Hi,
First of all apologies but due to security restrictions with the affected laptops I'm not allowed to run executables against them.
I have however, pulled the full memory dump (memory.dmp) and minidumps.
On or around 6 July many of our corporate Windows 8.1 laptops and surface pro's have started randomly BSOD. We initially thought that this could be a missing patch issue but we have subsequently installed all the latest patches and firmware updates to the affected devices. Some devices do not exhibit the problem and I suspect this is because they have came from a slightly different build version.
I've ran an initial analysis of the memory dump to see if there was anything that I could pick out with regard to faultly software but it looks like the failing module is always in mup.sys. These devices are all failing with the same problem, are all connected via Direct Access and are Domain joined.
If anyone can shed any light as to what the problem might be I would be most grateful.
If I need to get any more info to aid in the debugging then I can, if needed I may be able to get authorisation to run the dm_logging utility.
First of all apologies but due to security restrictions with the affected laptops I'm not allowed to run executables against them.
I have however, pulled the full memory dump (memory.dmp) and minidumps.
On or around 6 July many of our corporate Windows 8.1 laptops and surface pro's have started randomly BSOD. We initially thought that this could be a missing patch issue but we have subsequently installed all the latest patches and firmware updates to the affected devices. Some devices do not exhibit the problem and I suspect this is because they have came from a slightly different build version.
I've ran an initial analysis of the memory dump to see if there was anything that I could pick out with regard to faultly software but it looks like the failing module is always in mup.sys. These devices are all failing with the same problem, are all connected via Direct Access and are Domain joined.
If anyone can shed any light as to what the problem might be I would be most grateful.
If I need to get any more info to aid in the debugging then I can, if needed I may be able to get authorisation to run the dm_logging utility.
Code:
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 27, {baad0073, ffffd00023491518, ffffd00023490d20, fffff800456f3be2}
***** Kernel symbols are WRONG. Please fix symbols to do analysis.
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*** WARNING: Unable to verify timestamp for mup.sys
*** ERROR: Module load completed but symbols could not be loaded for mup.sys
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************
Probably caused by : mup.sys ( mup+130d )
Followup: MachineOwner
---------
2: kd> .reload
Loading Kernel Symbols
...............................................................
................................................................
..............................................
Loading User Symbols
Loading unloaded module list
..................................................
2: kd> !analyze -v
ERROR: FindPlugIns 8007007b
ERROR: Some plugins may not be available [8007007b]
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
RDR_FILE_SYSTEM (27)
If you see RxExceptionFilter on the stack then the 2nd and 3rd parameters are the
exception record and context record. Do a .cxr on the 3rd parameter and then kb to
obtain a more informative stack trace.
The high 16 bits of the first parameter is the RDBSS bugcheck code, which is defined
as follows:
RDBSS_BUG_CHECK_CACHESUP = 0xca550000,
RDBSS_BUG_CHECK_CLEANUP = 0xc1ee0000,
RDBSS_BUG_CHECK_CLOSE = 0xc10e0000,
RDBSS_BUG_CHECK_NTEXCEPT = 0xbaad0000,
Arguments:
Arg1: 00000000baad0073
Arg2: ffffd00023491518
Arg3: ffffd00023490d20
Arg4: fffff800456f3be2
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for sk.sys
*** ERROR: Module load completed but symbols could not be loaded for sk.sys
EXCEPTION_RECORD: ffffd00023491518 -- (.exr 0xffffd00023491518)
ExceptionAddress: fffff800456f3be2 (nt!FsRtlLookupPerFileObjectContext+0x0000000000000056)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 00000000001f82e0
Attempt to read from address 00000000001f82e0
CONTEXT: ffffd00023490d20 -- (.cxr 0xffffd00023490d20)
rax=0000000000000000 rbx=00000000001f82c0 rcx=ffffe0008fa83a70
rdx=ffffe000873c3b30 rsi=ffffe0008f8a6330 rdi=ffffe0008fa83a70
rip=fffff800456f3be2 rsp=ffffd00023491750 rbp=ffffe000873c3b30
r8=0000000000000000 r9=ffffd0006b398180 r10=fffff8009d9b4800
r11=fffff78000000008 r12=ffffe0008de70010 r13=ffffc00049acedd0
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010203
nt!FsRtlLookupPerFileObjectContext+0x56:
fffff800`456f3be2 488b5b20 mov rbx,qword ptr [rbx+20h] ds:002b:00000000`001f82e0=????????????????
Resetting default scope
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 00000000001f82e0
READ_ADDRESS: fffff800458d1c60: Unable to get special pool info
fffff800458d1c60: Unable to get special pool info
unable to get nt!MmNonPagedPoolStart
unable to get nt!MmSizeOfNonPagedPoolInBytes
00000000001f82e0
FOLLOWUP_IP:
mup!MupFindFileContext+1d
fffff800`9ca7930d 4885c0 test rax,rax
FAULTING_IP:
nt!FsRtlLookupPerFileObjectContext+56
fffff800`456f3be2 488b5b20 mov rbx,qword ptr [rbx+20h]
BUGCHECK_STR: 0x27
LAST_CONTROL_TRANSFER: from fffff8009ca7930d to fffff800456f3be2
STACK_TEXT:
ffffd000`23491750 fffff800`9ca7930d : 00000000`00000000 ffffc000`49acec50 ffffe000`8f8a6330 ffffc000`49acec50 : nt!FsRtlLookupPerFileObjectContext+0x56
ffffd000`23491790 fffff800`9ca89a70 : 00000000`00000000 ffffc000`4a9fdb00 ffffd000`234919e0 ffffc000`49acec50 : mup!MupFindFileContext+0x1d
ffffd000`234917d0 fffff800`9d9ee86e : ffffc000`49aced08 ffffd000`234919e0 ffffd000`234919e0 ffffc000`4a9fdb00 : mup!MupSurrogateCloneProvider+0x1c
ffffd000`23491800 fffff800`9d9ed621 : ffffe000`8de70010 00000000`00000000 ffffe000`91896500 ffffe000`8de70010 : rdbss!RxMigrationPerFcbFinishMigrationCallback+0x4ea
ffffd000`234918f0 fffff800`9d9ef1c2 : ffffe000`8894ee90 ffffd000`23491a70 ffffd000`23491a08 ffffd000`23491a08 : rdbss!RxIterateOnFcbs+0xc9
ffffd000`23491970 fffff800`9d9eeb7e : ffffe000`8de70010 ffffe000`8894ee90 ffffe000`8894ee90 ffffe000`00000001 : rdbss!RxPerformSingleLogicalViewMigration+0x5fa
ffffd000`23491ad0 fffff800`9d9e4480 : 00000000`00000000 ffffd000`23491c10 ffffe000`8894ee90 ffffe000`8de70010 : rdbss!RxPerformLogicalViewMigration+0x5e
ffffd000`23491b10 fffff800`9d9c3bec : ffffe000`8856f030 ffffe000`95ae4a01 ffffd000`23491d10 ffffd000`23491e58 : rdbss!RxFindOrConstructLogicalView+0x17740
ffffd000`23491c70 fffff800`9d9ed430 : ffffe000`8de70000 ffffe000`8deab3c0 ffffd000`23491e58 fffff800`9d9b4004 : rdbss!RxFindOrConstructVirtualNetRoot+0xa0c
ffffd000`23491dd0 fffff800`9d9c5d96 : 00000000`00000000 ffffd000`23491e90 00000000`00000000 ffffe000`8de70010 : rdbss!RxFindOrConstructVirtualNetRootWithRetry+0xb0
ffffd000`23491e20 fffff800`9d9c4fe7 : ffffe000`8deab520 ffffe000`8deab3c0 ffffe000`8f8a6330 fffff800`9d9bfe04 : rdbss!RxCanonicalizeNameAndObtainNetRoot+0x2d6
ffffd000`23491eb0 fffff800`9d98fcea : ffffe000`8de70010 00000000`00000000 ffffe000`8deab3c0 00007ff6`ee8e0000 : rdbss!RxCommonCreate+0xf7
ffffd000`23491f60 fffff800`9d9c028d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : rdbss!RxFsdCommonDispatch+0x4fa
ffffd000`234920e0 fffff800`9f1a61b3 : 00000000`00000000 ffffe000`8deab301 ffffe000`8deab3c0 fffff800`9ca7f018 : rdbss!RxFsdDispatch+0xed
ffffd000`23492150 fffff800`9ca814c5 : 00000000`00000000 ffffe000`8deab3c0 ffffe000`95d84010 ffffc000`2f69cc90 : mrxsmb!MRxSmbFsdDispatch+0x83
ffffd000`23492190 fffff800`9ca816a2 : ffffc000`2f69cc90 fffff800`9ca78000 ffffd000`23492300 ffffe000`8dffe870 : mup!MupiCallUncProvider+0x1b5
ffffd000`23492200 fffff800`9ca81c8a : 00000000`00000000 ffffd000`23492300 ffffe000`8dffe870 ffffd000`234922c0 : mup!MupStateMachine+0xd2
ffffd000`23492240 fffff800`9c59fb1e : ffffe000`8fb9c010 ffffe000`95d84010 ffffe000`8dffe870 00000000`00000000 : mup!MupCreate+0x166
ffffd000`234922b0 fffff800`9c5c8349 : ffffd000`23492390 ffffe000`8fb9c010 ffffe000`8deab3c0 ffffe000`873c37c0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2ce
ffffd000`23492350 fffff800`9c97d9da : ffffe000`00000000 ffffe000`8deab3c0 ffffe000`8f8a6300 00000000`00000000 : fltmgr!FltpCreate+0x339
ffffd000`23492400 ffffe000`00000000 : ffffe000`8deab3c0 ffffe000`8f8a6300 00000000`00000000 ffffe000`87353d90 : sk+0x659da
ffffd000`23492408 ffffe000`8deab3c0 : ffffe000`8f8a6300 00000000`00000000 ffffe000`87353d90 fffff800`9c97253a : 0xffffe000`00000000
ffffd000`23492410 ffffe000`8f8a6300 : 00000000`00000000 ffffe000`87353d90 fffff800`9c97253a ffffe000`8deab3c0 : 0xffffe000`8deab3c0
ffffd000`23492418 00000000`00000000 : ffffe000`87353d90 fffff800`9c97253a ffffe000`8deab3c0 00000000`00000000 : 0xffffe000`8f8a6300
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: mup!MupFindFileContext+1d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: mup
IMAGE_NAME: mup.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 54b0e145
STACK_COMMAND: .cxr 0xffffd00023490d20 ; kb
BUCKET_ID_FUNC_OFFSET: 1d
FAILURE_BUCKET_ID: 0x27_mup!MupFindFileContext
BUCKET_ID: 0x27_mup!MupFindFileContext
Followup: MachineOwner
---------
2: kd> !process 0 0
**** NT ACTIVE PROCESS DUMP ****
GetPointerFromAddress: unable to read from fffff8004596e000
Error in reading nt!_EPROCESS at 0000000000000000
2: kd> lm kv m mup.sys
start end module name
2: kd> !process
GetPointerFromAddress: unable to read from fffff8004596e000
Unable to get LeftChild of nt!_MMVAD_SHORT at ffffe0008d1c2830
failed to count VADs
PROCESS ffffe0008b970900
SessionId: none Cid: 0194 Peb: 7ff6eea17000 ParentCid: 02c0
DirBase: 11d2f5000 ObjectTable: ffffc00032a663c0 HandleCount: <Data Not Accessible>
Image: svchost.exe
VadRoot ffffe0008d1c2830 Vads 0 Clone 0 Private 7917. Modified 92121. Locked 4.
DeviceMap ffffc0002f60c220
Token ffffc00032aac060
ReadMemory error: Cannot get nt!KeMaximumIncrement value.
fffff78000000000: Unable to get shared data
ElapsedTime 00:00:00.000
UserTime 00:00:00.000
KernelTime 00:00:00.000
QuotaPoolUsage[PagedPool] 263184
QuotaPoolUsage[NonPagedPool] 47136
Working Set Sizes (now,min,max) (12915, 50, 345) (51660KB, 200KB, 1380KB)
PeakWorkingSetSize 26025
VirtualSize 2101392 Mb
PeakVirtualSize 2101437 Mb
PageFaultCount 3735794
MemoryPriority BACKGROUND
BasePriority 8
CommitCharge 9059
*** Error in reading nt!_ETHREAD @ ffffe0008bb62080
2: kd> kv
Child-SP RetAddr : Args to Child : Call Site
ffffd000`23490488 fffff800`9d9a316d : 00000000`00000027 00000000`baad0073 ffffd000`23491518 ffffd000`23490d20 : nt!KeBugCheckEx
ffffd000`23490490 fffff800`9d99bf9f : fffff800`9d9ac9a4 ffffd000`23491f60 00000000`00000000 00000000`00000000 : rdbss!RxExceptionFilter+0xed
ffffd000`234904e0 fffff800`4574ab26 : 00000000`00000000 ffffd000`234908f0 ffffe000`8ba0d070 ffffd000`234908f0 : rdbss!RxFsdCommonDispatch$filt$0+0x18
ffffd000`23490550 fffff800`9d99bd5e : fffff800`9d9ac9b4 ffffd000`23491518 ffffd000`23491f60 00000000`00000000 : nt!_C_specific_handler+0x86
ffffd000`234905c0 fffff800`45762eed : 00000000`00000000 ffffd000`23490720 ffffd000`23491518 00000000`00000000 : rdbss!_GSHandlerCheck_SEH+0x76
ffffd000`234905f0 fffff800`456c9b25 : 00000000`00000001 fffff800`9d98e000 ffffd000`23491500 fffff800`00000000 : nt!RtlpExecuteHandlerForException+0xd
ffffd000`23490620 fffff800`456cdede : ffffd000`23491518 ffffd000`23491220 ffffd000`23491518 ffffe000`8fa83a70 : nt!RtlDispatchException+0x1a5
ffffd000`23490cf0 fffff800`457675c2 : ffffe000`88634880 ffffd000`23491480 00000000`00000000 fffff800`45675897 : nt!KiDispatchException+0x646
ffffd000`234913e0 fffff800`45765d14 : 00000000`00000000 00000000`001f82c0 ffffe000`8bdd4700 fffff800`9d9b4a00 : nt!KiExceptionDispatch+0xc2
ffffd000`234915c0 fffff800`456f3be2 : ffffe000`00000082 ffffc000`00000082 ffffd000`234919e0 ffffc000`40d6c770 : nt!KiPageFault+0x214 (TrapFrame @ ffffd000`234915c0)
ffffd000`23491750 fffff800`9ca7930d : 00000000`00000000 ffffc000`49acec50 ffffe000`8f8a6330 ffffc000`49acec50 : nt!FsRtlLookupPerFileObjectContext+0x56
ffffd000`23491790 fffff800`9ca89a70 : 00000000`00000000 ffffc000`4a9fdb00 ffffd000`234919e0 ffffc000`49acec50 : mup!MupFindFileContext+0x1d
ffffd000`234917d0 fffff800`9d9ee86e : ffffc000`49aced08 ffffd000`234919e0 ffffd000`234919e0 ffffc000`4a9fdb00 : mup!MupSurrogateCloneProvider+0x1c
ffffd000`23491800 fffff800`9d9ed621 : ffffe000`8de70010 00000000`00000000 ffffe000`91896500 ffffe000`8de70010 : rdbss!RxMigrationPerFcbFinishMigrationCallback+0x4ea
ffffd000`234918f0 fffff800`9d9ef1c2 : ffffe000`8894ee90 ffffd000`23491a70 ffffd000`23491a08 ffffd000`23491a08 : rdbss!RxIterateOnFcbs+0xc9
ffffd000`23491970 fffff800`9d9eeb7e : ffffe000`8de70010 ffffe000`8894ee90 ffffe000`8894ee90 ffffe000`00000001 : rdbss!RxPerformSingleLogicalViewMigration+0x5fa
ffffd000`23491ad0 fffff800`9d9e4480 : 00000000`00000000 ffffd000`23491c10 ffffe000`8894ee90 ffffe000`8de70010 : rdbss!RxPerformLogicalViewMigration+0x5e
ffffd000`23491b10 fffff800`9d9c3bec : ffffe000`8856f030 ffffe000`95ae4a01 ffffd000`23491d10 ffffd000`23491e58 : rdbss!RxFindOrConstructLogicalView+0x17740
ffffd000`23491c70 fffff800`9d9ed430 : ffffe000`8de70000 ffffe000`8deab3c0 ffffd000`23491e58 fffff800`9d9b4004 : rdbss!RxFindOrConstructVirtualNetRoot+0xa0c
ffffd000`23491dd0 fffff800`9d9c5d96 : 00000000`00000000 ffffd000`23491e90 00000000`00000000 ffffe000`8de70010 : rdbss!RxFindOrConstructVirtualNetRootWithRetry+0xb0
ffffd000`23491e20 fffff800`9d9c4fe7 : ffffe000`8deab520 ffffe000`8deab3c0 ffffe000`8f8a6330 fffff800`9d9bfe04 : rdbss!RxCanonicalizeNameAndObtainNetRoot+0x2d6
ffffd000`23491eb0 fffff800`9d98fcea : ffffe000`8de70010 00000000`00000000 ffffe000`8deab3c0 00007ff6`ee8e0000 : rdbss!RxCommonCreate+0xf7
ffffd000`23491f60 fffff800`9d9c028d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : rdbss!RxFsdCommonDispatch+0x4fa
ffffd000`234920e0 fffff800`9f1a61b3 : 00000000`00000000 ffffe000`8deab301 ffffe000`8deab3c0 fffff800`9ca7f018 : rdbss!RxFsdDispatch+0xed
ffffd000`23492150 fffff800`9ca814c5 : 00000000`00000000 ffffe000`8deab3c0 ffffe000`95d84010 ffffc000`2f69cc90 : mrxsmb!MRxSmbFsdDispatch+0x83
ffffd000`23492190 fffff800`9ca816a2 : ffffc000`2f69cc90 fffff800`9ca78000 ffffd000`23492300 ffffe000`8dffe870 : mup!MupiCallUncProvider+0x1b5
ffffd000`23492200 fffff800`9ca81c8a : 00000000`00000000 ffffd000`23492300 ffffe000`8dffe870 ffffd000`234922c0 : mup!MupStateMachine+0xd2
ffffd000`23492240 fffff800`9c59fb1e : ffffe000`8fb9c010 ffffe000`95d84010 ffffe000`8dffe870 00000000`00000000 : mup!MupCreate+0x166
ffffd000`234922b0 fffff800`9c5c8349 : ffffd000`23492390 ffffe000`8fb9c010 ffffe000`8deab3c0 ffffe000`873c37c0 : fltmgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x2ce
ffffd000`23492350 fffff800`9c97d9da : ffffe000`00000000 ffffe000`8deab3c0 ffffe000`8f8a6300 00000000`00000000 : fltmgr!FltpCreate+0x339
ffffd000`23492400 ffffe000`00000000 : ffffe000`8deab3c0 ffffe000`8f8a6300 00000000`00000000 ffffe000`87353d90 : sk+0x659da
ffffd000`23492408 ffffe000`8deab3c0 : ffffe000`8f8a6300 00000000`00000000 ffffe000`87353d90 fffff800`9c97253a : 0xffffe000`00000000
ffffd000`23492410 ffffe000`8f8a6300 : 00000000`00000000 ffffe000`87353d90 fffff800`9c97253a ffffe000`8deab3c0 : 0xffffe000`8deab3c0
ffffd000`23492418 00000000`00000000 : ffffe000`87353d90 fffff800`9c97253a ffffe000`8deab3c0 00000000`00000000 : 0xffffe000`8f8a6300
2: kd> r
rax=fffff800456f3be2 rbx=00000000c0000005 rcx=0000000000000027
rdx=00000000baad0073 rsi=ffffe0008de70010 rdi=ffffd00023490580
rip=fffff8004575b9a0 rsp=ffffd00023490488 rbp=fffff8009d9b4010
r8=ffffd00023491518 r9=ffffd00023490d20 r10=ffffd00023490d20
r11=ffffd000234904d8 r12=ffffd00023491f60 r13=ffffd00023491518
r14=ffffd000234906a0 r15=fffff8009d98e000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00000246
nt!KeBugCheckEx:
fffff800`4575b9a0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffd000`23490490=2700000000000000
2: kd> lmtn
start end module name
fffff800`43d2b000 fffff800`43d34000 kd kd.dll Thu Aug 22 12:40:43 2013 (5215F8BB)
fffff800`4560b000 fffff800`45d9f000 nt ntkrnlmp.exe Sat Jan 10 06:13:11 2015 (54B0C2F7)
fffff800`45d9f000 fffff800`45e0f000 hal hal.dll Sun Jun 01 23:49:12 2014 (538BADE8)
fffff800`9ba00000 fffff800`9ba6a000 usbhub usbhub.sys Thu Jul 24 12:45:29 2014 (53D0F1D9)
fffff800`9ba71000 fffff800`9baee000 mcupdate_GenuineIntel mcupdate_GenuineIntel.dll Fri Jul 04 13:59:36 2014 (53B6A538)
fffff800`9baee000 fffff800`9bafc000 werkernel werkernel.sys Thu Aug 22 12:40:24 2013 (5215F8A8)
fffff800`9bafc000 fffff800`9bb5d000 CLFS CLFS.SYS Wed Mar 19 08:12:20 2014 (53295164)
fffff800`9bb5d000 fffff800`9bb7f000 tm tm.sys Thu Aug 22 12:39:33 2013 (5215F875)
fffff800`9bb7f000 fffff800`9bb94000 PSHED PSHED.dll Sat Sep 14 14:57:19 2013 (52346B3F)
fffff800`9bb94000 fffff800`9bb9e000 BOOTVID BOOTVID.dll Thu Aug 22 12:40:26 2013 (5215F8AA)
fffff800`9bc00000 fffff800`9bc4c000 netbt netbt.sys Thu Aug 22 12:37:01 2013 (5215F7DD)
fffff800`9bc53000 fffff800`9bcdb000 CI CI.dll Sat Feb 22 12:12:12 2014 (5308941C)
fffff800`9bcdb000 fffff800`9bd38000 msrpc msrpc.sys Thu Aug 22 12:39:22 2013 (5215F86A)
fffff800`9bd38000 fffff800`9bd80000 pci pci.sys Thu Jul 24 12:45:24 2014 (53D0F1D4)
fffff800`9bd80000 fffff800`9bddf000 volmgrx volmgrx.sys Thu Aug 22 12:40:23 2013 (5215F8A7)
fffff800`9be00000 fffff800`9be88000 ACPI ACPI.sys Tue Oct 07 04:29:50 2014 (54335E2E)
fffff800`9be88000 fffff800`9be92000 WMILIB WMILIB.SYS Thu Aug 22 12:40:23 2013 (5215F8A7)
fffff800`9be92000 fffff800`9be9c000 msisadrv msisadrv.sys Thu Aug 22 12:39:03 2013 (5215F857)
fffff800`9beb9000 fffff800`9bf88000 Wdf01000 Wdf01000.sys Thu Aug 22 12:38:56 2013 (5215F850)
fffff800`9bf88000 fffff800`9bf99000 WDFLDR WDFLDR.SYS Thu Aug 22 12:39:03 2013 (5215F857)
fffff800`9bf99000 fffff800`9bfb1000 acpiex acpiex.sys Thu Aug 22 12:37:47 2013 (5215F80B)
fffff800`9bfb1000 fffff800`9bfbc000 WppRecorder WppRecorder.sys Thu Aug 22 12:39:40 2013 (5215F87C)
fffff800`9bfbc000 fffff800`9bffe000 MpFilter MpFilter.sys Thu Jul 10 03:43:06 2014 (53BDFDBA)
fffff800`9c000000 fffff800`9c069000 spaceport spaceport.sys Wed Oct 29 02:47:03 2014 (54505527)
fffff800`9c069000 fffff800`9c07e000 volmgr volmgr.sys Thu Aug 22 12:39:53 2013 (5215F889)
fffff800`9c07e000 fffff800`9c099000 mountmgr mountmgr.sys Tue Oct 07 02:18:16 2014 (54333F58)
fffff800`9c0d1000 fffff800`9c15c000 cng cng.sys Wed Oct 29 02:46:55 2014 (5450551F)
fffff800`9c15c000 fffff800`9c188000 tpm tpm.sys Thu Aug 22 12:37:21 2013 (5215F7F1)
fffff800`9c193000 fffff800`9c1a0000 vdrvroot vdrvroot.sys Thu Aug 22 12:38:49 2013 (5215F849)
fffff800`9c1a0000 fffff800`9c1bc000 pdc pdc.sys Wed Oct 15 05:34:24 2014 (543DF950)
fffff800`9c1bc000 fffff800`9c1d4000 partmgr partmgr.sys Wed Oct 08 08:34:42 2014 (5434E912)
fffff800`9c200000 fffff800`9c216000 fileinfo fileinfo.sys Sat Feb 22 12:13:10 2014 (53089456)
fffff800`9c216000 fffff800`9c241000 Wof Wof.sys Thu Mar 13 08:27:29 2014 (53216BF1)
fffff800`9c241000 fffff800`9c260000 HIDCLASS HIDCLASS.SYS Thu Mar 06 09:24:40 2014 (53183ED8)
fffff800`9c26b000 fffff800`9c525000 iaStorA iaStorA.sys Wed Aug 28 23:13:22 2013 (521E7602)
fffff800`9c525000 fffff800`9c583000 storport storport.sys Thu Sep 25 03:47:07 2014 (5423822B)
fffff800`9c583000 fffff800`9c59d000 EhStorClass EhStorClass.sys Thu Aug 22 12:38:15 2013 (5215F827)
fffff800`9c59d000 fffff800`9c5f9000 fltmgr fltmgr.sys Tue Aug 26 03:25:16 2014 (53FBF00C)
fffff800`9c600000 fffff800`9c646000 rdyboost rdyboost.sys Sat Feb 22 12:13:40 2014 (53089474)
fffff800`9c646000 fffff800`9c662000 disk disk.sys Thu Aug 22 12:39:47 2013 (5215F883)
fffff800`9c662000 fffff800`9c6b8000 CLASSPNP CLASSPNP.SYS Wed Oct 08 06:22:07 2014 (5434C9FF)
fffff800`9c6b8000 fffff800`9c6cd000 crashdmp crashdmp.sys Thu Aug 22 12:40:03 2013 (5215F893)
fffff800`9c6e7000 fffff800`9c8e1000 Ntfs Ntfs.sys Sat Oct 11 01:35:55 2014 (54387B6B)
fffff800`9c8e1000 fffff800`9c8fd000 ksecdd ksecdd.sys Wed Oct 29 02:47:36 2014 (54505548)
fffff800`9c8fd000 fffff800`9c90d000 pcw pcw.sys Thu Aug 22 09:46:34 2013 (5215CFEA)
fffff800`9c90d000 fffff800`9c918000 Fs_Rec Fs_Rec.sys Thu Aug 22 09:46:33 2013 (5215CFE9)
fffff800`9c918000 fffff800`9c9cb000 sk sk.sys Fri Sep 20 14:04:23 2013 (523C47D7)
fffff800`9c9cb000 fffff800`9c9e9000 intelppm intelppm.sys Thu Aug 22 09:46:35 2013 (5215CFEB)
fffff800`9ca00000 fffff800`9ca78000 NETIO NETIO.SYS Mon Nov 10 02:58:13 2014 (546029C5)
fffff800`9ca78000 fffff800`9ca98000 mup mup.sys Sat Jan 10 08:22:29 2015 (54B0E145)
fffff800`9caa6000 fffff800`9cbbd000 ndis ndis.sys Sat Oct 11 01:35:46 2014 (54387B62)
fffff800`9cbbd000 fffff800`9cbed000 ksecpkg ksecpkg.sys Wed Oct 29 02:46:30 2014 (54505506)
fffff800`9cc00000 fffff800`9cc95000 fvevol fvevol.sys Mon Apr 07 23:25:31 2014 (534325DB)
fffff800`9cc95000 fffff800`9cf01000 tcpip tcpip.sys Mon Nov 10 02:59:03 2014 (546029F7)
fffff800`9cf01000 fffff800`9cf6d000 fwpkclnt fwpkclnt.sys Mon Nov 10 02:57:40 2014 (546029A4)
fffff800`9cf6d000 fffff800`9cf92000 wfplwfs wfplwfs.sys Mon Nov 10 02:57:28 2014 (54602998)
fffff800`9cf92000 fffff800`9cfe1000 volsnap volsnap.sys Wed Jun 18 23:41:28 2014 (53A21598)
fffff800`9cfe1000 fffff800`9cff0000 intelpep intelpep.sys Wed Oct 15 07:29:44 2014 (543E1458)
fffff800`9d200000 fffff800`9d263000 dxgmms1 dxgmms1.sys Wed Oct 29 02:46:30 2014 (54505506)
fffff800`9d263000 fffff800`9d26f000 mssmbios mssmbios.sys Thu Aug 22 12:39:41 2013 (5215F87D)
fffff800`9d26f000 fffff800`9d296000 dfsc dfsc.sys Sat Jan 10 08:20:53 2015 (54B0E0E5)
fffff800`9d296000 fffff800`9d550000 dump_iaStorA dump_iaStorA.sys Wed Aug 28 23:13:22 2013 (521E7602)
fffff800`9d56d000 fffff800`9d577000 WirelessButtonDriver64 WirelessButtonDriver64.sys Thu Aug 30 04:11:29 2012 (503ED9E1)
fffff800`9d57e000 fffff800`9d595000 ahcache ahcache.sys Thu Aug 22 12:39:54 2013 (5215F88A)
fffff800`9d59b000 fffff800`9d5a4000 Null Null.SYS Thu Aug 22 12:40:24 2013 (5215F8A8)
fffff800`9d5a4000 fffff800`9d5ac000 Beep Beep.SYS Thu Aug 22 12:40:24 2013 (5215F8A8)
fffff800`9d5ac000 fffff800`9d5c1f00 ctxusbm ctxusbm.sys Mon Sep 09 17:02:22 2013 (522DF10E)
fffff800`9d5c2000 fffff800`9d5d0000 BasicRender BasicRender.sys Sat Feb 22 12:14:02 2014 (5308948A)
fffff800`9d5d0000 fffff800`9d5df000 CompositeBus CompositeBus.sys Thu Aug 22 12:38:48 2013 (5215F848)
fffff800`9d5df000 fffff800`9d5ea000 kdnic kdnic.sys Thu Aug 22 12:38:26 2013 (5215F832)
fffff800`9d5ea000 fffff800`9d5fb000 umbus umbus.sys Thu Aug 22 12:38:59 2013 (5215F853)
fffff800`9d600000 fffff800`9d620000 tdx tdx.sys Thu Aug 22 12:36:34 2013 (5215F7C2)
fffff800`9d620000 fffff800`9d62e000 TDI TDI.SYS Thu Aug 22 12:39:01 2013 (5215F855)
fffff800`9d62e000 fffff800`9d635f00 HIDPARSE HIDPARSE.SYS Thu Aug 22 12:40:26 2013 (5215F8AA)
fffff800`9d636000 fffff800`9d7b6000 dxgkrnl dxgkrnl.sys Wed Oct 29 02:46:45 2014 (54505515)
fffff800`9d7b6000 fffff800`9d7c8000 watchdog watchdog.sys Sat Feb 22 12:14:39 2014 (530894AF)
fffff800`9d7c8000 fffff800`9d7da000 BasicDisplay BasicDisplay.sys Thu Aug 22 12:39:31 2013 (5215F873)
fffff800`9d7da000 fffff800`9d7ee000 Npfs Npfs.SYS Thu Aug 22 12:40:25 2013 (5215F8A9)
fffff800`9d7ee000 fffff800`9d7fa000 Msfs Msfs.SYS Thu Aug 22 12:40:24 2013 (5215F8A8)
fffff800`9d800000 fffff800`9d88e000 csc csc.sys Wed Oct 29 02:46:49 2014 (54505519)
fffff800`9d88e000 fffff800`9d89c000 nsiproxy nsiproxy.sys Wed Oct 29 02:46:03 2014 (545054EB)
fffff800`9d89c000 fffff800`9d8a8000 npsvctrig npsvctrig.sys Thu Aug 22 12:38:22 2013 (5215F82E)
fffff800`9d8a9000 fffff800`9d93b000 afd afd.sys Fri May 30 04:03:01 2014 (5387F4E5)
fffff800`9d93b000 fffff800`9d965000 pacer pacer.sys Wed Oct 29 02:45:30 2014 (545054CA)
fffff800`9d965000 fffff800`9d97d000 vwififlt vwififlt.sys Wed Apr 30 07:43:46 2014 (53609BA2)
fffff800`9d97d000 fffff800`9d98e000 netbios netbios.sys Wed Oct 29 02:47:23 2014 (5450553B)
fffff800`9d98e000 fffff800`9d9fc000 rdbss rdbss.sys Sat Jan 10 08:20:59 2015 (54B0E0EB)
fffff800`9da00000 fffff800`9da74000 e1d64x64 e1d64x64.sys Mon Sep 23 00:18:47 2013 (523F7AD7)
fffff800`9da74000 fffff800`9dae1000 RtsPer RtsPer.sys Wed Aug 21 08:23:24 2013 (52146AEC)
fffff800`9dae9000 fffff800`9df03000 igdkmd64 igdkmd64.sys Tue Oct 01 18:06:57 2013 (524B0131)
fffff800`9df03000 fffff800`9df1c000 HDAudBus HDAudBus.sys Thu Jul 24 12:45:39 2014 (53D0F1E3)
fffff800`9df1c000 fffff800`9df71000 USBXHCI USBXHCI.SYS Tue Oct 07 06:00:56 2014 (54337388)
fffff800`9df71000 fffff800`9dfaa000 fastfat fastfat.SYS Thu Aug 22 12:40:18 2013 (5215F8A2)
fffff800`9dfaa000 fffff800`9dfdc000 ucx01000 ucx01000.sys Tue Oct 07 06:00:55 2014 (54337387)
fffff800`9dfdc000 fffff800`9dff8000 TeeDriverx64 TeeDriverx64.sys Thu Sep 05 19:02:18 2013 (5228C72A)
fffff800`9e000000 fffff800`9e00b000 NdisVirtualBus NdisVirtualBus.sys Thu Aug 22 12:36:25 2013 (5215F7B9)
fffff800`9e00b000 fffff800`9e00c600 swenum swenum.sys Wed Oct 29 02:47:41 2014 (5450554D)
fffff800`9e00d000 fffff800`9e05b000 ks ks.sys Fri Jul 04 13:58:59 2014 (53B6A513)
fffff800`9e05b000 fffff800`9e067000 iwdbus iwdbus.sys Thu Sep 26 22:38:04 2013 (5244A93C)
fffff800`9e067000 fffff800`9e072000 rdpbus rdpbus.sys Thu Aug 22 12:38:52 2013 (5215F84C)
fffff800`9e0ad000 fffff800`9e434000 NETwbw02 NETwbw02.sys Thu Sep 19 08:40:12 2013 (523AAA5C)
fffff800`9e434000 fffff800`9e441000 vwifibus vwifibus.sys Thu Aug 22 12:39:00 2013 (5215F854)
fffff800`9e441000 fffff800`9e459000 usbehci usbehci.sys Sat May 31 07:29:54 2014 (538976E2)
fffff800`9e459000 fffff800`9e4c8000 USBPORT USBPORT.SYS Sat May 31 07:30:25 2014 (53897701)
fffff800`9e4c8000 fffff800`9e4e7000 i8042prt i8042prt.sys Tue Nov 04 06:54:54 2014 (5458783E)
fffff800`9e4e7000 fffff800`9e4f1000 ikbevent ikbevent.sys Wed Aug 07 00:41:35 2013 (520189AF)
fffff800`9e4f1000 fffff800`9e57d000 SynTP SynTP.sys Thu Jan 23 21:56:28 2014 (52E1900C)
fffff800`9e57d000 fffff800`9e589000 USBD USBD.SYS Sat May 31 07:31:17 2014 (53897735)
fffff800`9e589000 fffff800`9e59b000 kbdclass kbdclass.sys Tue Nov 04 06:54:54 2014 (5458783E)
fffff800`9e59b000 fffff800`9e5a6000 imsevent imsevent.sys Wed Aug 07 00:45:57 2013 (52018AB5)
fffff800`9e5a6000 fffff800`9e5b6000 mouclass mouclass.sys Tue Nov 04 06:54:47 2014 (54587837)
fffff800`9e5b6000 fffff800`9e5c3000 Smb_driver_Intel Smb_driver_Intel.sys Thu Jan 23 21:59:05 2014 (52E190A9)
fffff800`9e5c3000 fffff800`9e5c9380 CmBatt CmBatt.sys Thu Aug 22 12:39:43 2013 (5215F87F)
fffff800`9e5ca000 fffff800`9e5d6000 BATTC BATTC.SYS Thu Aug 22 12:40:04 2013 (5215F894)
fffff800`9e5d6000 fffff800`9e5e0000 wmiacpi wmiacpi.sys Thu Aug 22 12:40:04 2013 (5215F894)
fffff800`9e5e0000 fffff800`9e5f1000 ISCTD64 ISCTD64.sys Tue Nov 27 19:52:34 2012 (50B51A02)
fffff800`9e5f1000 fffff800`9e5f8000 sk_ndis_wan sk_ndis_wan.sys Fri Sep 20 14:08:15 2013 (523C48BF)
fffff800`9e5f8000 fffff800`9e5ff000 sk_ndis sk_ndis.sys Fri Sep 20 14:08:15 2013 (523C48BF)
fffff800`9e600000 fffff800`9e673000 IntcDAud IntcDAud.sys Thu Aug 29 15:42:53 2013 (521F5DED)
fffff800`9e6cb000 fffff800`9e712000 portcls portcls.sys Wed Oct 29 02:46:35 2014 (5450550B)
fffff800`9e712000 fffff800`9e72e000 drmk drmk.sys Wed Oct 29 02:47:38 2014 (5450554A)
fffff800`9e72e000 fffff800`9e733300 ksthunk ksthunk.sys Thu Aug 22 12:39:31 2013 (5215F873)
fffff800`9e734000 fffff800`9e7c0000 stwrt64 stwrt64.sys Thu Nov 07 06:12:44 2013 (527B2F5C)
fffff800`9e800000 fffff800`9e874000 nwifi nwifi.sys Wed Oct 29 02:45:41 2014 (545054D5)
fffff800`9e87a000 fffff800`9e8f2000 UsbHub3 UsbHub3.sys Wed Oct 08 08:32:50 2014 (5434E8A2)
fffff800`9e8f2000 fffff800`9e919000 usbccgp usbccgp.sys Thu Jul 24 12:44:51 2014 (53D0F1B3)
fffff800`9e919000 fffff800`9e929000 condrv condrv.sys Thu Aug 22 12:40:17 2013 (5215F8A1)
fffff800`9e929000 fffff800`9e961000 mrxsmb20 mrxsmb20.sys Sat Jan 10 08:20:54 2015 (54B0E0E6)
fffff800`9e96f000 fffff800`9e991000 ibtusb ibtusb.sys Mon Oct 14 20:07:42 2013 (525C40FE)
fffff800`9e991000 fffff800`9e9dd000 mrxsmb10 mrxsmb10.sys Sat Jan 10 08:19:36 2015 (54B0E098)
fffff800`9ea00000 fffff800`9ea3d000 WUDFRd WUDFRd.sys Wed Oct 29 02:46:13 2014 (545054F5)
fffff800`9ea3d000 fffff800`9ea49000 dump_diskdump dump_diskdump.sys Thu Aug 22 12:40:18 2013 (5215F8A2)
fffff800`9ea49000 fffff800`9ea5f000 dump_dumpfve dump_dumpfve.sys Sat Feb 22 12:14:48 2014 (530894B8)
fffff800`9ea6d000 fffff800`9ea91000 luafv luafv.sys Sat Feb 22 12:14:25 2014 (530894A1)
fffff800`9ea91000 fffff800`9eab2000 WudfPf WudfPf.sys Wed Oct 29 02:46:27 2014 (54505503)
fffff800`9eab2000 fffff800`9eacb000 WinUsb WinUsb.sys Thu Aug 22 12:37:55 2013 (5215F813)
fffff800`9eacb000 fffff800`9eadf000 lltdio lltdio.sys Thu Aug 22 12:36:18 2013 (5215F7B2)
fffff800`9eadf000 fffff800`9eaf3000 ndisuio ndisuio.sys Thu Aug 22 12:37:34 2013 (5215F7FE)
fffff800`9eaf8000 fffff800`9ec50000 btmhsf btmhsf.sys Thu Sep 05 13:12:49 2013 (52287541)
fffff800`9ec50000 fffff800`9ec69000 BTHUSB BTHUSB.sys Wed Oct 29 02:46:16 2014 (545054F8)
fffff800`9ec69000 fffff800`9ed94000 bthport bthport.sys Wed Oct 29 02:45:37 2014 (545054D1)
fffff800`9ed94000 fffff800`9eddc000 wmbclass wmbclass.sys Fri Nov 01 09:06:50 2013 (52736F2A)
fffff800`9eddc000 fffff800`9edf4000 rspndr rspndr.sys Thu Aug 22 12:36:34 2013 (5215F7C2)
fffff800`9ee42000 fffff800`9efb2380 SPUVCbv_x64 SPUVCbv_x64.sys Mon Nov 04 03:03:56 2013 (52770E9C)
fffff800`9f000000 fffff800`9f01f000 NisDrvWFP NisDrvWFP.sys Thu Jul 10 03:43:47 2014 (53BDFDE3)
fffff800`9f031000 fffff800`9f12b000 HTTP HTTP.sys Mon Jan 27 19:48:02 2014 (52E6B7F2)
fffff800`9f12b000 fffff800`9f14b000 bowser bowser.sys Thu Aug 22 12:38:38 2013 (5215F83E)
fffff800`9f14b000 fffff800`9f162000 mpsdrv mpsdrv.sys Wed Oct 29 02:45:31 2014 (545054CB)
fffff800`9f162000 fffff800`9f1cf000 mrxsmb mrxsmb.sys Sat Jan 10 08:19:58 2015 (54B0E0AE)
fffff800`9f1cf000 fffff800`9f1ec000 Ndu Ndu.sys Wed Oct 29 02:45:16 2014 (545054BC)
fffff800`9f200000 fffff800`9f2ad000 srv2 srv2.sys Wed Oct 08 08:33:30 2014 (5434E8CA)
fffff800`9f2ad000 fffff800`9f2da000 tunnel tunnel.sys Thu Aug 22 12:35:45 2013 (5215F791)
fffff800`9f2f4000 fffff800`9f39d000 peauth peauth.sys Sat Feb 22 12:09:37 2014 (53089381)
fffff800`9f39d000 fffff800`9f3a8000 secdrv secdrv.SYS Wed Sep 13 14:18:38 2006 (4508052E)
fffff800`9f3a8000 fffff800`9f3eb000 srvnet srvnet.sys Fri Jun 27 07:22:21 2014 (53AD0D9D)
fffff800`9f3eb000 fffff800`9f3fd000 tcpipreg tcpipreg.sys Thu Mar 06 09:19:59 2014 (53183DBF)
fffff800`9f600000 fffff800`9f61d900 usbaudio usbaudio.sys Fri Dec 13 07:24:20 2013 (52AAB624)
fffff800`9f61e000 fffff800`9f651f00 usbvideo usbvideo.sys Sat Jun 21 08:33:39 2014 (53A53553)
fffff800`9f652000 fffff800`9f65d000 prepdrv prepdrv.sys Wed Aug 03 13:56:26 2011 (4E39457A)
fffff800`9f66a000 fffff800`9f6f8000 srv srv.sys Thu Jul 24 12:43:27 2014 (53D0F15F)
fffff800`9f6f8000 fffff800`9f720000 mrxdav mrxdav.sys Thu Mar 06 09:22:04 2014 (53183E3C)
fffff800`9f725000 fffff800`9f730000 INETMON INETMON.sys Wed Mar 13 21:11:58 2013 (5140EB9E)
fffff800`9f730000 fffff800`9f746000 mslldp mslldp.sys Wed Oct 29 02:45:39 2014 (545054D3)
fffff800`9f746000 fffff800`9f751000 rdpvideominiport rdpvideominiport.sys Wed Oct 29 02:47:25 2014 (5450553D)
fffff800`9f751000 fffff800`9f785000 rdpdr rdpdr.sys Thu Aug 22 12:36:46 2013 (5215F7CE)
fffff800`9f785000 fffff800`9f794000 vwifimp vwifimp.sys Wed Apr 30 07:41:59 2014 (53609B37)
fffff800`9f794000 fffff800`9f7b7000 tsusbhub tsusbhub.sys Thu Aug 22 12:35:58 2013 (5215F79E)
fffff800`9f7b7000 fffff800`9f7c5000 monitor monitor.sys Thu Aug 22 12:36:37 2013 (5215F7C5)
fffff800`9f7c5000 fffff800`9f7d3000 hidusb hidusb.sys Thu Mar 06 09:24:14 2014 (53183EBE)
fffff800`9f7d3000 fffff800`9f7e1000 kbdhid kbdhid.sys Tue Nov 04 06:54:47 2014 (54587837)
fffff800`9f7e1000 fffff800`9f7ee000 mouhid mouhid.sys Tue Nov 04 06:54:47 2014 (54587837)
fffff960`000da000 fffff960`004f2000 win32k win32k.sys Tue Oct 07 04:29:46 2014 (54335E2A)
fffff960`00722000 fffff960`0072b000 TSDDD TSDDD.dll unavailable (00000000)
fffff960`0090a000 fffff960`00944000 cdd cdd.dll unavailable (00000000)
Unloaded modules:
fffff800`9f2ad000 fffff800`9f2da000 tunnel.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0002D000
fffff800`9f65d000 fffff800`9f669000 hiber_storpo
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000C000
fffff800`9f8e9000 fffff800`9fba3000 hiber_iaStor
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 002BA000
fffff800`9fba3000 fffff800`9fbb9000 hiber_dumpfv
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00016000
fffff800`9f7f0000 fffff800`9f7fb000 prepdrv.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000B000
fffff800`9f2ad000 fffff800`9f2da000 tunnel.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0002D000
fffff800`9f63b000 fffff800`9f668000 tunnel.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0002D000
fffff800`9f62d000 fffff800`9f63b000 monitor.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff800`9e600000 fffff800`9e673000 IntcDAud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00073000
fffff800`9f600000 fffff800`9f62d000 tunnel.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0002D000
fffff800`9f63b000 fffff800`9f649000 hidusb.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff800`9f649000 fffff800`9f657000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff800`9f657000 fffff800`9f664000 mouhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000D000
fffff800`9f7b7000 fffff800`9f7d5000 usbaudio.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0001E000
fffff800`9f2ad000 fffff800`9f2e1000 usbvideo.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00034000
fffff800`9f62d000 fffff800`9f63b000 monitor.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff800`9f600000 fffff800`9f62d000 tunnel.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0002D000
fffff800`9f7d5000 fffff800`9f7e1000 hiber_storpo
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000C000
fffff800`9f840000 fffff800`9fafa000 hiber_iaStor
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 002BA000
fffff800`9fafa000 fffff800`9fb10000 hiber_dumpfv
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00016000
fffff800`9f600000 fffff800`9f62d000 tunnel.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0002D000
fffff800`9f649000 fffff800`9f657000 monitor.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff800`9f7b7000 fffff800`9f7e4000 tunnel.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0002D000
fffff800`9e600000 fffff800`9e673000 IntcDAud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00073000
fffff800`9f61c000 fffff800`9f649000 tunnel.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0002D000
fffff800`9f7b7000 fffff800`9f7c5000 hidusb.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff800`9f7c5000 fffff800`9f7d2000 mouhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000D000
fffff800`9f2ad000 fffff800`9f2e1000 usbvideo.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00034000
fffff800`9f7d2000 fffff800`9f7f0000 usbaudio.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0001E000
fffff800`9f60e000 fffff800`9f61c000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff800`9f600000 fffff800`9f60e000 monitor.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff800`9f63b000 fffff800`9f668000 tunnel.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0002D000
fffff800`9e658000 fffff800`9e6cb000 IntcDAud.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00073000
fffff800`9f60e000 fffff800`9f63b000 tunnel.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0002D000
fffff800`9f7c3000 fffff800`9f7f0000 tunnel.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0002D000
fffff800`9efb3000 fffff800`9efc1000 hidusb.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff800`9efc1000 fffff800`9eff5000 usbvideo.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00034000
fffff800`9ee00000 fffff800`9ee1e000 usbaudio.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0001E000
fffff800`9ee1e000 fffff800`9ee2c000 kbdhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff800`9ee2c000 fffff800`9ee39000 mouhid.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000D000
fffff800`9ea5f000 fffff800`9ea6d000 monitor.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000E000
fffff800`9f6f8000 fffff800`9f725000 tunnel.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0002D000
fffff800`9f7b7000 fffff800`9f7c3000 hiber_storpo
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000C000
fffff800`9f86f000 fffff800`9fb29000 hiber_iaStor
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 002BA000
fffff800`9fb29000 fffff800`9fb3f000 hiber_dumpfv
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00016000
fffff800`9cff0000 fffff800`9cffc000 dump_storpor
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0000C000
fffff800`9d29d000 fffff800`9d557000 dump_iaStorA
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 002BA000
fffff800`9d557000 fffff800`9d56d000 dump_dumpfve
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00016000
fffff800`9eddc000 fffff800`9edf5000 WinUsb.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 00019000
fffff800`9ea00000 fffff800`9ea3d000 WUDFRd.sys
Timestamp: unavailable (00000000)
Checksum: 00000000
ImageSize: 0003D000
2: kd> lmvm mup.sys
start end module name
My Computer
System One
-
- OS
- Windows 8.1