Code:
-
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [D:\Kingston\BSODDmpFiles\wikke\022312-12729-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c4d000 PsLoadedModuleList = 0xfffff800`02e92670
Debug session time: Thu Feb 23 11:52:21.166 2012 (UTC - 6:00)
System Uptime: 0 days 0:07:51.929
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff80003ddb008, 0, fffff80002c8f6cb, 2}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!PsGetProcessSessionId+1b )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff80003ddb008, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002c8f6cb, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002efc100
fffff80003ddb008
FAULTING_IP:
nt!PsGetProcessSessionId+1b
fffff800`02c8f6cb 8b4008 mov eax,dword ptr [rax+8]
MM_INTERNAL_CODE: 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: HitmanPro36_x6
CURRENT_IRQL: 0
TRAP_FRAME: fffff880083e7540 -- (.trap 0xfffff880083e7540)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80003ddb000 rbx=0000000000000000 rcx=fffffa8003adeb30
rdx=00000000ffffffff rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002c8f6cb rsp=fffff880083e76d8 rbp=fffff880083e7ca0
r8=0000000000000000 r9=0000000002d58658 r10=fffffa8003adeb00
r11=fffffa8004565640 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!PsGetProcessSessionId+0x1b:
fffff800`02c8f6cb 8b4008 mov eax,dword ptr [rax+8] ds:8658:fffff800`03ddb008=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002c743f0 to fffff80002cc9c40
STACK_TEXT:
fffff880`083e73d8 fffff800`02c743f0 : 00000000`00000050 fffff800`03ddb008 00000000`00000000 fffff880`083e7540 : nt!KeBugCheckEx
fffff880`083e73e0 fffff800`02cc7d6e : 00000000`00000000 fffff800`03ddb008 fffff880`083e7600 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x447c6
fffff880`083e7540 fffff800`02c8f6cb : fffff800`02f8587d 00000000`00000000 fffff880`083e7ca0 00000000`0000e6d0 : nt!KiPageFault+0x16e
fffff880`083e76d8 fffff800`02f8587d : 00000000`00000000 fffff880`083e7ca0 00000000`0000e6d0 00000000`02d58558 : nt!PsGetProcessSessionId+0x1b
fffff880`083e76e0 fffff800`02fd39f6 : 00000000`02d4a270 00000000`00008000 fffff880`083e7870 00000000`00000000 : nt!ExpGetProcessInformation+0xce
fffff880`083e7830 fffff800`02fd4449 : 00000000`02d4a270 00000000`00000000 00000000`00008000 00000000`000006d5 : nt!ExpQuerySystemInformation+0xfb4
fffff880`083e7be0 fffff800`02cc8ed3 : 00000000`00000001 00000000`02d5227a 00000000`02ce6501 00000000`00310000 : nt!NtQuerySystemInformation+0x4d
fffff880`083e7c20 00000000`77bf167a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0695f778 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77bf167a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!PsGetProcessSessionId+1b
fffff800`02c8f6cb 8b4008 mov eax,dword ptr [rax+8]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!PsGetProcessSessionId+1b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x50_nt!PsGetProcessSessionId+1b
BUCKET_ID: X64_0x50_nt!PsGetProcessSessionId+1b
Followup: MachineOwner
---------
- Loading Dump File [D:\Kingston\BSODDmpFiles\wikke\022312-12916-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c65000 PsLoadedModuleList = 0xfffff800`02eaa670
Debug session time: Thu Feb 23 11:43:31.215 2012 (UTC - 6:00)
System Uptime: 0 days 1:46:10.604
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {0, 2, 0, fffff880112c0ecb}
Unable to load image \SystemRoot\system32\DRIVERS\nvlddmkm.sys, Win32 error 0n2
*** WARNING: Unable to verify timestamp for nvlddmkm.sys
*** ERROR: Module load completed but symbols could not be loaded for nvlddmkm.sys
Probably caused by : nvlddmkm.sys ( nvlddmkm+2fecb )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, value 0 = read operation, 1 = write operation
Arg4: fffff880112c0ecb, address which referenced memory
Debugging Details:
------------------
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f14100
0000000000000000
CURRENT_IRQL: 2
FAULTING_IP:
nvlddmkm+2fecb
fffff880`112c0ecb 41b811000000 mov r8d,11h
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
TRAP_FRAME: fffff880035b9640 -- (.trap 0xfffff880035b9640)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff880112c0e79 rbx=0000000000000000 rcx=fffff88011e7ffa0
rdx=0000000080000102 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880112c0ecb rsp=fffff880035b97d0 rbp=0000000000000000
r8=000000000000ff00 r9=0000000000000000 r10=fffffa8004232188
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nvlddmkm+0x2fecb:
fffff880`112c0ecb 41b811000000 mov r8d,11h
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002ce11e9 to fffff80002ce1c40
STACK_TEXT:
fffff880`035b94f8 fffff800`02ce11e9 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
fffff880`035b9500 fffff800`02cdfe60 : 00000000`00000000 fffffa80`0424b530 fffffa80`041e7400 fffff880`035b9940 : nt!KiBugCheckDispatch+0x69
fffff880`035b9640 fffff880`112c0ecb : fffff880`000000d8 fffff880`035b9940 fffffa80`00000000 fffffa80`026f1000 : nt!KiPageFault+0x260
fffff880`035b97d0 fffff880`000000d8 : fffff880`035b9940 fffffa80`00000000 fffffa80`026f1000 fffff880`112c0d1e : nvlddmkm+0x2fecb
fffff880`035b97d8 fffff880`035b9940 : fffffa80`00000000 fffffa80`026f1000 fffff880`112c0d1e fffffa80`026f1000 : 0xfffff880`000000d8
fffff880`035b97e0 fffffa80`00000000 : fffffa80`026f1000 fffff880`112c0d1e fffffa80`026f1000 fffffa80`041e7400 : 0xfffff880`035b9940
fffff880`035b97e8 fffffa80`026f1000 : fffff880`112c0d1e fffffa80`026f1000 fffffa80`041e7400 fffffa80`04231010 : 0xfffffa80`00000000
fffff880`035b97f0 fffff880`112c0d1e : fffffa80`026f1000 fffffa80`041e7400 fffffa80`04231010 fffffa80`04232010 : 0xfffffa80`026f1000
fffff880`035b97f8 fffffa80`026f1000 : fffffa80`041e7400 fffffa80`04231010 fffffa80`04232010 00000000`00000000 : nvlddmkm+0x2fd1e
fffff880`035b9800 fffffa80`041e7400 : fffffa80`04231010 fffffa80`04232010 00000000`00000000 00000000`00000000 : 0xfffffa80`026f1000
fffff880`035b9808 fffffa80`04231010 : fffffa80`04232010 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffffa80`041e7400
fffff880`035b9810 fffffa80`04232010 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`000000d8 : 0xfffffa80`04231010
fffff880`035b9818 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`000000d8 00000000`0000088a : 0xfffffa80`04232010
STACK_COMMAND: kb
FOLLOWUP_IP:
nvlddmkm+2fecb
fffff880`112c0ecb 41b811000000 mov r8d,11h
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nvlddmkm+2fecb
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nvlddmkm
IMAGE_NAME: nvlddmkm.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4e99233b
FAILURE_BUCKET_ID: X64_0xD1_nvlddmkm+2fecb
BUCKET_ID: X64_0xD1_nvlddmkm+2fecb
Followup: MachineOwner
---------
-
Loading Dump File [D:\Kingston\BSODDmpFiles\wikke\022312-11341-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c64000 PsLoadedModuleList = 0xfffff800`02ea9670
Debug session time: Thu Feb 23 09:56:21.849 2012 (UTC - 6:00)
System Uptime: 0 days 2:29:03.238
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffffa0004593508, 0, fffff80002d09690, 7}
Could not read faulting driver name
Probably caused by : memory_corruption ( nt!MiInsertNode+20 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffa0004593508, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002d09690, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000007, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f13100
fffffa0004593508
FAULTING_IP:
nt!MiInsertNode+20
fffff800`02d09690 493b4018 cmp rax,qword ptr [r8+18h]
MM_INTERNAL_CODE: 7
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: firefox.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800762c730 -- (.trap 0xfffff8800762c730)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000019d40 rbx=0000000000000000 rcx=fffffa00045934f0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002d09690 rsp=fffff8800762c8c8 rbp=fffffa8002a22b28
r8=fffffa00045934f0 r9=00000000000004c8 r10=fffffa8001c04330
r11=fffffa8002a22bd8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!MiInsertNode+0x20:
fffff800`02d09690 493b4018 cmp rax,qword ptr [r8+18h] ds:8fff:fffffa00`04593508=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002c8b347 to fffff80002ce0c40
STACK_TEXT:
fffff880`0762c5c8 fffff800`02c8b347 : 00000000`00000050 fffffa00`04593508 00000000`00000000 fffff880`0762c730 : nt!KeBugCheckEx
fffff880`0762c5d0 fffff800`02cded6e : 00000000`00000000 fffffa00`04593508 fffffa80`03f6ac00 fffffa80`02a22790 : nt! ?? ::FNODOBFM::`string'+0x44711
fffff880`0762c730 fffff800`02d09690 : fffff800`02d15d82 fffffa80`01b60060 00000000`00000000 00000000`19dd8fff : nt!KiPageFault+0x16e
fffff880`0762c8c8 fffff800`02d15d82 : fffffa80`01b60060 00000000`00000000 00000000`19dd8fff 00000000`00000098 : nt!MiInsertNode+0x20
fffff880`0762c8d0 fffff800`02ff9c6b : fffffa80`02a22790 fffffa80`04281010 fffffa80`01c04330 00000000`00000000 : nt!MiGetWsAndInsertVad+0x62
fffff880`0762c910 fffff800`02ffa32b : fffffa80`04281010 fffffa80`02a22790 fffff880`0762cb50 fffffa80`01b60060 : nt!MiMapViewOfDataSection+0x45b
fffff880`0762c9f0 fffff800`02ffa78e : fffffa80`00000001 fffffa80`02a22790 fffff880`0762cb50 00000000`00000020 : nt!MiMapViewOfSection+0x20b
fffff880`0762cae0 fffff800`02cdfed3 : 00000000`00000f60 fffffa80`01b60060 00000000`005be238 fffff800`00000001 : nt!NtMapViewOfSection+0x2bd
fffff880`0762cbb0 00000000`77cd159a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`005be218 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77cd159a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!MiInsertNode+20
fffff800`02d09690 493b4018 cmp rax,qword ptr [r8+18h]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiInsertNode+20
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
IMAGE_NAME: memory_corruption
FAILURE_BUCKET_ID: X64_0x50_nt!MiInsertNode+20
BUCKET_ID: X64_0x50_nt!MiInsertNode+20
Followup: MachineOwner
---------
-
Loading Dump File [D:\Kingston\BSODDmpFiles\wikke\022312-13478-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c49000 PsLoadedModuleList = 0xfffff800`02e8e670
Debug session time: Wed Feb 22 17:31:06.000 2012 (UTC - 6:00)
System Uptime: 0 days 0:41:18.763
Loading Kernel Symbols
...............................................................
................................................................
......................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff82003f235d0, 0, fffff88001116626, 5}
Could not read faulting driver name
Probably caused by : fltmgr.sys ( fltmgr!TreeUnlinkNoBalance+6 )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff82003f235d0, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff88001116626, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000005, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ef8100
fffff82003f235d0
FAULTING_IP:
fltmgr!TreeUnlinkNoBalance+6
fffff880`01116626 488b5118 mov rdx,qword ptr [rcx+18h]
MM_INTERNAL_CODE: 5
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: System
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800314f600 -- (.trap 0xfffff8800314f600)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa80018cbb60 rbx=0000000000000000 rcx=fffff82003f235b8
rdx=ffffffffffffffff rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001116626 rsp=fffff8800314f790 rbp=fffffa8004696ec8
r8=ffffffffffffffff r9=ffffffffffffffff r10=fffff80002c49000
r11=0000000000000398 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
fltmgr!TreeUnlinkNoBalance+0x6:
fffff880`01116626 488b5118 mov rdx,qword ptr [rcx+18h] ds:0008:fffff820`03f235d0=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002c703bf to fffff80002cc5c40
STACK_TEXT:
fffff880`0314f498 fffff800`02c703bf : 00000000`00000050 fffff820`03f235d0 00000000`00000000 fffff880`0314f600 : nt!KeBugCheckEx
fffff880`0314f4a0 fffff800`02cc3d6e : 00000000`00000000 fffff820`03f235d0 00000000`00000000 fffff820`03f235b8 : nt! ?? ::FNODOBFM::`string'+0x44791
fffff880`0314f600 fffff880`01116626 : 00000000`00000000 fffffa80`0199b150 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x16e
fffff880`0314f790 fffff880`011142c8 : 00000000`00000703 fffff8a0`03f47070 fffff8a0`73634946 fffff8a0`03f470a0 : fltmgr!TreeUnlinkNoBalance+0x6
fffff880`0314f7c0 fffff880`011322af : fffffa80`04696e98 fffff880`01132178 fffff8a0`03f47028 fffff880`0110f000 : fltmgr!TreeUnlinkMulti+0x148
fffff880`0314f810 fffff880`01134341 : fffffa80`04696e50 fffffa80`022b2010 00000000`00000130 fffff8a0`03cde140 : fltmgr!DeleteNameCacheNodes+0x9f
fffff880`0314f850 fffff880`011343fb : fffffa80`022b2010 00000000`00000000 fffffa80`022b2010 00000000`000007ff : fltmgr!CleanupStreamListCtrl+0x51
fffff880`0314f890 fffff800`02f7e90e : 00000000`00000001 00000000`00000000 00000000`00000000 fffff8a0`03f33901 : fltmgr!DeleteStreamListCtrlCallback+0x6b
fffff880`0314f8c0 fffff880`012ddbac : fffff8a0`03cde140 fffffa80`018cbb60 fffff880`0314f998 00000000`00000706 : nt!FsRtlTeardownPerStreamContexts+0xe2
fffff880`0314f910 fffff880`012e2cc1 : 00000000`00000000 00000000`00000000 fffff800`02e66200 00000000`00000001 : Ntfs!NtfsDeleteScb+0x108
fffff880`0314f950 fffff880`0125b85c : fffff8a0`03cde040 fffff8a0`03cde140 fffff800`02e66200 fffff8a0`03f335c0 : Ntfs!NtfsRemoveScb+0x61
fffff880`0314f990 fffff880`0125aa3f : fffff8a0`03cde010 fffff800`02e66260 fffff880`0314fb01 fffffa80`04785010 : Ntfs!NtfsPrepareFcbForRemoval+0x50
fffff880`0314f9c0 fffff880`012e063c : fffffa80`04785010 fffffa80`022a8180 fffff8a0`03f33590 fffff8a0`03f33928 : Ntfs!NtfsTeardownFromLcb+0x2af
fffff880`0314fa50 fffff880`012620e2 : fffffa80`04785010 fffffa80`04785010 fffff8a0`03f33590 fffff880`0314fc00 : Ntfs!NtfsTeardownStructures+0xcc
fffff880`0314fad0 fffff880`012f0193 : fffffa80`022a8180 fffff800`02e66260 fffff8a0`6366744e 00000000`00000009 : Ntfs!NtfsDecrementCloseCounts+0xa2
fffff880`0314fb10 fffff880`012df357 : fffffa80`04785010 fffff8a0`03f336c0 fffff8a0`03f33590 fffffa80`022a8180 : Ntfs!NtfsCommonClose+0x353
fffff880`0314fbe0 fffff800`02cd0001 : 00000000`00000000 fffff800`02fbc900 fffff800`02ec7801 fffffa80`00000002 : Ntfs!NtfsFspClose+0x15f
fffff880`0314fcb0 fffff800`02f60fee : 00000000`00000000 fffffa80`018cbb60 00000000`00000080 fffffa80`018be9e0 : nt!ExpWorkerThread+0x111
fffff880`0314fd40 fffff800`02cb75e6 : fffff880`02f63180 fffffa80`018cbb60 fffff880`02f6dfc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`0314fd80 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
fltmgr!TreeUnlinkNoBalance+6
fffff880`01116626 488b5118 mov rdx,qword ptr [rcx+18h]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: fltmgr!TreeUnlinkNoBalance+6
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: fltmgr
IMAGE_NAME: fltmgr.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4ce7929c
FAILURE_BUCKET_ID: X64_0x50_fltmgr!TreeUnlinkNoBalance+6
BUCKET_ID: X64_0x50_fltmgr!TreeUnlinkNoBalance+6
Followup: MachineOwner
---------