Details
Id: AVR:Free iexplore.exe!jscript.dll!RegExpBase::FBadHeader 6A0257
Description: Access violation while reading freed memory at 0x9A15E68
Process binary: iexplore.exe
Location: jscript.dll!RegExpBase::FBadHeader + 0x6
Security impact: Potentially exploitable security issue
Stack
jscript.dll!RegExpBase::FBadHeader + 0x6 (6A in id)
jscript.dll!RegExpExec::Exec + 0x3C (02 in id)
jscript.dll!RegExpExec::ReplaceUsingCallable + 0x2B3 (57 in id)
jscript.dll!RegExpObj::Exec + 0xAAE
jscript.dll!JsStrReplace + 0x1E8
jscript.dll!NatFncObj::Call + 0x106
jscript.dll!NameTbl::InvokeInternal + 0x2B4
jscript.dll!VAR::InvokeByDispID + 0x17F
jscript.dll!VAR::InvokeJSObj<SYM *> + 0xB8
jscript.dll!VAR::InvokeByName + 0x174
jscript.dll!VAR::InvokeDispName + 0x7D
jscript.dll!VAR::InvokeByDispID + 0xCE
jscript.dll!CScriptRuntime::Run + 0x2B80 (this symbol may not be correct)
jscript.dll!ScrFncObj::CallWithFrameOnStack + 0xCE
jscript.dll!ScrFncObj::Call + 0x8D
jscript.dll!CSession::Execute + 0x15F
jscript.dll!COleScript::ExecutePendingScripts + 0x1BD
jscript.dll!COleScript::ParseScriptTextCore + 0x2A4
jscript.dll!COleScript::ParseScriptText + 0x30
mshtml.dll!CScriptCollection::ParseScriptText + 0x231
mshtml.dll!CScriptElement::CommitCode + 0x3C2
mshtml.dll!CScriptElement::Execute + 0xD7
mshtml.dll!CHtmParse::Execute + 0x4A
mshtml.dll!CHtmPost::Broadcast + 0xF
mshtml.dll!CHtmPost::Exec + 0x618
mshtml.dll!CHtmPost::Run + 0x15
mshtml.dll!PostManExecute + 0x1FB
mshtml.dll!PostManResume + 0xF7
mshtml.dll!CHtmPost::OnDwnChanCallback + 0x10
mshtml.dll!CDwnChan::OnMethodCall + 0x19
mshtml.dll!GlobalWndOnMethodCall + 0x108
mshtml.dll!GlobalWndProc + 0x111
USER32.dll!InternalCallWinProc + 0x23
USER32.dll!UserCallWinProcCheckWow + 0x14B
USER32.dll!DispatchMessageWorker + 0x35E
USER32.dll!DispatchMessageW + 0xF
IEFRAME.dll!CTabWindow::_TabWindowThreadProc + 0x54B
IEFRAME.dll!LCIETab_ThreadProc + 0x2C1
iertutil.dll!CIsoScope::RegisterThread + 0xAB
kernel32.dll!BaseThreadInitThunk + 0xE
ntdll.dll!__RtlUserThreadStart + 0x70
ntdll.dll!_RtlUserThreadStart + 0x1B
Binary iexplore.exe details
    Image path: iexplore.exe
    Image name: iexplore.exe
    Timestamp:        Thu Jul 16 09:55:30 2015 (55A7E202)
    CheckSum:         000A9DD0
    ImageSize:        000A6000
    File version:     8.0.7601.18934
    Product version:  8.0.7601.18934
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Windows� Internet Explorer
    InternalName:     iexplore
    OriginalFilename: IEXPLORE.EXE
    ProductVersion:   8.00.7601.18934
    FileVersion:      8.00.7601.18934 (win7sp1_gdr.150716-0600)
    FileDescription:  Internet Explorer
    LegalCopyright:   � Microsoft Corporation. All rights reserved.
Binary jscript.dll details
    Loaded symbol image file: C:\Windows\System32\jscript.dll
    Image path: C:\Windows\System32\jscript.dll
    Image name: jscript.dll
    Timestamp:        Thu Jul 16 12:04:48 2015 (55A80050)
    CheckSum:         000B9049
    ImageSize:        000B2000
    File version:     5.8.7601.18934
    Product version:  5.8.7601.18934
    File flags:       0 (Mask 3)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft � JScript
    InternalName:     jscript.dll
    OriginalFilename: jscript.dll
    ProductVersion:   5.8.7601.18934
    FileVersion:      5.8.7601.18934
    FileDescription:  Microsoft � JScript
    LegalCopyright:   � Microsoft Corporation. All rights reserved.
Debugger input/output

Microsoft (R) Windows Debugger Version 6.3.9600.16384 X86
Copyright (c) Microsoft Corporation. All rights reserved.

CommandLine: "C:\Program Files\Internet Explorer\iexplore.exe" http://W7-IE8:28876

************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*http://msdl.microsoft.com/download/symbols
Deferred                                       cache*C:\Symbols*\\server\Symbols
Deferred                                       srv*http://symbols.mozilla.org/firefox
Deferred                                       srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is: 
ModLoad: 013e0000 01486000   iexplore.exe
ModLoad: 77320000 77461000   ntdll.dll
ModLoad: 6be30000 6be90000   C:\Windows\system32\verifier.dll
Page heap: pid 0x32C: page heap enabled with flags 0x3.
ModLoad: 76050000 76124000   C:\Windows\system32\kernel32.dll
ModLoad: 75690000 756db000   C:\Windows\system32\KERNELBASE.dll
ModLoad: 76550000 765f1000   C:\Windows\system32\ADVAPI32.dll
ModLoad: 757f0000 7589c000   C:\Windows\system32\msvcrt.dll
ModLoad: 77480000 77499000   C:\Windows\SYSTEM32\sechost.dll
ModLoad: 75fa0000 76042000   C:\Windows\system32\RPCRT4.dll
ModLoad: 76600000 766c9000   C:\Windows\system32\USER32.dll
ModLoad: 75e10000 75e5e000   C:\Windows\system32\GDI32.dll
ModLoad: 75e00000 75e0a000   C:\Windows\system32\LPK.dll
ModLoad: 75b40000 75bdd000   C:\Windows\system32\USP10.dll
ModLoad: 75f40000 75f97000   C:\Windows\system32\SHLWAPI.dll
ModLoad: 766d0000 7731b000   C:\Windows\system32\SHELL32.dll
ModLoad: 758a0000 759fc000   C:\Windows\system32\ole32.dll
ModLoad: 762f0000 764f1000   C:\Windows\system32\iertutil.dll
ModLoad: 75a00000 75b40000   C:\Windows\system32\urlmon.dll
ModLoad: 75730000 7575f000   C:\Windows\system32\XmlLite.dll
ModLoad: 75be0000 75cd5000   C:\Windows\system32\WININET.dll
ModLoad: 75760000 757ef000   C:\Windows\system32\OLEAUT32.dll
ModLoad: 754a0000 755c1000   C:\Windows\system32\CRYPT32.dll
ModLoad: 75490000 7549c000   C:\Windows\system32\MSASN1.dll
(32c.208): Break instruction exception - code 80000003 (first chance)
eax=00000000 ebx=00000000 ecx=001bf990 edx=773671b4 esi=fffffffe edi=00000000
eip=773c09c6 esp=001bf9ac ebp=001bf9d8 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!LdrpDoDebuggerBreak+0x2c:
773c09c6 cc              int     3
0:000> .lastevent
Last event: 32c.208: Break instruction exception - code 80000003 (first chance)
  debugger time: Fri Sep  4 15:46:14.922 2015 (UTC - 7:00)
0:000> .childdbg 1
Processes created by the current process will be debugged
0:000> sxd *;sxi ld;sxi ud;sxd 0xE06D7363;sxd 0xC0000420;sxd 0xC0000094;sxd 0xC0000095;sxd 0xC00000FD;sxd 0xC0000008;sxe cpr;sxe ibp;sxe epr;sxe wkd;sxe aph;sxe 0xC0000005;sxe 0xC000008C;sxe 0x80000003;sxe 0x80000002;sxe 0xC0000602;sxe 0x80000001;sxe 0xC000001D;sxe 0xC0000006;sxe 0xC0000096;sxe 0x80000004;sxe 0xC0000409;sxe 0x4000001F;sxe 0x4000001E
0:000> g

************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*http://msdl.microsoft.com/download/symbols
Deferred                                       cache*C:\Symbols*\\server\Symbols
Deferred                                       srv*http://symbols.mozilla.org/firefox
Deferred                                       srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is: 
eax=013e1b0a ebx=7ffd5000 ecx=00000000 edx=00000000 esi=00000000 edi=00000000
eip=77367198 esp=001afe44 ebp=00000000 iopl=0         nv up ei pl nz na po nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000200
77367198 89442404        mov     dword ptr [esp+4],eax ss:0023:001afe48=00000000
1:012> .lastevent
Last event: ab4.ac4: Create process 1:ab4
  debugger time: Fri Sep  4 15:46:16.200 2015 (UTC - 7:00)
1:012> .childdbg 1
Processes created by the current process will be debugged
1:012> sxd *;sxi ld;sxi ud;sxd 0xE06D7363;sxd 0xC0000420;sxd 0xC0000094;sxd 0xC0000095;sxd 0xC00000FD;sxd 0xC0000008;sxe cpr;sxe ibp;sxe epr;sxe wkd;sxe aph;sxe 0xC0000005;sxe 0xC000008C;sxe 0x80000003;sxe 0x80000002;sxe 0xC0000602;sxe 0x80000001;sxe 0xC000001D;sxe 0xC0000006;sxe 0xC0000096;sxe 0x80000004;sxe 0xC0000409;sxe 0x4000001F;sxe 0x4000001E
1:012> g
Page heap: pid 0xAB4: page heap enabled with flags 0x3.
(ab4.ac4): Break instruction exception - code 80000003 (first chance)
eax=00000000 ebx=00000000 ecx=001af95c edx=773671b4 esi=fffffffe edi=00000000
eip=773c09c6 esp=001af978 ebp=001af9a4 iopl=0         nv up ei pl zr na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000246
ntdll!LdrpDoDebuggerBreak+0x2c:
773c09c6 cc              int     3
1:012> .lastevent
Last event: ab4.ac4: Break instruction exception - code 80000003 (first chance)
  debugger time: Fri Sep  4 15:46:16.220 2015 (UTC - 7:00)
1:012> !sym quiet
quiet mode - symbol prompts off
1:012> |.
.  1 id: ab4 child name: iexplore.exe
1:012> .exr -1
ExceptionAddress: 773c09c6 (ntdll!LdrpDoDebuggerBreak+0x0000002c)
   ExceptionCode: 80000003 (Break instruction exception)
  ExceptionFlags: 00000000
NumberParameters: 3
   Parameter[0]: 00000000
   Parameter[1]: 85726918
   Parameter[2]: 773671b4
1:012> kn 0x32
 # ChildEBP RetAddr  
00 001af9a4 773a1180 ntdll!LdrpDoDebuggerBreak+0x2c
01 001afb04 7738638f ntdll!LdrpInitializeProcess+0x11a9
02 001afb54 77383921 ntdll!_LdrpInitialize+0x78
03 001afb64 00000000 ntdll!LdrInitializeThunk+0x10
1:012> lm on
start    end        module name
013e0000 01486000   iexplore iexplore.exe
6be30000 6be90000   verifier verifier.dll
75490000 7549c000   MSASN1   MSASN1.dll  
754a0000 755c1000   CRYPT32  CRYPT32.dll 
75690000 756db000   KERNELBASE KERNELBASE.dll
75730000 7575f000   XmlLite  XmlLite.dll 
75760000 757ef000   OLEAUT32 OLEAUT32.dll
757f0000 7589c000   msvcrt   msvcrt.dll  
758a0000 759fc000   ole32    ole32.dll   
75a00000 75b40000   urlmon   urlmon.dll  
75b40000 75bdd000   USP10    USP10.dll   
75be0000 75cd5000   WININET  WININET.dll 
75e00000 75e0a000   LPK      LPK.dll     
75e10000 75e5e000   GDI32    GDI32.dll   
75f40000 75f97000   SHLWAPI  SHLWAPI.dll 
75fa0000 76042000   RPCRT4   RPCRT4.dll  
76050000 76124000   kernel32 kernel32.dll
762f0000 764f1000   iertutil iertutil.dll
76550000 765f1000   ADVAPI32 ADVAPI32.dll
76600000 766c9000   USER32   USER32.dll  
766d0000 7731b000   SHELL32  SHELL32.dll 
77320000 77461000   ntdll    ntdll.dll   
77480000 77499000   sechost  sechost.dll 
1:012> sxd *;sxi ld;sxi ud;sxd 0xE06D7363;sxd 0xC0000420;sxd 0xC0000094;sxd 0xC0000095;sxd 0xC00000FD;sxd 0xC0000008;sxe cpr;sxe ibp;sxe epr;sxe wkd;sxe aph;sxe 0xC0000005;sxe 0xC000008C;sxe 0x80000003;sxe 0x80000002;sxe 0xC0000602;sxe 0x80000001;sxe 0xC000001D;sxe 0xC0000006;sxe 0xC0000096;sxe 0x80000004;sxe 0xC0000409;sxe 0x4000001F;sxe 0x4000001E
1:012> g
(ab4.b8c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=09a15e64 ebx=04b7cf80 ecx=04b7ce50 edx=000000fc esi=04b7ce50 edi=09a15e64
eip=708b2701 esp=04b7ccb4 ebp=04b7cce4 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
jscript!RegExpBase::FBadHeader+0x6:
708b2701 395004          cmp     dword ptr [eax+4],edx ds:0023:09a15e68=????????
1:021> .lastevent
Last event: ab4.b8c: Access violation - code c0000005 (first chance)
  debugger time: Fri Sep  4 15:46:19.279 2015 (UTC - 7:00)
1:021> !sym quiet
quiet mode - symbol prompts off
1:021> |.
.  1 id: ab4 child name: iexplore.exe
1:021> .exr -1
ExceptionAddress: 708b2701 (jscript!RegExpBase::FBadHeader+0x00000006)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 09a15e68
Attempt to read from address 09a15e68
1:021> kn 0x32
 # ChildEBP RetAddr  
00 04b7ccb4 708b25a7 jscript!RegExpBase::FBadHeader+0x6
01 04b7cce4 708bf7ec jscript!RegExpExec::Exec+0x3c
02 04b7cda0 708ce2ec jscript!RegExpExec::ReplaceUsingCallable+0x2b3
03 04b7cfd0 7089d5cb jscript!RegExpObj::Exec+0xaae
04 04b7d0d4 708a594a jscript!JsStrReplace+0x1e8
05 04b7d13c 708a5820 jscript!NatFncObj::Call+0x106
06 04b7d1c0 708a4f34 jscript!NameTbl::InvokeInternal+0x2b4
07 04b7d1f4 708af2cb jscript!VAR::InvokeByDispID+0x17f
08 04b7d234 708adccb jscript!VAR::InvokeJSObj<SYM *>+0xb8
09 04b7d270 708ad978 jscript!VAR::InvokeByName+0x174
0a 04b7d2bc 708ada1f jscript!VAR::InvokeDispName+0x7d
0b 04b7d2e8 708ae497 jscript!VAR::InvokeByDispID+0xce
0c 04b7d484 708a5d1f jscript!CScriptRuntime::Run+0x2b80
0d 04b7d56c 708a5c7d jscript!ScrFncObj::CallWithFrameOnStack+0xce
0e 04b7d5b4 708a5e93 jscript!ScrFncObj::Call+0x8d
0f 04b7d630 708a61b2 jscript!CSession::Execute+0x15f
10 04b7d67c 708ac389 jscript!COleScript::ExecutePendingScripts+0x1bd
11 04b7d6e0 708ac1a1 jscript!COleScript::ParseScriptTextCore+0x2a4
12 04b7d708 6f31c2fb jscript!COleScript::ParseScriptText+0x30
13 04b7d768 6f31c601 mshtml!CScriptCollection::ParseScriptText+0x231
14 04b7d82c 6f31c3d1 mshtml!CScriptElement::CommitCode+0x3c2
15 04b7d860 6f300373 mshtml!CScriptElement::Execute+0xd7
16 04b7d8ac 6f2f9836 mshtml!CHtmParse::Execute+0x4a
17 04b7d8c4 6f2fa396 mshtml!CHtmPost::Broadcast+0xf
18 04b7d984 6f2fbeec mshtml!CHtmPost::Exec+0x618
19 04b7d99c 6f2fbe50 mshtml!CHtmPost::Run+0x15
1a 04b7d9bc 6f2fbdb5 mshtml!PostManExecute+0x1fb
1b 04b7d9d8 6f30035f mshtml!PostManResume+0xf7
1c 04b7d9e8 6f2f93b2 mshtml!CHtmPost::OnDwnChanCallback+0x10
1d 04b7d9f8 6f2f8239 mshtml!CDwnChan::OnMethodCall+0x19
1e 04b7da34 6f34b1f8 mshtml!GlobalWndOnMethodCall+0x108
1f 04b7da54 7661c4e7 mshtml!GlobalWndProc+0x111
20 04b7da80 7661c5e7 USER32!InternalCallWinProc+0x23
21 04b7daf8 7661cc19 USER32!UserCallWinProcCheckWow+0x14b
22 04b7db58 7661cc70 USER32!DispatchMessageWorker+0x35e
23 04b7db68 6e7c38fc USER32!DispatchMessageW+0xf
24 04b7fc78 6e7d3c1a IEFRAME!CTabWindow::_TabWindowThreadProc+0x54b
25 04b7fd30 7645a523 IEFRAME!LCIETab_ThreadProc+0x2c1
26 04b7fd40 7609ee6c iertutil!CIsoScope::RegisterThread+0xab
27 04b7fd4c 77383ab3 kernel32!BaseThreadInitThunk+0xe
28 04b7fd8c 77383a86 ntdll!__RtlUserThreadStart+0x70
29 04b7fda4 00000000 ntdll!_RtlUserThreadStart+0x1b
1:021> lm on
start    end        module name
013e0000 01486000   iexplore iexplore.exe
6bc60000 6bccf000   ieapfltr ieapfltr.dll
6bd70000 6bda6000   IEShims  IEShims.dll 
6bdb0000 6bddb000   ieproxy  ieproxy.dll 
6be30000 6be90000   verifier verifier.dll
6e6f0000 6f179000   IEFRAME  IEFRAME.dll 
6f180000 6f745000   mshtml   mshtml.dll  
70550000 70558000   winrnr   winrnr.dll  
70890000 70942000   jscript  jscript.dll 
714e0000 714f2000   pnrpnsp  pnrpnsp.dll 
71520000 71530000   napinsp  napinsp.dll 
71530000 71536000   rasadhlp rasadhlp.dll
71620000 7164e000   MLANG    MLANG.dll   
71740000 7176a000   msls31   msls31.dll  
719d0000 71a0c000   OLEACC   OLEACC.dll  
72a20000 72a34000   MSACM32  MSACM32.dll 
72a40000 72a72000   WINMM    WINMM.dll   
72e20000 72f54000   msxml3   msxml3.dll  
73510000 73548000   fwpuclnt fwpuclnt.dll
735a0000 735a7000   WINNSI   WINNSI.DLL  
735e0000 735fc000   iphlpapi iphlpapi.DLL
73640000 7364b000   msimtf   msimtf.dll  
737d0000 737da000   slc      slc.dll     
73820000 7382f000   wkscli   wkscli.dll  
73840000 73849000   netutils netutils.dll
73b20000 73b45000   rdpendp  rdpendp.dll 
73b50000 73b56000   sensapi  sensapi.dll 
73b70000 73b85000   rasman   rasman.dll  
73b90000 73be2000   RASAPI32 RASAPI32.dll
73d60000 73d70000   NLAapi   NLAapi.dll  
73dc0000 73dcd000   WTSAPI32 WTSAPI32.dll
73e00000 73e39000   MMDevAPI MMDevAPI.DLL
73ec0000 73ecd000   rtutils  rtutils.dll 
73f50000 73f63000   DWMAPI   DWMAPI.DLL  
74230000 74325000   propsys  propsys.dll 
74480000 744a1000   ntmarta  ntmarta.dll 
744b0000 7464e000   comctl32 comctl32.dll
747d0000 74810000   UxTheme  UxTheme.dll 
74910000 74919000   VERSION  VERSION.dll 
749a0000 749a5000   wshtcpip wshtcpip.dll
74b70000 74bad000   bcryptprimitives bcryptprimitives.dll
74c30000 74c6b000   rsaenh   rsaenh.dll  
74d10000 74d54000   dnsapi   dnsapi.DLL  
74e40000 74e46000   wship6   wship6.dll  
74e50000 74e8c000   mswsock  mswsock.dll 
74e90000 74ea7000   CRYPTSP  CRYPTSP.dll 
74fa0000 74fb7000   bcrypt   bcrypt.dll  
751b0000 751b8000   Secur32  Secur32.dll 
75300000 7531b000   SspiCli  SspiCli.dll 
75320000 7536c000   apphelp  apphelp.dll 
75370000 7537c000   CRYPTBASE CRYPTBASE.DLL
75380000 753df000   SXS      SXS.DLL     
753e0000 75409000   WINSTA   WINSTA.dll  
75410000 7541e000   RpcRtRemote RpcRtRemote.dll
75420000 7542b000   profapi  profapi.dll 
75490000 7549c000   MSASN1   MSASN1.dll  
754a0000 755c1000   CRYPT32  CRYPT32.dll 
75690000 756db000   KERNELBASE KERNELBASE.dll
756e0000 756f2000   DEVOBJ   DEVOBJ.dll  
75700000 75727000   CFGMGR32 CFGMGR32.dll
75730000 7575f000   XmlLite  XmlLite.dll 
75760000 757ef000   OLEAUT32 OLEAUT32.dll
757f0000 7589c000   msvcrt   msvcrt.dll  
758a0000 759fc000   ole32    ole32.dll   
75a00000 75b40000   urlmon   urlmon.dll  
75b40000 75bdd000   USP10    USP10.dll   
75be0000 75cd5000   WININET  WININET.dll 
75ce0000 75d15000   ws2_32   ws2_32.DLL  
75d20000 75d25000   PSAPI    PSAPI.DLL   
75d30000 75dfc000   MSCTF    MSCTF.dll   
75e00000 75e0a000   LPK      LPK.dll     
75e10000 75e5e000   GDI32    GDI32.dll   
75e60000 75edb000   comdlg32 comdlg32.dll
75f40000 75f97000   SHLWAPI  SHLWAPI.dll 
75fa0000 76042000   RPCRT4   RPCRT4.dll  
76050000 76124000   kernel32 kernel32.dll
76130000 7614f000   IMM32    IMM32.DLL   
76150000 762ed000   SETUPAPI SETUPAPI.dll
762f0000 764f1000   iertutil iertutil.dll
76500000 76545000   WLDAP32  WLDAP32.dll 
76550000 765f1000   ADVAPI32 ADVAPI32.dll
76600000 766c9000   USER32   USER32.dll  
766d0000 7731b000   SHELL32  SHELL32.dll 
77320000 77461000   ntdll    ntdll.dll   
77470000 77473000   Normaliz Normaliz.dll
77480000 77499000   sechost  sechost.dll 
774d0000 77553000   CLBCatQ  CLBCatQ.DLL 
77560000 77566000   NSI      NSI.dll     
1:021> !heap -p -a 0x9A15E68
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_PEB                                    ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_PEB                                    ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_PEB                                    ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_PEB                                    ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_ENTRY                             ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_ENTRY                             ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_UNCOMMMTTED_RANGE                 ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_UNCOMMMTTED_RANGE                 ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_SEGMENT                           ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_SEGMENT                           ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_LOOKASIDE                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_LOOKASIDE                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_VIRTUAL_ALLOC_ENTRY                ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_VIRTUAL_ALLOC_ENTRY                ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP                                   ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP                                   ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_ENTRY_EXTRA                       ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_ENTRY_EXTRA                       ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_RTL_PROCESS_MODULE_INFORMATION                ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_RTL_PROCESS_MODULE_INFORMATION                ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_STACK_TRACE_DATABASE                   ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_STACK_TRACE_DATABASE                   ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_DPH_HEAP_ROOT                          ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_DPH_HEAP_ROOT                          ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_DPH_HEAP_BLOCK                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_DPH_HEAP_BLOCK                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_DPH_BLOCK_INFORMATION                  ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_DPH_BLOCK_INFORMATION                  ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_RTL_STACK_TRACE_ENTRY                  ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_RTL_STACK_TRACE_ENTRY                  ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_LFH_HEAP                               ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_LFH_HEAP                               ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_LFH_BLOCK_ZONE                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_LFH_BLOCK_ZONE                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_SUBSEGMENT                        ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_SUBSEGMENT                        ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_USERDATA_HEADER                   ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_USERDATA_HEADER                   ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_UCR_DESCRIPTOR                    ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_UCR_DESCRIPTOR                    ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_STACK_TRACE_LOG_ENTRY                ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_HEAP_STACK_TRACE_LOG_ENTRY                ***
***                                                                   ***
*************************************************************************
    address 09a15e68 found in
    _DPH_HEAP_ROOT @ 11b1000
    in free-ed allocation (  DPH_HEAP_BLOCK:         VirtAddr         VirtSize)
                                    99f1b2c:          9a15000             2000
    6be390b2 verifier!AVrfDebugPageHeapFree+0x000000c2
    773e6dbc ntdll!RtlDebugFreeHeap+0x0000002f
    773aa4c7 ntdll!RtlpFreeHeap+0x0000005d
    77376896 ntdll!RtlFreeHeap+0x00000142
    758f6e6a ole32!CRetailMalloc_Free+0x0000001c
    7576449b OLEAUT32!APP_DATA::FreeCachedMem+0x000000c1
    75763ea3 OLEAUT32!SysFreeString+0x0000006b
    75764870 OLEAUT32!VariantClear+0x000000c3
    6e7ecd03 IEFRAME!Detour_VariantClear+0x0000002f
    708b72e5 jscript!VAR::Clear+0x0000009c
    708b6fb6 jscript!GcContext::Reclaim+0x000000b6
    708b44ca jscript!GcContext::CollectCore+0x00000133
    708b4cc2 jscript!CScriptRuntime::Run+0x000039dc
    708a5d1f jscript!ScrFncObj::CallWithFrameOnStack+0x000000ce
    708a5c7d jscript!ScrFncObj::Call+0x0000008d
    708bf66b jscript!RegExpExec::CallEntryPoint+0x00000022
    708bf747 jscript!RegExpExec::ReplaceUsingCallable+0x00000214
    708ce2ec jscript!RegExpObj::Exec+0x00000aae
    7089d5cb jscript!JsStrReplace+0x000001e8
    708a594a jscript!NatFncObj::Call+0x00000106
    708a5820 jscript!NameTbl::InvokeInternal+0x000002b4
    708a4f34 jscript!VAR::InvokeByDispID+0x0000017f
    708af2cb jscript!VAR::InvokeJSObj<SYM *>+0x000000b8
    708adccb jscript!VAR::InvokeByName+0x00000174
    708ad978 jscript!VAR::InvokeDispName+0x0000007d
    708ada1f jscript!VAR::InvokeByDispID+0x000000ce
    708ae497 jscript!CScriptRuntime::Run+0x00002b80
    708a5d1f jscript!ScrFncObj::CallWithFrameOnStack+0x000000ce
    708a5c7d jscript!ScrFncObj::Call+0x0000008d
    708a5e93 jscript!CSession::Execute+0x0000015f
    708a61b2 jscript!COleScript::ExecutePendingScripts+0x000001bd
    708ac389 jscript!COleScript::ParseScriptTextCore+0x000002a4
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Either you specified an unqualified symbol, or your debugger   ***
***    doesn't have full symbol information.  Unqualified symbol      ***
***    resolution is turned off by default. Please either specify a   ***
***    fully qualified symbol module!symbolname, or enable resolution ***
***    of unqualified symbols by typing ".symopt- 100". Note that   ***
***    enabling unqualified symbol resolution with network symbol     ***
***    server shares in the symbol path may cause the debugger to     ***
***    appear to hang for long periods of time when an incorrect      ***
***    symbol name is typed or the network symbol server is down.     ***
***                                                                   ***
***    For some commands to work properly, your symbol path           ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information.  Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: ntdll!_STACK_TRACE_DATABASE                   ***
***                                                                   ***
*************************************************************************

 
1:021> lm M *iexplore.exe
start    end        module name
013e0000 01486000   iexplore   (deferred)             
1:021> lmv m *iexplore
start    end        module name
013e0000 01486000   iexplore   (deferred)             
    Image path: iexplore.exe
    Image name: iexplore.exe
    Timestamp:        Thu Jul 16 09:55:30 2015 (55A7E202)
    CheckSum:         000A9DD0
    ImageSize:        000A6000
    File version:     8.0.7601.18934
    Product version:  8.0.7601.18934
    File flags:       0 (Mask 3F)
    File OS:          40004 NT Win32
    File type:        1.0 App
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Windows� Internet Explorer
    InternalName:     iexplore
    OriginalFilename: IEXPLORE.EXE
    ProductVersion:   8.00.7601.18934
    FileVersion:      8.00.7601.18934 (win7sp1_gdr.150716-0600)
    FileDescription:  Internet Explorer
    LegalCopyright:   � Microsoft Corporation. All rights reserved.
1:021> lmv m *jscript
start    end        module name
70890000 70942000   jscript    (pdb symbols)          c:\symbols\jscript.pdb\58109943E5154F55AFC6AB3B329A28132\jscript.pdb
    Loaded symbol image file: C:\Windows\System32\jscript.dll
    Image path: C:\Windows\System32\jscript.dll
    Image name: jscript.dll
    Timestamp:        Thu Jul 16 12:04:48 2015 (55A80050)
    CheckSum:         000B9049
    ImageSize:        000B2000
    File version:     5.8.7601.18934
    Product version:  5.8.7601.18934
    File flags:       0 (Mask 3)
    File OS:          4 Unknown Win32
    File type:        2.0 Dll
    File date:        00000000.00000000
    Translations:     0409.04b0
    CompanyName:      Microsoft Corporation
    ProductName:      Microsoft � JScript
    InternalName:     jscript.dll
    OriginalFilename: jscript.dll
    ProductVersion:   5.8.7601.18934
    FileVersion:      5.8.7601.18934
    FileDescription:  Microsoft � JScript
    LegalCopyright:   � Microsoft Corporation. All rights reserved.
1:021>