595d0000, 548 kB, USB XHCI Driver
TeeDriverW8x64.sys, 0xfffff80c59660000, 208 kB, Intel(R) Management Engine Interface
e1d68x64.sys, 0xfffff80c596a0000, 596 kB, Intel(R) Gigabit Adapter NDIS 6.x driver
usbehci.sys, 0xfffff80c59740000, 116 kB, EHCI eUSB Miniport Driver
USBPORT.SYS, 0xfffff80c59760000, 488 kB, USB 1.1 & 2.0 Port Driver
RtsPer.sys, 0xfffff80c597e0000, 880 kB, RTS PCIE READER Driver
nwifi.sys, 0xfffff80c598c0000, 712 kB, NativeWiFi Miniport Driver
CAD.sys, 0xfffff80c59a90000, 84 kB, Charge Arbiration Driver
intelppm.sys, 0xfffff80c59ab0000, 248 kB, Processor Device Driver
USBD.SYS, 0xfffff80c59c00000, 56 kB, Universal Serial Bus Driver
HIDPARSE.SYS, 0xfffff80c59c10000, 76 kB, Hid Parsing Library
kbdclass.sys, 0xfffff80c59c30000, 80 kB, Keyboard Class Driver
mouclass.sys, 0xfffff80c59c50000, 76 kB, Mouse Class Driver
CmBatt.sys, 0xfffff80c59c70000, 60 kB, Control Method Battery Driver
BATTC.SYS, 0xfffff80c59c80000, 64 kB, Battery Class Driver
ibmpmdrv.sys, 0xfffff80c59ca0000, 84 kB, Lenovo Power Management Driver
Smb_driver_Intel.sys, 0xfffff80c59cc0000, 60 kB, Synaptics SMBus Driver
wmiacpi.sys, 0xfffff80c59cd0000, 48 kB, Windows Management Interface for ACPI
NdisVirtualBus.sys, 0xfffff80c59ce0000, 52 kB, Microsoft Virtual Network Adapter Enumerator
swenum.sys, 0xfffff80c59cf0000, 48 kB, Plug and Play Software Device Enumerator
rdpbus.sys, 0xfffff80c59d00000, 56 kB, Microsoft RDP Bus Device driver
usbhub.sys, 0xfffff80c59d10000, 552 kB, Default Hub Driver for USB
ksthunk.sys, 0xfffff80c59e20000, 60 kB, Kernel Streaming WOW Thunk Service
UsbHub3.sys, 0xfffff80c59e30000, 640 kB, USB3 HUB Driver
vmswitch.sys, 0xfffff80c59ee0000, 2.35 MB, Microsoft® Network Virtualization Service Provider
Netwbw02.sys, 0xfffff80c5a170000, 3.55 MB, Intel® Wireless WiFi Link Driver
vwifibus.sys, 0xfffff80c5a500000, 56 kB, Virtual Wireless Bus Driver
i8042prt.sys, 0xfffff80c5a510000, 140 kB, i8042 Port Driver
SynTP.sys, 0xfffff80c5a540000, 716 kB, Synaptics Touchpad Win64 Driver
ks.sys, 0xfffff80c5b200000, 480 kB, Kernel CSA Library
ucx01000.sys, 0xfffff80c5b280000, 260 kB, USB Controller Extension
nvlddmkm.sys, 0xfffff80c5b2e0000, 20.21 MB, NVIDIA Windows Kernel Mode Driver, Version 425.91 
HDAudBus.sys, 0xfffff80c5c720000, 136 kB, High Definition Audio Bus Driver
portcls.sys, 0xfffff80c5c750000, 412 kB, Port Class (Class Driver for Port/Miniport Devices)
drmk.sys, 0xfffff80c5c7c0000, 132 kB, Microsoft Trusted Audio Drivers
BTHUSB.sys, 0xfffff80c5c800000, 124 kB, Bluetooth Miniport Driver
bthport.sys, 0xfffff80c5c820000, 1.39 MB, Bluetooth Bus Driver
hidusb.sys, 0xfffff80c5c990000, 72 kB, USB Miniport Driver for Input Devices
HIDCLASS.SYS, 0xfffff80c5c9b0000, 236 kB, Hid Class Library
mouhid.sys, 0xfffff80c5c9f0000, 64 kB, HID Mouse Filter Driver
Microsoft.Bluetooth.Legacy.LEEnumerator.sys, 0xfffff80c5ca10000, 120 kB, Legacy Bluetooth LE Bus Enumerator
rfcomm.sys, 0xfffff80c5ca30000, 232 kB, Bluetooth RFCOMM Driver
BthEnum.sys, 0xfffff80c5ca70000, 136 kB, Bluetooth Bus Extender
bthpan.sys, 0xfffff80c5caa0000, 152 kB, Bluetooth Personal Area Networking
usbvideo.sys, 0xfffff80c5cae0000, 316 kB, USB Video Class Driver
tsusbhub.sys, 0xfffff80c5cb30000, 156 kB, Remote Desktop USB Hub
bowser.sys, 0xfffff80c5cb60000, 148 kB, NT Lan Manager Datagram Receiver Driver
winquic.sys, 0xfffff80c5cb90000, 224 kB, Windows QUIC Driver
mrxsmb.sys, 0xfffff80c5cbd0000, 572 kB, Windows NT SMB Minirdr
mrxsmb20.sys, 0xfffff80c5cc80000, 276 kB, Longhorn SMB 2.0 Redirector
lltdio.sys, 0xfffff80c5ccd0000, 96 kB, Link-Layer Topology Mapper I/O Driver
mslldp.sys, 0xfffff80c5ccf0000, 100 kB, Microsoft Link-Layer Discovery Protocol Driver
rspndr.sys, 0xfffff80c5cd10000, 108 kB, Link-Layer Topology Responder Driver for NDIS 6
wanarp.sys, 0xfffff80c5cd30000, 116 kB, MS Remote Access and Routing ARP Driver
ndisuio.sys, 0xfffff80c5cd50000, 96 kB, NDIS User mode I/O driver
dump_diskdump.sys, 0xfffff80c5cdf0000, 56 kB, 
dump_dumpfve.sys, 0xfffff80c5ce20000, 116 kB, 
dxgmms2.sys, 0xfffff80c5ce40000, 872 kB, DirectX Graphics MMS
monitor.sys, 0xfffff80c5cf20000, 96 kB, Monitor Driver
rdpvideominiport.sys, 0xfffff80c5cf40000, 52 kB, Microsoft RDP Video Miniport driver
wcifs.sys, 0xfffff80c5cf80000, 220 kB, Windows Container Isolation FS Filter Driver
cldflt.sys, 0xfffff80c5cfc0000, 476 kB, Cloud Files Mini Filter Driver
storqosflt.sys, 0xfffff80c5d040000, 104 kB, Storage QoS Filter
mmcss.sys, 0xfffff80c5d060000, 80 kB, MMCSS Driver
rdpdr.sys, 0xfffff80c5d080000, 188 kB, Microsoft RDP Device redirector
RTKVHD64.sys, 0xfffff80c5d0b0000, 6.77 MB, Realtek(r) High Definition Audio Function Driver
usbccgp.sys, 0xfffff80c5d780000, 204 kB, USB Common Class Generic Parent Driver
ibtusb.sys, 0xfffff80c5d7c0000, 236 kB, Intel(R) Wireless Bluetooth(R) Filter Driver

