iamgdv, в дампе два потока:
Код:
0:000> k
ChildEBP RetAddr
05c9df48 753ac5ef ntdll!ZwCreateFile+0x12
05c9dfec 769e3f86 KERNELBASE!CreateFileW+0x35e
05c9e018 63e32880 kernel32!CreateFileWImplementation+0x69
05c9e274 63e32c83 ntlanman!GetNetworkPhysicalPath+0x41
05c9e6e0 63e32a7a ntlanman!ShareExists+0x14b
05c9e728 63e329a7 ntlanman!NPDfsLmGetResourceInformation+0x14a
05c9e744 75163894 ntlanman!NPGetResourceInformation+0x29
05c9e75c 751634ae mpr!CGetResourceInformation::TestProvider+0x1a
05c9e7b4 751635a6 mpr!CRoutedOperation::GetResult+0xf6
05c9e7f0 75163558 mpr!CMprOperation::Perform+0x65
05c9e7fc 751638c3 mpr!CRoutedOperation::Perform+0x22
05c9e83c 753eb8e2 mpr!WNetGetResourceInformationW+0x26
05c9e880 753eb83d shell32!SHWNetGetResourceInformationAlloc+0x6b
05c9e8a4 753fb0ab shell32!CNetFolder::_GetResourceInformationAlloc+0x15b
05c9ef44 753faea7 shell32!CNetFolder::_ParseUNCName+0x21c
05c9f19c 75467b33 shell32!CNetFolder::ParseDisplayName+0x1c6
05c9f220 5f141794 shell32!CRegFolder::ParseDisplayName+0x93
05c9f2a4 5f142425 NetworkExplorer!CNetworkExplorerFolder::_IsValidServer+0x9f
05c9f2dc 75467b33 NetworkExplorer!CNetworkExplorerFolder::ParseDisplayName+0x88
05c9f360 75469eb3 shell32!CRegFolder::ParseDisplayName+0x93
0:001> k
ChildEBP RetAddr
068bf318 753a6a16 ntdll!NtOpenFile+0x12
068bf7c4 769f086d KERNELBASE!GetDriveTypeW+0x220
068bf828 769f06f8 kernel32!GetVolumePathNameInternalW+0x1ac
068bf840 767e1bbf kernel32!GetVolumePathNameW+0x15
068bfa68 767e1c47 comdlg32!_GetNetFileName+0x2bd
068bfa80 767de27f comdlg32!SHGetSnapshotVolume+0x38
068bfcb4 767de8c3 comdlg32!PathAllocCombine+0x159
068bfcd4 767be56a comdlg32!SHAreSnapshotsAvailable+0x84
068bfcf0 767ae13b comdlg32!HavePreviousVersionsAt+0x8b
068bfd18 767adde4 comdlg32!CGetCommandStateTask::InternalResumeRT+0x46
068bfd38 754863bb comdlg32!CRunnableTask::Run+0xce
068bfd54 75488c43 shell32!CShellTask::TT_Run+0x167
068bfd9c 75488d77 shell32!CShellTaskThread::ThreadProc+0xa3
068bfda4 772ab2b1 shell32!CShellTaskThread::s_ThreadProc+0x1b
068bfdb4 778f94d2 shlwapi!ExecuteWorkItemThreadProc+0xe
068bfe28 778e43e9 ntdll!RtlpTpWorkCallback+0x11d
068bff88 769e33aa ntdll!TppWorkerThread+0x572
068bff94 778c9ef2 kernel32!BaseThreadInitThunk+0xe
068bffd4 778c9ec5 ntdll!__RtlUserThreadStart+0x70
068bffec 00000000 ntdll!_RtlUserThreadStart+0x1b
Если отключить сеть, процесс завершится?
