MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041287, An illegal page fault occurred while holding working set synchronization.
Parameter 2 contains the referenced virtual address.
Arg2: 0000000000000038
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 9600.19538.amd64fre.winblue_ltsb_escrow.191014-1700
DUMP_TYPE: 2
BUGCHECK_P1: 41287
BUGCHECK_P2: 38
BUGCHECK_P3: 0
BUGCHECK_P4: 0
BUGCHECK_STR: 0x1a_41287
CPU_COUNT: 3
CPU_MHZ: 889
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 10
CPU_MODEL: 2
CPU_STEPPING: 3
CUSTOMER_CRASH_COUNT: 1
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 12-27-2019 17:39:05.0612
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff801d2ec9741 to fffff801d2fbe4a0
STACK_TEXT:
ffffd000`8dde3568 fffff801`d2ec9741 : 00000000`0000001a 00000000`00041287 00000000`00000038 00000000`00000000 : 0xfffff801`d2fbe4a0
ffffd000`8dde3570 00000000`0000001a : 00000000`00041287 00000000`00000038 00000000`00000000 00000000`00000000 : 0xfffff801`d2ec9741
ffffd000`8dde3578 00000000`00041287 : 00000000`00000038 00000000`00000000 00000000`00000000 00000000`00000000 : <Unloaded_Unknown_Module_00000000`00000000>+0x1a
ffffd000`8dde3580 00000000`00000038 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : <Unloaded_Unknown_Module_00000000`00000000>+0x41287
ffffd000`8dde3588 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : <Unloaded_Unknown_Module_00000000`00000000>+0x38
THREAD_SHA1_HASH_MOD_FUNC: b86dbb757dabe82126ba7138972e406d419db178
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 12e18a3f62eb753019db02557378693940d8e0be
THREAD_SHA1_HASH_MOD: 71fd9ea671e1593e8490c3c756cd8cbe8a3e28b3
SYMBOL_NAME: ANALYSIS_INCONCLUSIVE
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: Unknown_Module
IMAGE_NAME: Unknown_Image
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID: CORRUPT_MODULELIST_0x1a_41287
DEFAULT_BUCKET_ID: CORRUPT_MODULELIST_0x1a_41287
PRIMARY_PROBLEM_CLASS: CORRUPT_MODULELIST_0x1a_41287
FAILURE_BUCKET_ID: CORRUPT_MODULELIST_0x1a_41287
TARGET_TIME: 2019-12-26T17:28:01.000Z
OSBUILD: 9600
OSSERVICEPACK: 0
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 191014-1700
BUILDLAB_STR: winblue_ltsb_escrow
BUILDOSVER_STR: 6.3.9600.19538.amd64fre.winblue_ltsb_escrow.191014-1700
ANALYSIS_SESSION_ELAPSED_TIME: 1e
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:corrupt_modulelist_0x1a_41287
FAILURE_ID_HASH: {fbb1dd26-a286-560b-f852-874d061cdd41}
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffffe00111c9a1d0, Virtual address for the attempted execute.
Arg2: 80000000102b2b63, PTE contents.
Arg3: ffffd00108e467a0, (reserved)
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
GetUlongPtrFromAddress: unable to read from fffff800e75cc308
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 9600.19538.amd64fre.winblue_ltsb_escrow.191014-1700
SYSTEM_MANUFACTURER: Unknow
SYSTEM_PRODUCT_NAME: Unknow
SYSTEM_VERSION: Unknow
BIOS_VENDOR: Phoenix Technologies, LTD
BIOS_VERSION: 6.00 PG
BIOS_DATE: 01/02/2009
BASEBOARD_PRODUCT: RS780-SB700
BASEBOARD_VERSION: Unknow
DUMP_TYPE: 2
BUGCHECK_P1: ffffe00111c9a1d0
BUGCHECK_P2: 80000000102b2b63
BUGCHECK_P3: ffffd00108e467a0
BUGCHECK_P4: 2
CPU_COUNT: 3
CPU_MHZ: 889
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 10
CPU_MODEL: 2
CPU_STEPPING: 3
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0xFC
PROCESS_NAME: dwm.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 12-27-2019 17:39:45.0362
ANALYSIS_VERSION: 10.0.18362.1 x86fre
TRAP_FRAME: ffffd00108e467a0 -- (.trap 0xffffd00108e467a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffffe00113b74a80
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000000
rip=ffffe00111c9a1d0 rsp=ffffd00108e46930 rbp=ffffd00108e46a00
r8=ffffd000fba40180 r9=0000000000000000 r10=ffffe00112758540
r11=ffffe00114368880 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
ffffe001`11c9a1d0 0100 add dword ptr [rax],eax ds:00000000`00000000=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800e735383c to fffff800e73bd4a0
STACK_TEXT:
ffffd001`08e465c8 fffff800`e735383c : 00000000`000000fc ffffe001`11c9a1d0 80000000`102b2b63 ffffd001`08e467a0 : nt!KeBugCheckEx
ffffd001`08e465d0 fffff800`e74622c5 : 00000000`00000008 ffffd001`08e467a0 fffff800`e75c4ec0 ffffe001`143689c0 : nt!MI_CHECK_KERNEL_NOEXECUTE_FAULT+0x64
ffffd001`08e46610 fffff800`e72c7fb9 : 00000000`00000008 ffffe001`11c9a1d0 ffffd001`08e467a0 ffffe001`11c9a1d0 : nt!MiSystemFault+0xa25
ffffd001`08e466a0 fffff800`e73cab9d : ffffd001`08e46b38 00001f80`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0x219
ffffd001`08e467a0 ffffe001`11c9a1d0 : 00000000`00000000 00000000`00000001 ffffd001`08e46960 00000000`00000000 : nt!KiPageFault+0x31d
ffffd001`08e46930 00000000`00000000 : 00000000`00000001 ffffd001`08e46960 00000000`00000000 00000000`00000001 : 0xffffe001`11c9a1d0
THREAD_SHA1_HASH_MOD_FUNC: 43cccc182f2b16152cfaf8789d66ba6ba7d419ba
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: de1dce5366c1d514a3d8e03530e55c883b1afc4a
THREAD_SHA1_HASH_MOD: f08ac56120cad14894587db086f77ce277bfae84
FOLLOWUP_IP:
nt!MI_CHECK_KERNEL_NOEXECUTE_FAULT+64
fffff800`e735383c cc int 3
FAULT_INSTR_CODE: c48348cc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MI_CHECK_KERNEL_NOEXECUTE_FAULT+64
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5da52921
IMAGE_VERSION: 6.3.9600.19538
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 64
FAILURE_BUCKET_ID: 0xFC_nt!MI_CHECK_KERNEL_NOEXECUTE_FAULT
BUCKET_ID: 0xFC_nt!MI_CHECK_KERNEL_NOEXECUTE_FAULT
PRIMARY_PROBLEM_CLASS: 0xFC_nt!MI_CHECK_KERNEL_NOEXECUTE_FAULT
TARGET_TIME: 2019-12-23T15:34:06.000Z
OSBUILD: 9600
OSSERVICEPACK: 19538
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2019-10-15 05:04:17
BUILDDATESTAMP_STR: 191014-1700
BUILDLAB_STR: winblue_ltsb_escrow
BUILDOSVER_STR: 6.3.9600.19538.amd64fre.winblue_ltsb_escrow.191014-1700
ANALYSIS_SESSION_ELAPSED_TIME: 84c
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xfc_nt!mi_check_kernel_noexecute_fault
FAILURE_ID_HASH: {1d0ea106-bc06-493d-fc9b-30e5321b79b0}
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000048, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff802b43636be, address which referenced memory
Debugging Details:
------------------
GetUlongPtrFromAddress: unable to read from fffff802b45ce308
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 9600.19538.amd64fre.winblue_ltsb_escrow.191014-1700
SYSTEM_MANUFACTURER: Unknow
SYSTEM_PRODUCT_NAME: Unknow
SYSTEM_VERSION: Unknow
BIOS_VENDOR: Phoenix Technologies, LTD
BIOS_VERSION: 6.00 PG
BIOS_DATE: 01/02/2009
BASEBOARD_PRODUCT: RS780-SB700
BASEBOARD_VERSION: Unknow
DUMP_TYPE: 2
BUGCHECK_P1: 48
BUGCHECK_P2: 2
BUGCHECK_P3: 1
BUGCHECK_P4: fffff802b43636be
WRITE_ADDRESS: GetUlongPtrFromAddress: unable to read from fffff802b45ce2a8
GetUlongPtrFromAddress: unable to read from fffff802b45ce530
0000000000000048
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiIdentifyPfn+2de
fffff802`b43636be f00fba6d481f lock bts dword ptr [rbp+48h],1Fh
CPU_COUNT: 3
CPU_MHZ: 889
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 10
CPU_MODEL: 2
CPU_STEPPING: 3
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: svchost.exe
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 12-27-2019 17:39:43.0143
ANALYSIS_VERSION: 10.0.18362.1 x86fre
TRAP_FRAME: ffffd0013ae0c4b0 -- (.trap 0xffffd0013ae0c4b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=e0019db851a00420 rbx=0000000000000000 rcx=e0019db851a00420
rdx=fffff802b427f000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff802b43636be rsp=ffffd0013ae0c640 rbp=0000000000000000
r8=000062c000062cf4 r9=022000000004c114 r10=f400921605420000
r11=e0019db851a00420 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!MiIdentifyPfn+0x2de:
fffff802`b43636be f00fba6d481f lock bts dword ptr [rbp+48h],1Fh ss:0018:00000000`00000048=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff802b43cf769 to fffff802b43bf4a0
STACK_TEXT:
ffffd001`3ae0c368 fffff802`b43cf769 : 00000000`0000000a 00000000`00000048 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
ffffd001`3ae0c370 fffff802`b43ccca8 : 00000000`00000200 00000000`00000000 ffffe001`9dfd8800 fffff802`b431c7b1 : nt!KiBugCheckDispatch+0x69
ffffd001`3ae0c4b0 fffff802`b43636be : 0000007f`ffffffff fffffa80`014c7840 00000000`00000001 00000000`00000000 : nt!KiPageFault+0x428
ffffd001`3ae0c640 fffff802`b42e851c : 00000000`00000004 ffffe001`9dfd88c0 00000000`00000000 ffffd001`3ae0c7c0 : nt!MiIdentifyPfn+0x2de
ffffd001`3ae0c6c0 fffff802`b466121b : ffffe001`9dfd83b0 ffffd001`3ae0ccc0 ffffe001`9dfd7000 00000000`00000000 : nt!MiIdentifyPfnWrapper+0x3c
ffffd001`3ae0c6f0 fffff802`b4654246 : ffffc000`4afc1060 00000000`00000001 ffffd001`3ae0c8d4 ffffe001`9dfd7000 : nt!PfpPfnPrioRequest+0xbb
ffffd001`3ae0c770 fffff802`b47153f6 : 00000025`f8d4a800 fffff802`b430ff65 00000000`00000000 00000000`0000004f : nt!PfQuerySuperfetchInformation+0x336
ffffd001`3ae0c8a0 fffff802`b46da711 : 00000025`f8d4a800 00000025`fab327e0 00000026`fa2467f8 00000000`00000001 : nt!ExpQuerySystemInformation+0x14f2
ffffd001`3ae0cc00 fffff802`b43cf3e3 : 00000000`00000001 ffffe001`9bcba800 00000000`00000001 ffffe001`9d487c50 : nt!NtQuerySystemInformation+0x49
ffffd001`3ae0cc40 00007ffa`dcb60aba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000025`f8d4a6f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`dcb60aba
THREAD_SHA1_HASH_MOD_FUNC: adf7db7e95aa6dee42d5c13ecf7b19cbca76e51f
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 58a101c729f9c46f2de078b8498bfbb3db169301
THREAD_SHA1_HASH_MOD: bc100a5647b828107ac4e18055e00abcbe1ec406
FOLLOWUP_IP:
nt!MiIdentifyPfn+2de
fffff802`b43636be f00fba6d481f lock bts dword ptr [rbp+48h],1Fh
FAULT_INSTR_CODE: 6dba0ff0
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiIdentifyPfn+2de
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 5da52921
IMAGE_VERSION: 6.3.9600.19538
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: memory_corruption
BUCKET_ID_FUNC_OFFSET: 2de
FAILURE_BUCKET_ID: AV_nt!MiIdentifyPfn
BUCKET_ID: AV_nt!MiIdentifyPfn
PRIMARY_PROBLEM_CLASS: AV_nt!MiIdentifyPfn
TARGET_TIME: 2019-12-26T18:09:14.000Z
OSBUILD: 9600
OSSERVICEPACK: 19538
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2019-10-15 05:04:17
BUILDDATESTAMP_STR: 191014-1700
BUILDLAB_STR: winblue_ltsb_escrow
BUILDOSVER_STR: 6.3.9600.19538.amd64fre.winblue_ltsb_escrow.191014-1700
ANALYSIS_SESSION_ELAPSED_TIME: 85c
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_nt!miidentifypfn
FAILURE_ID_HASH: {4f0b8d4b-7219-bc8c-33a3-7bfc14bc92e1}
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000048, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff802b43636be, address which referenced memory
Debugging Details:
------------------
GetUlongPtrFromAddress: unable to read from fffff802b45ce308
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 9600.19538.amd64fre.winblue_ltsb_escrow.191014-1700
SYSTEM_MANUFACTURER: Unknow
SYSTEM_PRODUCT_NAME: Unknow
SYSTEM_VERSION: Unknow
BIOS_VENDOR: Phoenix Technologies, LTD
BIOS_VERSION: 6.00 PG
BIOS_DATE: 01/02/2009
BASEBOARD_PRODUCT: RS780-SB700
BASEBOARD_VERSION: Unknow
DUMP_TYPE: 2
BUGCHECK_P1: 48
BUGCHECK_P2: 2
BUGCHECK_P3: 1
BUGCHECK_P4: fffff802b43636be
WRITE_ADDRESS: GetUlongPtrFromAddress: unable to read from fffff802b45ce2a8
GetUlongPtrFromAddress: unable to read from fffff802b45ce530
0000000000000048
CURRENT_IRQL: 2
FAULTING_IP:
nt!MiIdentifyPfn+2de
fffff802`b43636be f00fba6d481f lock bts dword ptr [rbp+48h],1Fh
CPU_COUNT: 3
CPU_MHZ: 889
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 10
CPU_MODEL: 2
CPU_STEPPING: 3
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: svchost.exe
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 12-27-2019 17:39:43.0143
ANALYSIS_VERSION: 10.0.18362.1 x86fre
TRAP_FRAME: ffffd0013ae0c4b0 -- (.trap 0xffffd0013ae0c4b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=e0019db851a00420 rbx=0000000000000000 rcx=e0019db851a00420
rdx=fffff802b427f000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff802b43636be rsp=ffffd0013ae0c640 rbp=0000000000000000
r8=000062c000062cf4 r9=022000000004c114 r10=f400921605420000
r11=e0019db851a00420 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!MiIdentifyPfn+0x2de:
fffff802`b43636be f00fba6d481f lock bts dword ptr [rbp+48h],1Fh ss:0018:00000000`00000048=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff802b43cf769 to fffff802b43bf4a0
STACK_TEXT:
ffffd001`3ae0c368 fffff802`b43cf769 : 00000000`0000000a 00000000`00000048 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
ffffd001`3ae0c370 fffff802`b43ccca8 : 00000000`00000200 00000000`00000000 ffffe001`9dfd8800 fffff802`b431c7b1 : nt!KiBugCheckDispatch+0x69
ffffd001`3ae0c4b0 fffff802`b43636be : 0000007f`ffffffff fffffa80`014c7840 00000000`00000001 00000000`00000000 : nt!KiPageFault+0x428
ffffd001`3ae0c640 fffff802`b42e851c : 00000000`00000004 ffffe001`9dfd88c0 00000000`00000000 ffffd001`3ae0c7c0 : nt!MiIdentifyPfn+0x2de
ffffd001`3ae0c6c0 fffff802`b466121b : ffffe001`9dfd83b0 ffffd001`3ae0ccc0 ffffe001`9dfd7000 00000000`00000000 : nt!MiIdentifyPfnWrapper+0x3c
ffffd001`3ae0c6f0 fffff802`b4654246 : ffffc000`4afc1060 00000000`00000001 ffffd001`3ae0c8d4 ffffe001`9dfd7000 : nt!PfpPfnPrioRequest+0xbb
ffffd001`3ae0c770 fffff802`b47153f6 : 00000025`f8d4a800 fffff802`b430ff65 00000000`00000000 00000000`0000004f : nt!PfQuerySuperfetchInformation+0x336
ffffd001`3ae0c8a0 fffff802`b46da711 : 00000025`f8d4a800 00000025`fab327e0 00000026`fa2467f8 00000000`00000001 : nt!ExpQuerySystemInformation+0x14f2
ffffd001`3ae0cc00 fffff802`b43cf3e3 : 00000000`00000001 ffffe001`9bcba800 00000000`00000001 ffffe001`9d487c50 : nt!NtQuerySystemInformation+0x49
ffffd001`3ae0cc40 00007ffa`dcb60aba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000025`f8d4a6f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`dcb60aba
THREAD_SHA1_HASH_MOD_FUNC: adf7db7e95aa6dee42d5c13ecf7b19cbca76e51f
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 58a101c729f9c46f2de078b8498bfbb3db169301
THREAD_SHA1_HASH_MOD: bc100a5647b828107ac4e18055e00abcbe1ec406
FOLLOWUP_IP:
nt!MiIdentifyPfn+2de
fffff802`b43636be f00fba6d481f lock bts dword ptr [rbp+48h],1Fh
FAULT_INSTR_CODE: 6dba0ff0
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!MiIdentifyPfn+2de
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 5da52921
IMAGE_VERSION: 6.3.9600.19538
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: memory_corruption
BUCKET_ID_FUNC_OFFSET: 2de
FAILURE_BUCKET_ID: AV_nt!MiIdentifyPfn
BUCKET_ID: AV_nt!MiIdentifyPfn
PRIMARY_PROBLEM_CLASS: AV_nt!MiIdentifyPfn
TARGET_TIME: 2019-12-26T18:09:14.000Z
OSBUILD: 9600
OSSERVICEPACK: 19538
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2019-10-15 05:04:17
BUILDDATESTAMP_STR: 191014-1700
BUILDLAB_STR: winblue_ltsb_escrow
BUILDOSVER_STR: 6.3.9600.19538.amd64fre.winblue_ltsb_escrow.191014-1700
ANALYSIS_SESSION_ELAPSED_TIME: 85c
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_nt!miidentifypfn
FAILURE_ID_HASH: {4f0b8d4b-7219-bc8c-33a3-7bfc14bc92e1}
Followup: MachineOwner
---------