Code:
-
Microsoft (R) Windows Debugger Version 6.11.0001.404 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [F:\BSODDmpFiles\midna34704\Windows_NT6_BSOD_jcgriff2\013112-23602-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) UP Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c05000 PsLoadedModuleList = 0xfffff800`02e4a670
Debug session time: Tue Jan 31 14:58:58.615 2012 (GMT-7)
System Uptime: 0 days 3:02:43.254
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
........
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff80002f7aa9a, 1, 18}
Probably caused by : ntkrnlmp.exe ( nt!ObpCreateHandle+29a )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002f7aa9a, The address that the exception occurred at
Arg3: 0000000000000001, Parameter 0 of the exception
Arg4: 0000000000000018, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ObpCreateHandle+29a
fffff800`02f7aa9a f0480fba6f1800 lock bts qword ptr [rdi+18h],0
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 0000000000000018
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eb4100
0000000000000018
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x1E
PROCESS_NAME: Pen_TouchUser.
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800355b300 -- (.trap 0xfffff8800355b300)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa8002407680
rdx=00000000000f001f rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002f7aa9a rsp=fffff8800355b490 rbp=0000000000000000
r8=fffff8a00fb59060 r9=00000000000000e8 r10=0000000000000000
r11=fffff8a00fb59010 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po nc
nt!ObpCreateHandle+0x29a:
fffff800`02f7aa9a f0480fba6f1800 lock bts qword ptr [rdi+18h],0 ds:00000000`00000018=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002ccd588 to fffff80002c81c40
STACK_TEXT:
fffff880`0355aa78 fffff800`02ccd588 : 00000000`0000001e ffffffff`c0000005 fffff800`02f7aa9a 00000000`00000001 : nt!KeBugCheckEx
fffff880`0355aa80 fffff800`02c812c2 : fffff880`0355b258 00000000`00000000 fffff880`0355b300 fffffa80`02407680 : nt! ?? ::FNODOBFM::`string'+0x4977d
fffff880`0355b120 fffff800`02c7fe3a : 00000000`00000001 00000000`00000018 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`0355b300 fffff800`02f7aa9a : fffff880`00000000 fffff880`0355b4e0 fffffa80`07fc5b30 fffff8a0`0fb59060 : nt!KiPageFault+0x23a
fffff880`0355b490 fffff800`02f6c27e : fffffa80`00000000 fffff8a0`0fb59060 fffff8a0`000f001f 00000000`00000000 : nt!ObpCreateHandle+0x29a
fffff880`0355b5a0 fffff800`02f5d623 : fffffa80`02f62800 fffff880`0355b960 fffffa80`0846c0e0 00000000`08000000 : nt!ObInsertObjectEx+0xde
fffff880`0355b7f0 fffff800`02c80ed3 : fffffa80`02407680 fffff880`0355ba98 fffff880`0355b888 fffffa80`08afd620 : nt!NtCreateSection+0x1fe
fffff880`0355b870 fffff800`02c7d470 : fffffa80`035cfa76 fffff880`0355bb80 00000000`00000000 fffffa80`035d3250 : nt!KiSystemServiceCopyEnd+0x13
fffff880`0355ba78 fffffa80`035cfa76 : fffff880`0355bb80 00000000`00000000 fffffa80`035d3250 fffffa80`035d6540 : nt!KiServiceLinkage
fffff880`0355ba80 fffff880`0355bb80 : 00000000`00000000 fffffa80`035d3250 fffffa80`035d6540 fffffa80`00000002 : 0xfffffa80`035cfa76
fffff880`0355ba88 00000000`00000000 : fffffa80`035d3250 fffffa80`035d6540 fffffa80`00000002 00000000`08000000 : 0xfffff880`0355bb80
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ObpCreateHandle+29a
fffff800`02f7aa9a f0480fba6f1800 lock bts qword ptr [rdi+18h],0
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!ObpCreateHandle+29a
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0x1E_nt!ObpCreateHandle+29a
BUCKET_ID: X64_0x1E_nt!ObpCreateHandle+29a
Followup: MachineOwner
---------
-
Loading Dump File [F:\BSODDmpFiles\midna34704\Windows_NT6_BSOD_jcgriff2\013012-46566-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) UP Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c0b000 PsLoadedModuleList = 0xfffff800`02e50670
Debug session time: Mon Jan 30 16:19:26.032 2012 (GMT-7)
System Uptime: 0 days 3:43:26.655
Loading Kernel Symbols
...............................................................
................................................................
....................................
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1E, {ffffffffc0000005, fffff80002f80a9a, 1, 18}
Probably caused by : tcpip.sys ( tcpip!LruContext+450 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff80002f80a9a, The address that the exception occurred at
Arg3: 0000000000000001, Parameter 0 of the exception
Arg4: 0000000000000018, Parameter 1 of the exception
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
nt!ObpCreateHandle+29a
fffff800`02f80a9a f0480fba6f1800 lock bts qword ptr [rdi+18h],0
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 0000000000000018
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002eba100
0000000000000018
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x1E
PROCESS_NAME: Pen_TouchUser.
CURRENT_IRQL: 0
TRAP_FRAME: fffff88008c37300 -- (.trap 0xfffff88008c37300)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffa800771cb60
rdx=00000000000f001f rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002f80a9a rsp=fffff88008c37490 rbp=0000000000000000
r8=fffff8a00e64ef90 r9=00000000000000e8 r10=0000000000000000
r11=fffff8a00e64ef40 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po nc
nt!ObpCreateHandle+0x29a:
fffff800`02f80a9a f0480fba6f1800 lock bts qword ptr [rdi+18h],0 ds:00000000`00000018=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002cd3588 to fffff80002c87c40
STACK_TEXT:
fffff880`08c36a78 fffff800`02cd3588 : 00000000`0000001e ffffffff`c0000005 fffff800`02f80a9a 00000000`00000001 : nt!KeBugCheckEx
fffff880`08c36a80 fffff800`02c872c2 : fffff880`08c37258 00000000`00000000 fffff880`08c37300 fffffa80`0771cb60 : nt! ?? ::FNODOBFM::`string'+0x4977d
fffff880`08c37120 fffff800`02c85e3a : 00000000`00000001 00000000`00000018 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0xc2
fffff880`08c37300 fffff800`02f80a9a : fffff880`00000000 fffff880`08c374e0 fffffa80`025eb990 fffff8a0`0e64ef90 : nt!KiPageFault+0x23a
fffff880`08c37490 fffff800`02f7227e : fffffa80`00000000 fffff8a0`0e64ef90 fffff8a0`000f001f 00000000`00000000 : nt!ObpCreateHandle+0x29a
fffff880`08c375a0 fffff800`02f63623 : fffffa80`02a4c7c0 fffff880`08c37960 fffffa80`02984010 00000000`08000000 : nt!ObInsertObjectEx+0xde
fffff880`08c377f0 fffff800`02c86ed3 : fffffa80`0771cb60 fffff880`08c37a98 fffff880`08c37888 fffffa80`05b3f010 : nt!NtCreateSection+0x1fe
fffff880`08c37870 fffff800`02c83470 : fffffa80`05499a76 fffff880`08c37b80 fffff800`02c97000 fffffa80`0549d250 : nt!KiSystemServiceCopyEnd+0x13
fffff880`08c37a78 fffffa80`05499a76 : fffff880`08c37b80 fffff800`02c97000 fffffa80`0549d250 fffffa80`054a0540 : nt!KiServiceLinkage
fffff880`08c37a80 fffff880`08c37b80 : fffff800`02c97000 fffffa80`0549d250 fffffa80`054a0540 fffffa80`00000002 : 0xfffffa80`05499a76
fffff880`08c37a88 fffff800`02c97000 : fffffa80`0549d250 fffffa80`054a0540 fffffa80`00000002 00000000`08000000 : 0xfffff880`08c37b80
fffff880`08c37a90 ffffffff`800005dc : ffffffff`ff676980 fffff880`01e27650 fffff880`01e276b0 fffff880`00000030 : nt!KiTryUnwaitThread+0x1fa
fffff880`08c37af0 ffffffff`ff676980 : fffff880`01e27650 fffff880`01e276b0 fffff880`00000030 00000000`00000000 : 0xffffffff`800005dc
fffff880`08c37af8 fffff880`01e27650 : fffff880`01e276b0 fffff880`00000030 00000000`00000000 fffff880`08c37b38 : 0xffffffff`ff676980
fffff880`08c37b00 fffff880`01e276b0 : fffff880`00000030 00000000`00000000 fffff880`08c37b38 fffff880`00000240 : tcpip!LruContext+0x450
fffff880`08c37b08 fffff880`00000030 : 00000000`00000000 fffff880`08c37b38 fffff880`00000240 00000000`00000000 : tcpip!LruContext+0x4b0
fffff880`08c37b10 00000000`00000000 : fffff880`08c37b38 fffff880`00000240 00000000`00000000 00000000`00000000 : 0xfffff880`00000030
STACK_COMMAND: kb
FOLLOWUP_IP:
tcpip!LruContext+450
fffff880`01e27650 ?? ???
SYMBOL_STACK_INDEX: e
SYMBOL_NAME: tcpip!LruContext+450
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: tcpip
IMAGE_NAME: tcpip.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4e83e948
FAILURE_BUCKET_ID: X64_0x1E_tcpip!LruContext+450
BUCKET_ID: X64_0x1E_tcpip!LruContext+450
Followup: MachineOwner
---------
-
Loading Dump File [F:\BSODDmpFiles\midna34704\Windows_NT6_BSOD_jcgriff2\012912-29983-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) UP Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c13000 PsLoadedModuleList = 0xfffff800`02e58670
Debug session time: Sun Jan 29 13:26:07.983 2012 (GMT-7)
System Uptime: 0 days 1:55:32.621
Loading Kernel Symbols
...............................................................
................................................................
...................................
Loading User Symbols
Loading unloaded module list
......
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {1000000dd, 2, 1, fffff80002cc0ab5}
Probably caused by : ntkrnlmp.exe ( nt!KeStackAttachProcess+115 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000001000000dd, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80002cc0ab5, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ec2100
00000001000000dd
CURRENT_IRQL: 2
FAULTING_IP:
nt!KeStackAttachProcess+115
fffff800`02cc0ab5 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xA
PROCESS_NAME: System
TRAP_FRAME: fffff88003554870 -- (.trap 0xfffff88003554870)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000008 rbx=0000000000000000 rcx=fffffa8002407bc0
rdx=fffff88003554b58 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002cc0ab5 rsp=fffff88003554a00 rbp=fffff88003554b58
r8=fffffa8002407bb0 r9=0000000000000130 r10=fffff80002e06dc0
r11=fffffa8002407b60 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KeStackAttachProcess+0x115:
fffff800`02cc0ab5 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax ds:7f10:00000000`000000dc=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002c8f1e9 to fffff80002c8fc40
STACK_TEXT:
fffff880`03554728 fffff800`02c8f1e9 : 00000000`0000000a 00000001`000000dd 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`03554730 fffff800`02c8de60 : fffff880`035548b0 fffff8a0`0ef77f10 00000000`0000006b fffffa80`02407b60 : nt!KiBugCheckDispatch+0x69
fffff880`03554870 fffff800`02cc0ab5 : 00000000`00000000 fffffa80`02407b60 fffffa80`02407b60 fffff800`02f62db3 : nt!KiPageFault+0x260
fffff880`03554a00 fffffa80`056889a0 : fffff880`03554b80 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeStackAttachProcess+0x115
fffff880`03554a80 fffff880`03554b80 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xfffffa80`056889a0
fffff880`03554a88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff880`01e429a0 : 0xfffff880`03554b80
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!KeStackAttachProcess+115
fffff800`02cc0ab5 f00fc186dc000000 lock xadd dword ptr [rsi+0DCh],eax
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!KeStackAttachProcess+115
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
FAILURE_BUCKET_ID: X64_0xA_nt!KeStackAttachProcess+115
BUCKET_ID: X64_0xA_nt!KeStackAttachProcess+115
Followup: MachineOwner
---------
-
Loading Dump File [F:\BSODDmpFiles\midna34704\Windows_NT6_BSOD_jcgriff2\012512-26941-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: SRV*C:\SymCache*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) UP Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Built by: 7601.17640.amd64fre.win7sp1_gdr.110622-1506
Machine Name:
Kernel base = 0xfffff800`02c5f000 PsLoadedModuleList = 0xfffff800`02ea4670
Debug session time: Wed Jan 25 14:05:38.038 2012 (GMT-7)
System Uptime: 0 days 6:08:39.661
Loading Kernel Symbols
...............................................................
................................................................
..................................
Loading User Symbols
Loading unloaded module list
.................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1000007E, {ffffffffc0000005, fffffa800956c163, fffff88003554a28, fffff88003554280}
Probably caused by : ntkrnlmp.exe ( nt!KxStartSystemThread+16 )
Followup: MachineOwner
---------
kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffffa800956c163, The address that the exception occurred at
Arg3: fffff88003554a28, Exception Record Address
Arg4: fffff88003554280, Context Record Address
Debugging Details:
------------------
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
FAULTING_IP:
+16
fffffa80`0956c163 0980faffff50 or dword ptr [rax+50FFFFFAh],eax
EXCEPTION_RECORD: fffff88003554a28 -- (.exr 0xfffff88003554a28)
ExceptionAddress: fffffa800956c163
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000001
Parameter[1]: 0000000050fffffc
Attempt to write to address 0000000050fffffc
CONTEXT: fffff88003554280 -- (.cxr 0xfffff88003554280)
rax=0000000000000002 rbx=fffffa800956c160 rcx=0000000000060001
rdx=fffffa80094d1660 rsi=fffffa8002407b60 rdi=0000000000060001
rip=fffffa800956c163 rsp=fffff88003554c60 rbp=fffff80002e7c2b8
r8=fffff80002e7c2d0 r9=fffff88003554ca8 r10=fffffffffffffffe
r11=fffffa8002407e68 r12=fffffa800956c010 r13=0000000000000001
r14=0000000000000000 r15=0000000000000001
iopl=0 nv up ei pl nz na pe nc
cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00010202
fffffa80`0956c163 0980faffff50 or dword ptr [rax+50FFFFFAh],eax ds:002b:00000000`50fffffc=????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000001
EXCEPTION_PARAMETER2: 0000000050fffffc
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002f0e100
0000000050fffffc
FOLLOWUP_IP:
nt!KxStartSystemThread+16
fffff800`02ccd5e6 48c7c10e000000 mov rcx,0Eh
FAILED_INSTRUCTION_ADDRESS:
+5c43952f0299da54
fffffa80`0956c163 0980faffff50 or dword ptr [rax+50FFFFFAh],eax
BUGCHECK_STR: 0x7E
LAST_CONTROL_TRANSFER: from fffffa8002407b60 to fffffa800956c163
STACK_TEXT:
fffff880`03554c60 fffffa80`02407b60 : fffff800`02ce6001 fffff800`00000003 fffff800`00000001 fffff800`02c98f00 : 0xfffffa80`0956c163
fffff880`03554c68 fffff800`02ce6001 : fffff800`00000003 fffff800`00000001 fffff800`02c98f00 fffff800`02e8b6a0 : 0xfffffa80`02407b60
fffff880`03554c70 fffff800`02f76fee : 00000000`00000000 fffffa80`02407b60 00000000`00000080 fffffa80`023f05f0 : nt!ExpWorkerThread+0x111
fffff880`03554d00 fffff800`02ccd5e6 : fffff800`02e51e80 fffffa80`02407b60 fffffa80`02407040 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`03554d40 00000000`00000000 : fffff880`03555000 fffff880`0354f000 fffff880`03554950 00000000`00000000 : nt!KxStartSystemThread+0x16
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!KxStartSystemThread+16
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4e02aaa3
STACK_COMMAND: .cxr 0xfffff88003554280 ; kb
FAILURE_BUCKET_ID: X64_0x7E_BAD_IP_nt!KxStartSystemThread+16
BUCKET_ID: X64_0x7E_BAD_IP_nt!KxStartSystemThread+16
Followup: MachineOwner
---------