MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000003453, The subtype of the bugcheck.
Arg2: ffffe000ed65d900
Arg3: 000000000012280a
Arg4: 0000000000000004
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 9600.17415.amd64fre.winblue_r4.141028-1500
SYSTEM_MANUFACTURER: Micro-Star International Co., Ltd.
SYSTEM_PRODUCT_NAME: GX70 3BE
SYSTEM_SKU: To be filled by O.E.M.
SYSTEM_VERSION: E176KAMS.50G
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: E176KAMS.50G
BIOS_DATE: 01/09/2014
BASEBOARD_MANUFACTURER: Micro-Star International Co., Ltd.
BASEBOARD_PRODUCT: MS-176K
BASEBOARD_VERSION: Ver 1.000
DUMP_TYPE: 2
BUGCHECK_P1: 3453
BUGCHECK_P2: ffffe000ed65d900
BUGCHECK_P3: 12280a
BUGCHECK_P4: 4
BUGCHECK_STR: 0x1a_3453
CPU_COUNT: 4
CPU_MHZ: 9bf
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 15
CPU_MODEL: 13
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 02-01-2020 18:43:13.0372
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff80007b86beb to fffff80007b519a0
STACK_TEXT:
ffffd001`72b4f868 fffff800`07b86beb : 00000000`0000001a 00000000`00003453 ffffe000`ed65d900 00000000`0012280a : nt!KeBugCheckEx
ffffd001`72b4f870 fffff800`07dbacb9 : ffffffff`ffffffff 00000000`00000000 ffffd001`72b4f9d0 ffffe000`ed65dbe8 : nt! ?? ::FNODOBFM::`string'+0x24d3b
ffffd001`72b4f910 fffff800`07dba79c : ffffe000`eb7f4880 ffffd001`72b4f9d0 ffffe000`ed65dbe8 ffffe000`ed65d900 : nt!MmDeleteProcessAddressSpace+0x35
ffffd001`72b4f950 fffff800`07dc9dd0 : 00000000`00000000 00000000`00000000 ffffe000`eac76480 ffffe000`ed65d8d0 : nt!PspProcessDelete+0x1a0
ffffd001`72b4fa00 fffff800`07a5ac5f : 00000000`00000000 fffff800`07cc0040 ffffe000`ed65d900 00000000`00000000 : nt!ObpRemoveObjectRoutine+0x64
ffffd001`72b4fa60 fffff800`0801ae5f : ffffe000`ed65d900 ffffe000`eb7f4880 fffff800`07cc0040 ffffe000`eb7f4880 : nt!ObfDereferenceObjectWithTag+0x8f
ffffd001`72b4faa0 fffff800`07a9d38c : fffff800`0801ae20 ffffe000`eb7f49c0 ffffe000`eb7f4880 fffff800`07cb3300 : nt!PspProcessRundownWorkerSingle+0x3f
ffffd001`72b4fad0 fffff800`07b02c70 : 214c2824`44894800 ffffe000`eb7f4880 00000000`00000080 ffffe000`eb7f4880 : nt!ExpWorkerThread+0x28c
ffffd001`72b4fb80 fffff800`07b57fc6 : ffffd001`72640180 ffffe000`eb7f4880 ffffe000`eac60880 8b44ff33`00000320 : nt!PspSystemThreadStartup+0x58
ffffd001`72b4fbe0 00000000`00000000 : ffffd001`72b50000 ffffd001`72b49000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
THREAD_SHA1_HASH_MOD_FUNC: 5afe794a4b3d7876191790e6986a95a31b24d585
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: a4e6d90b421a8e835becf8deea6b3e500448b4e0
THREAD_SHA1_HASH_MOD: bc100a5647b828107ac4e18055e00abcbe1ec406
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+24d3b
fffff800`07b86beb cc int 3
FAULT_INSTR_CODE: 85c6ffcc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+24d3b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 54503718
IMAGE_VERSION: 6.3.9600.17415
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 24d3b
FAILURE_BUCKET_ID: 0x1a_3453_nt!_??_::FNODOBFM::_string_
BUCKET_ID: 0x1a_3453_nt!_??_::FNODOBFM::_string_
PRIMARY_PROBLEM_CLASS: 0x1a_3453_nt!_??_::FNODOBFM::_string_
TARGET_TIME: 2020-01-28T09:19:04.000Z
OSBUILD: 9600
OSSERVICEPACK: 17415
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2014-10-29 03:38:48
BUILDDATESTAMP_STR: 141028-1500
BUILDLAB_STR: winblue_r4
BUILDOSVER_STR: 6.3.9600.17415.amd64fre.winblue_r4.141028-1500
ANALYSIS_SESSION_ELAPSED_TIME: 79d
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x1a_3453_nt!_??_::fnodobfm::_string_
FAILURE_ID_HASH: {8c6944dd-28fb-640a-3fae-95a7a3ec1a0a}
Followup: MachineOwner
---------
REFERENCE_BY_POINTER (18)
Arguments:
Arg1: 0000000000000000, Object type of the object whose reference count is being lowered
Arg2: ffffc00109963060, Object whose reference count is being lowered
Arg3: 0000000000000010, Reserved
Arg4: 0000000000000000, Reserved
The reference count of an object is illegal for the current state of the object.
Each time a driver uses a pointer to an object the driver calls a kernel routine
to increment the reference count of the object. When the driver is done with the
pointer the driver calls another kernel routine to decrement the reference count.
Drivers must match calls to the increment and decrement routines. This bugcheck
can occur because an object's reference count goes to zero while there are still
open handles to the object, in which case the fourth parameter indicates the number
of opened handles. It may also occur when the object's reference count drops below zero
whether or not there are open handles to the object, and in that case the fourth parameter
contains the actual value of the pointer references count.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 9600.17415.amd64fre.winblue_r4.141028-1500
SYSTEM_MANUFACTURER: Micro-Star International Co., Ltd.
SYSTEM_PRODUCT_NAME: GX70 3BE
SYSTEM_SKU: To be filled by O.E.M.
SYSTEM_VERSION: E176KAMS.50G
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: E176KAMS.50G
BIOS_DATE: 01/09/2014
BASEBOARD_MANUFACTURER: Micro-Star International Co., Ltd.
BASEBOARD_PRODUCT: MS-176K
BASEBOARD_VERSION: Ver 1.000
DUMP_TYPE: 2
BUGCHECK_P1: 0
BUGCHECK_P2: ffffc00109963060
BUGCHECK_P3: 10
BUGCHECK_P4: 0
CPU_COUNT: 4
CPU_MHZ: 9bf
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 15
CPU_MODEL: 13
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x18
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 02-01-2020 18:43:16.0542
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff8007c170177 to fffff8007bd6e9a0
STACK_TEXT:
ffffd000`32c90678 fffff800`7c170177 : 00000000`00000018 00000000`00000000 ffffc001`09963060 00000000`00000010 : nt!KeBugCheckEx
ffffd000`32c90680 fffff800`7c019a51 : 00000000`00000001 ffffd000`32c907d0 00000000`00000000 00000000`00000000 : nt! ?? ::NNGAKEGL::`string'+0x23fc7
ffffd000`32c906d0 fffff800`7c01990a : 00000000`746c6600 ffffd000`00000040 ffffe000`e91f3ba0 ffffc000`fcf2b801 : nt!ObDuplicateObject+0xc1
ffffd000`32c90980 fffff800`7bd7a1b3 : ffffe000`ebe43040 00000055`33a2cc98 ffffd000`32c90a28 ffffd000`00000000 : nt!NtDuplicateObject+0x12a
ffffd000`32c90a10 00007ffa`41ce100a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000055`33a2cc78 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`41ce100a
THREAD_SHA1_HASH_MOD_FUNC: c30b0c022e5488d37a362b54b765e225a6eada12
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: be2c4f4d0b2f098e287f568c2913b1fd33e86d3a
THREAD_SHA1_HASH_MOD: f08ac56120cad14894587db086f77ce277bfae84
FOLLOWUP_IP:
nt! ?? ::NNGAKEGL::`string'+23fc7
fffff800`7c170177 cc int 3
FAULT_INSTR_CODE: 4c8b44cc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::NNGAKEGL::`string'+23fc7
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 54503718
IMAGE_VERSION: 6.3.9600.17415
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 23fc7
FAILURE_BUCKET_ID: 0x18_nt!_??_::NNGAKEGL::_string_
BUCKET_ID: 0x18_nt!_??_::NNGAKEGL::_string_
PRIMARY_PROBLEM_CLASS: 0x18_nt!_??_::NNGAKEGL::_string_
TARGET_TIME: 2020-01-28T09:15:06.000Z
OSBUILD: 9600
OSSERVICEPACK: 17415
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2014-10-29 03:38:48
BUILDDATESTAMP_STR: 141028-1500
BUILDLAB_STR: winblue_r4
BUILDOSVER_STR: 6.3.9600.17415.amd64fre.winblue_r4.141028-1500
ANALYSIS_SESSION_ELAPSED_TIME: 79e
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x18_nt!_??_::nngakegl::_string_
FAILURE_ID_HASH: {0bed1247-ca82-b969-ac2a-0d0bda811963}
Followup: MachineOwner
---------
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff803e7769c6a, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 9600.17415.amd64fre.winblue_r4.141028-1500
SYSTEM_MANUFACTURER: Micro-Star International Co., Ltd.
SYSTEM_PRODUCT_NAME: GX70 3BE
SYSTEM_SKU: To be filled by O.E.M.
SYSTEM_VERSION: E176KAMS.50G
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: E176KAMS.50G
BIOS_DATE: 01/09/2014
BASEBOARD_MANUFACTURER: Micro-Star International Co., Ltd.
BASEBOARD_PRODUCT: MS-176K
BASEBOARD_VERSION: Ver 1.000
DUMP_TYPE: 2
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff803e7769c6a
BUGCHECK_P3: 0
BUGCHECK_P4: ffffffffffffffff
READ_ADDRESS: GetUlongPtrFromAddress: unable to read from fffff803e7979298
GetUlongPtrFromAddress: unable to read from fffff803e7979520
ffffffffffffffff
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
nt!SwapContext_PatchXRstor+0
fffff803`e7769c6a 0fae29 xrstor [rcx]
EXCEPTION_PARAMETER2: ffffffffffffffff
BUGCHECK_STR: 0x1E_c0000005_R
CPU_COUNT: 4
CPU_MHZ: 9bf
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 15
CPU_MODEL: 13
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 2
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 02-01-2020 18:43:19.0521
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff803e77b8b69 to fffff803e77669a0
THREAD_SHA1_HASH_MOD_FUNC: 9bf396324f525e0e837471a0d1b4f971b07bdb3c
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 4a099aec6ea6d389990e699f3593dba50a29941a
THREAD_SHA1_HASH_MOD: f08ac56120cad14894587db086f77ce277bfae84
FOLLOWUP_IP:
nt!SwapContext_PatchXRstor+0
fffff803`e7769c6a 0fae29 xrstor [rcx]
FAULT_INSTR_CODE: eb29ae0f
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!SwapContext_PatchXRstor+0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 54503718
IMAGE_VERSION: 6.3.9600.17415
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 0
FAILURE_BUCKET_ID: 0x1E_c0000005_R_nt!SwapContext_PatchXRstor
BUCKET_ID: 0x1E_c0000005_R_nt!SwapContext_PatchXRstor
PRIMARY_PROBLEM_CLASS: 0x1E_c0000005_R_nt!SwapContext_PatchXRstor
TARGET_TIME: 2020-01-28T09:20:44.000Z
OSBUILD: 9600
OSSERVICEPACK: 17415
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2014-10-29 03:38:48
BUILDDATESTAMP_STR: 141028-1500
BUILDLAB_STR: winblue_r4
BUILDOSVER_STR: 6.3.9600.17415.amd64fre.winblue_r4.141028-1500
ANALYSIS_SESSION_ELAPSED_TIME: 12605
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x1e_c0000005_r_nt!swapcontext_patchxrstor
FAILURE_ID_HASH: {3877648d-a897-a15e-f342-f1945b62c157}
Followup: MachineOwner
---------
BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 000000000000000e,
Arg2: ffffc00149b96380
Arg3: ffefdffeff6fffbf
Arg4: 7ecf5f4b43709345
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 9600.17415.amd64fre.winblue_r4.141028-1500
SYSTEM_MANUFACTURER: Micro-Star International Co., Ltd.
SYSTEM_PRODUCT_NAME: GX70 3BE
SYSTEM_SKU: To be filled by O.E.M.
SYSTEM_VERSION: E176KAMS.50G
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: E176KAMS.50G
BIOS_DATE: 01/09/2014
BASEBOARD_MANUFACTURER: Micro-Star International Co., Ltd.
BASEBOARD_PRODUCT: MS-176K
BASEBOARD_VERSION: Ver 1.000
DUMP_TYPE: 2
BUGCHECK_P1: e
BUGCHECK_P2: ffffc00149b96380
BUGCHECK_P3: ffefdffeff6fffbf
BUGCHECK_P4: 7ecf5f4b43709345
BUGCHECK_STR: 0x19_e
CPU_COUNT: 4
CPU_MHZ: 9bf
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 15
CPU_MODEL: 13
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: TiWorker.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 02-01-2020 18:43:32.0721
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff803d4aaf61c to fffff803d495a9a0
STACK_TEXT:
ffffd001`0d721fe8 fffff803`d4aaf61c : 00000000`00000019 00000000`0000000e ffffc001`49b96380 ffefdffe`ff6fffbf : nt!KeBugCheckEx
ffffd001`0d721ff0 fffff803`d4c3f401 : ffffd001`0d722168 00000000`00001880 ffffc001`0f418880 00000000`00000000 : nt!ExDeferredFreePool+0xdac
ffffd001`0d7220c0 fffff803`d4c3ed2f : 00000000`92819301 00000000`0000005c ffffc001`f4f55321 ffffc001`25175380 : nt!CmpGetNameControlBlock+0x191
ffffd001`0d722140 fffff803`d4bfbaab : ffffc001`18719000 00000000`035622f8 ffffc001`1a6452fc ffffc001`0f6caa70 : nt!CmpCreateKeyControlBlock+0x3cf
ffffd001`0d7221d0 fffff803`d4bfd22c : 00000000`00000000 ffffd001`035622f8 ffffd001`0d722950 ffffe000`cf001010 : nt!CmpDoOpen+0x6ab
ffffd001`0d7222b0 fffff803`d4bf5c39 : ffffc001`0f405268 ffffc001`0f405268 ffffc001`0f4051d0 00000000`00000012 : nt!CmpParseKey+0x51c
ffffd001`0d7225e0 fffff803`d4bf3a63 : 00000000`00000000 ffffd001`0d7227d8 ffffe000`00000040 ffffe000`bbe60f20 : nt!ObpLookupObjectName+0x6b9
ffffd001`0d722760 fffff803`d4bf31c4 : 00000000`00000001 000000a5`867cde88 000000a5`867cd980 00000000`01020019 : nt!ObOpenObjectByName+0x1e3
ffffd001`0d722890 fffff803`d4bf160b : ffffc5ab`b35900b0 ffffd001`0d722b00 00007ff9`fdbf89e8 00000000`00000002 : nt!CmOpenKey+0x2a4
ffffd001`0d722a40 fffff803`d49661b3 : 00000000`00000001 000000a5`88b26530 00007ff9`fd984840 00000000`00000000 : nt!NtOpenKeyEx+0xf
ffffd001`0d722a80 00007ffa`0ec01cca : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
000000a5`867cd858 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`0ec01cca
THREAD_SHA1_HASH_MOD_FUNC: 6c0971105e59bfb812cc6a4d42f4e8fa6985a1f5
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 47d20bdbd8b872c35e945c801ae500916b04da6b
THREAD_SHA1_HASH_MOD: b28610981796779b4ac02f58898fde25728a775c
FOLLOWUP_IP:
nt!ExDeferredFreePool+dac
fffff803`d4aaf61c cc int 3
FAULT_INSTR_CODE: 4c8d48cc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ExDeferredFreePool+dac
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 6.3.9600.17415
MODULE_NAME: Pool_Corruption
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: dac
FAILURE_BUCKET_ID: 0x19_e_nt!ExDeferredFreePool
BUCKET_ID: 0x19_e_nt!ExDeferredFreePool
PRIMARY_PROBLEM_CLASS: 0x19_e_nt!ExDeferredFreePool
TARGET_TIME: 2020-01-27T23:08:35.000Z
OSBUILD: 9600
OSSERVICEPACK: 17415
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2014-10-29 03:38:48
BUILDDATESTAMP_STR: 141028-1500
BUILDLAB_STR: winblue_r4
BUILDOSVER_STR: 6.3.9600.17415.amd64fre.winblue_r4.141028-1500
ANALYSIS_SESSION_ELAPSED_TIME: 791
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x19_e_nt!exdeferredfreepool
FAILURE_ID_HASH: {652ef998-c993-02e1-bea8-9dbeb0e887a3}
Followup: Pool_corruption
---------
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: 0000005be1a10001, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: 00007fffd9b5ce5c, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000008, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 9600.17415.amd64fre.winblue_r4.141028-1500
SYSTEM_MANUFACTURER: Micro-Star International Co., Ltd.
SYSTEM_PRODUCT_NAME: GX70 3BE
SYSTEM_SKU: To be filled by O.E.M.
SYSTEM_VERSION: E176KAMS.50G
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: E176KAMS.50G
BIOS_DATE: 01/09/2014
BASEBOARD_MANUFACTURER: Micro-Star International Co., Ltd.
BASEBOARD_PRODUCT: MS-176K
BASEBOARD_VERSION: Ver 1.000
DUMP_TYPE: 2
BUGCHECK_P1: 5be1a10001
BUGCHECK_P2: 0
BUGCHECK_P3: 7fffd9b5ce5c
BUGCHECK_P4: 8
READ_ADDRESS: GetUlongPtrFromAddress: unable to read from fffff80365765298
GetUlongPtrFromAddress: unable to read from fffff80365765520
0000005be1a10001
FAULTING_IP:
+0
00007fff`d9b5ce5c ?? ???
MM_INTERNAL_CODE: 8
CPU_COUNT: 4
CPU_MHZ: 9bf
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 15
CPU_MODEL: 13
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 02-01-2020 18:43:09.0662
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff803655a5ed3 to fffff803655529a0
STACK_TEXT:
ffffd000`30b31868 fffff803`655a5ed3 : 00000000`00000050 0000005b`e1a10001 00000000`00000000 ffffd000`30b31a80 : nt!KeBugCheckEx
ffffd000`30b31870 fffff803`6545a183 : ffffe001`99e59580 ffffd000`30b31940 ffffe001`9a8c3880 fffff680`2df0d080 : nt! ?? ::FNODOBFM::`string'+0x43023
ffffd000`30b318c0 fffff803`6555cc2f : 00000000`00000000 00000000`023163ac 00000000`00000001 0000005b`dae61050 : nt!MmAccessFault+0x633
ffffd000`30b31a80 00007fff`d9b5ce5c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x12f
0000005b`daddf4b0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`d9b5ce5c
THREAD_SHA1_HASH_MOD_FUNC: c657d94433f4f33fd268b372caf2b4bbf9b614e8
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: a50f349d072369079e9be5692fdb90b89d0eca80
THREAD_SHA1_HASH_MOD: d084f7dfa548ce4e51810e4fd5914176ebc66791
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+43023
fffff803`655a5ed3 cc int 3
FAULT_INSTR_CODE: 353b48cc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+43023
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 54503718
IMAGE_VERSION: 6.3.9600.17415
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 43023
FAILURE_BUCKET_ID: AV_nt!_??_::FNODOBFM::_string_
BUCKET_ID: AV_nt!_??_::FNODOBFM::_string_
PRIMARY_PROBLEM_CLASS: AV_nt!_??_::FNODOBFM::_string_
TARGET_TIME: 2020-01-28T09:08:19.000Z
OSBUILD: 9600
OSSERVICEPACK: 17415
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2014-10-29 03:38:48
BUILDDATESTAMP_STR: 141028-1500
BUILDLAB_STR: winblue_r4
BUILDOSVER_STR: 6.3.9600.17415.amd64fre.winblue_r4.141028-1500
ANALYSIS_SESSION_ELAPSED_TIME: 842
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_nt!_??_::fnodobfm::_string_
FAILURE_ID_HASH: {9e2f043e-2671-7df2-fe70-649f4b2357db}
Followup: MachineOwner
---------
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffffffffffff07, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff8010432704f, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 9600.17415.amd64fre.winblue_r4.141028-1500
SYSTEM_MANUFACTURER: Micro-Star International Co., Ltd.
SYSTEM_PRODUCT_NAME: GX70 3BE
SYSTEM_SKU: To be filled by O.E.M.
SYSTEM_VERSION: E176KAMS.50G
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: E176KAMS.50G
BIOS_DATE: 01/09/2014
BASEBOARD_MANUFACTURER: Micro-Star International Co., Ltd.
BASEBOARD_PRODUCT: MS-176K
BASEBOARD_VERSION: Ver 1.000
DUMP_TYPE: 2
BUGCHECK_P1: ffffffffffffff07
BUGCHECK_P2: 0
BUGCHECK_P3: fffff8010432704f
BUGCHECK_P4: 0
READ_ADDRESS: GetUlongPtrFromAddress: unable to read from fffff801043e6298
GetUlongPtrFromAddress: unable to read from fffff801043e6520
ffffffffffffff07
FAULTING_IP:
nt!ExAllocatePoolWithTag+5ff
fffff801`0432704f 4c8b4808 mov r9,qword ptr [rax+8]
MM_INTERNAL_CODE: 0
CPU_COUNT: 4
CPU_MHZ: 9bf
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 15
CPU_MODEL: 13
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 1
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 02-01-2020 18:43:00.0299
ANALYSIS_VERSION: 10.0.18362.1 x86fre
TRAP_FRAME: ffffd000310eef70 -- (.trap 0xffffd000310eef70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffffffffffeff rbx=0000000000000000 rcx=ffffe001b962f880
rdx=0000000000000002 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8010432704f rsp=ffffd000310ef100 rbp=0000000000000001
r8=ffffc001473f3010 r9=7ffffffffffffffc r10=0000000000000001
r11=7ffffffffffffffc r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe cy
nt!ExAllocatePoolWithTag+0x5ff:
fffff801`0432704f 4c8b4808 mov r9,qword ptr [rax+8] ds:ffffffff`ffffff07=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80104201bd2 to fffff801041d39a0
STACK_TEXT:
ffffd000`310eed08 fffff801`04201bd2 : 00000000`00000050 ffffffff`ffffff07 00000000`00000000 ffffd000`310eef70 : nt!KeBugCheckEx
ffffd000`310eed10 fffff801`040db2b9 : 00000000`00000000 ffffe001`b9632900 ffffd000`310eef70 fffff801`043272ee : nt! ?? ::FNODOBFM::`string'+0x1dd22
ffffd000`310eedb0 fffff801`041ddc2f : 00000000`00000000 ffffe001`b7a01660 ffffd000`310ef000 ffffd000`310eefb0 : nt!MmAccessFault+0x769
ffffd000`310eef70 fffff801`0432704f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x12f
ffffd000`310ef100 fffff801`04449f7b : ffffffff`00000001 00000000`00000314 0a1bfb5a`a8acba61 ffffffff`00000001 : nt!ExAllocatePoolWithTag+0x5ff
ffffd000`310ef1d0 fffff801`04449ab8 : ffffc001`473f2060 ffffd000`310ef260 ffffc001`00000010 00000000`00000001 : nt!ObLogSecurityDescriptor+0x23b
ffffd000`310ef230 fffff801`04447080 : 00000000`00000000 ffffd000`310ef310 00000000`00000000 00000000`00000000 : nt!SeDefaultObjectMethod+0x5c
ffffd000`310ef2a0 fffff801`0446a108 : ffffd000`00000100 ffffd000`310ef3f0 ffffe001`ba3b8990 00000000`00000001 : nt!ObpAssignSecurity+0x114
ffffd000`310ef340 fffff801`0451649c : ffffe001`b9eed5c0 ffffe001`b9eed600 ffffc001`44f0d100 ffffc001`465af060 : nt!ObInsertObjectEx+0x2a8
ffffd000`310ef5d0 fffff801`0445309c : ffffe001`b9eed5c0 ffffe001`b9eed66c ffffc001`473ecaf0 00000000`00000440 : nt!SeCopyClientToken+0x9c
ffffd000`310ef660 fffff801`0445af58 : ffffe001`b9eed5c0 00000000`00000000 ffffd000`310ef740 ffffd000`310ef724 : nt!SepCreateClientSecurityEx+0x100
ffffd000`310ef6c0 fffff801`04442906 : 00000000`00000001 ffffe001`b9eed708 ffffe001`b9eed580 00000000`ffff0000 : nt!SeCreateClientSecurity+0xa4
ffffd000`310ef750 fffff801`0444220f : ffffd000`310ef898 ffffd000`310ef890 ffffe001`00000000 00000000`00000000 : nt!AlpcpCreateClientPort+0x4e6
ffffd000`310ef800 fffff801`0443f198 : 00000000`00000000 ffffe001`b9632900 00000000`00000002 00000000`00000000 : nt!AlpcpConnectPort+0x277
ffffd000`310ef990 fffff801`041df1b3 : ffffe001`b962f880 0000005f`9360efd8 ffffd000`310efa28 00000000`00000001 : nt!NtAlpcConnectPortEx+0x70
ffffd000`310efa10 00007ffd`fd6813ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
0000005f`9360f4e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`fd6813ba
THREAD_SHA1_HASH_MOD_FUNC: 6b6cffb9e78e814084dadf36d2ed16200a978e2e
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 3fc63f12470f626a0c45991ae80755488e4fb0f4
THREAD_SHA1_HASH_MOD: 9eef8c7ca0ce66f8b8b34848179f303828cff762
FOLLOWUP_IP:
nt!ExAllocatePoolWithTag+5ff
fffff801`0432704f 4c8b4808 mov r9,qword ptr [rax+8]
FAULT_INSTR_CODE: 8488b4c
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!ExAllocatePoolWithTag+5ff
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 54503718
IMAGE_VERSION: 6.3.9600.17415
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 5ff
FAILURE_BUCKET_ID: AV_nt!ExAllocatePoolWithTag
BUCKET_ID: AV_nt!ExAllocatePoolWithTag
PRIMARY_PROBLEM_CLASS: AV_nt!ExAllocatePoolWithTag
TARGET_TIME: 2020-01-28T09:23:57.000Z
OSBUILD: 9600
OSSERVICEPACK: 17415
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2014-10-29 03:38:48
BUILDDATESTAMP_STR: 141028-1500
BUILDLAB_STR: winblue_r4
BUILDOSVER_STR: 6.3.9600.17415.amd64fre.winblue_r4.141028-1500
ANALYSIS_SESSION_ELAPSED_TIME: 84f
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_nt!exallocatepoolwithtag
FAILURE_ID_HASH: {8c8c5521-08d5-4e98-e93e-114b9bc77ddd}
Followup: MachineOwner
---------
WINLOGON_FATAL_ERROR (c000021a)
The Winlogon process terminated unexpectedly.
Arguments:
Arg1: ffffc00076696340, String that identifies the problem.
Arg2: 0000000000000000, Error Code.
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
ETW minidump data unavailable
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 9600.17415.amd64fre.winblue_r4.141028-1500
SYSTEM_MANUFACTURER: Micro-Star International Co., Ltd.
SYSTEM_PRODUCT_NAME: GX70 3BE
SYSTEM_SKU: To be filled by O.E.M.
SYSTEM_VERSION: E176KAMS.50G
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: E176KAMS.50G
BIOS_DATE: 01/09/2014
BASEBOARD_MANUFACTURER: Micro-Star International Co., Ltd.
BASEBOARD_PRODUCT: MS-176K
BASEBOARD_VERSION: Ver 1.000
ERROR_CODE: (NTSTATUS) 0xc000021a - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc000021a - <Unable to get error code text>
EXCEPTION_CODE_STR: c000021a
EXCEPTION_PARAMETER1: ffffc00076696340
EXCEPTION_PARAMETER2: 0000000000000000
EXCEPTION_PARAMETER3: 0000000000000000
EXCEPTION_PARAMETER4: 0
DUMP_TYPE: 2
BUGCHECK_P1: ffffc00076696340
BUGCHECK_P2: 0
BUGCHECK_P3: 0
BUGCHECK_P4: 0
PROCESS_NAME: services.exe
ADDITIONAL_DEBUG_TEXT: DCOM Sunucusu Ýþlem Baþlatýcýsý hizmeti beklenmedik biçimde sonlandýrýldýðýndan, Windows þimdi yeniden baþlatýlmalýdýr
TAG_NOT_DEFINED_1004c:
This is a STATUS_SYSTEM_PROCESS_TERMINATED bugcheck.
It signals that the system is rebooting due to a critical service termination.
The bugcheck is not very useful for debugging. To investigate the root cause
find the related svchost.exe crashes that happened on the same machine
around the time of this dump.
BUGCHECK_STR: 0xc000021a_rpcss.dll_Critical_Service_Terminated
IMAGE_NAME: ntkrnlmp.exe
MODULE_NAME: nt
CPU_COUNT: 4
CPU_MHZ: 9bf
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 15
CPU_MODEL: 13
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 02-01-2020 18:42:56.0700
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff800801a39a1 to fffff8007ff689a0
STACK_TEXT:
ffffd000`76612638 fffff800`801a39a1 : 00000000`0000004c 00000000`c000021a ffffd000`311df378 ffffe001`2a709360 : nt!KeBugCheckEx
ffffd000`76612640 fffff800`8019d4fa : ffffe001`2685a400 ffffd000`76612759 00000000`00000000 00000000`00000002 : nt!PopGracefulShutdown+0x2c9
ffffd000`76612680 fffff800`7ff741b3 : ffffe001`2685a040 00000000`00000000 00000000`c0000004 ffffd000`76612900 : nt! ?? ::OKHAJAOM::`string'+0x269a
ffffd000`766127c0 fffff800`7ff6c600 : fffff800`803ba86d 00000000`00000001 ffffd000`766129d8 00000000`c0000004 : nt!KiSystemServiceCopyEnd+0x13
ffffd000`76612958 fffff800`803ba86d : 00000000`00000001 ffffd000`766129d8 00000000`c0000004 ffffd000`7a5bb180 : nt!KiServiceLinkage
ffffd000`76612960 fffff800`802ed9e3 : 00000000`00000000 00000000`00000000 ffffd000`7a5bb180 ffffe001`2685a180 : nt! ?? ::NNGAKEGL::`string'+0x746bd
ffffd000`76612a20 fffff800`7ff14a5e : fffff800`7ff149a4 00000000`00000000 00000000`00000002 fffff800`800ca300 : nt!PopPolicyWorkerAction+0x63
ffffd000`76612a90 fffff800`7feb438c : fffff800`00000002 fffff800`800d7d40 ffffe001`2685a040 fffff800`800ca300 : nt!PopPolicyWorkerThread+0xba
ffffd000`76612ad0 fffff800`7ff19c70 : 440f4800`1140230d ffffe001`2685a040 00000000`00000080 ffffe001`2685a040 : nt!ExpWorkerThread+0x28c
ffffd000`76612b80 fffff800`7ff6efc6 : fffff800`8011b180 ffffe001`2685a040 ffffe001`26860880 24448d48`884d8948 : nt!PspSystemThreadStartup+0x58
ffffd000`76612be0 00000000`00000000 : ffffd000`76613000 ffffd000`7660c000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
THREAD_SHA1_HASH_MOD_FUNC: ca83477c6c105b050cb3ec79e1112ae3fe845ead
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 46fe666991a5db9d5866c1db91110caec568cdad
THREAD_SHA1_HASH_MOD: b28610981796779b4ac02f58898fde25728a775c
FOLLOWUP_IP:
nt! ?? ::OKHAJAOM::`string'+269a
fffff800`8019d4fa cc int 3
FAULT_INSTR_CODE: e46ce8cc
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt! ?? ::OKHAJAOM::`string'+269a
FOLLOWUP_NAME: MachineOwner
DEBUG_FLR_IMAGE_TIMESTAMP: 54503718
IMAGE_VERSION: 6.3.9600.17415
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 269a
FAILURE_BUCKET_ID: 0xc000021a_rpcss.dll_Critical_Service_Terminated_nt!_??_::OKHAJAOM::_string_
BUCKET_ID: 0xc000021a_rpcss.dll_Critical_Service_Terminated_nt!_??_::OKHAJAOM::_string_
PRIMARY_PROBLEM_CLASS: 0xc000021a_rpcss.dll_Critical_Service_Terminated_nt!_??_::OKHAJAOM::_string_
TARGET_TIME: 2020-01-28T09:18:13.000Z
OSBUILD: 9600
OSSERVICEPACK: 17415
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2014-10-29 03:38:48
BUILDDATESTAMP_STR: 141028-1500
BUILDLAB_STR: winblue_r4
BUILDOSVER_STR: 6.3.9600.17415.amd64fre.winblue_r4.141028-1500
ANALYSIS_SESSION_ELAPSED_TIME: bc9
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xc000021a_rpcss.dll_critical_service_terminated_nt!_??_::okhajaom::_string_
FAILURE_ID_HASH: {985ba5ee-c7fd-3ab7-c026-2d066fd15a29}
Followup: MachineOwner
---------
This is a STATUS_SYSTEM_PROCESS_TERMINATED bugcheck.
It signals that the system is rebooting due to a critical service termination.
The bugcheck is not very useful for debugging. To investigate the root cause
find the related svchost.exe crashes that happened on the same machine
around the time of this dump.
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff800c579fd8a, The address that the exception occurred at
Arg3: ffffd0013512f548, Exception Record Address
Arg4: ffffd0013512ed50, Context Record Address
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : AV.Fault
Value: Read
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 9600.17415.amd64fre.winblue_r4.141028-1500
SYSTEM_MANUFACTURER: Micro-Star International Co., Ltd.
SYSTEM_PRODUCT_NAME: GX70 3BE
SYSTEM_SKU: To be filled by O.E.M.
SYSTEM_VERSION: E176KAMS.50G
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: E176KAMS.50G
BIOS_DATE: 01/09/2014
BASEBOARD_MANUFACTURER: Micro-Star International Co., Ltd.
BASEBOARD_PRODUCT: MS-176K
BASEBOARD_VERSION: Ver 1.000
DUMP_TYPE: 2
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff800c579fd8a
BUGCHECK_P3: ffffd0013512f548
BUGCHECK_P4: ffffd0013512ed50
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
nt!MiDemoteCombinedPte+42
fffff800`c579fd8a 49394520 cmp qword ptr [r13+20h],rax
EXCEPTION_RECORD: ffffd0013512f548 -- (.exr 0xffffd0013512f548)
ExceptionAddress: fffff800c579fd8a (nt!MiDemoteCombinedPte+0x0000000000000042)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff
CONTEXT: ffffd0013512ed50 -- (.cxr 0xffffd0013512ed50)
rax=0000000000000001 rbx=0000000000000000 rcx=fffff6fffffffff8
rdx=8000000000000000 rsi=fffff6fffffffff8 rdi=fffff7810003f000
rip=fffff800c579fd8a rsp=ffffd0013512f780 rbp=fffff800c59d4dc0
r8=8000000000000000 r9=0000000000000013 r10=0000000000000014
r11=0000000000000013 r12=fffff6fffffffff8 r13=7fffffffffffffd0
r14=ffffd0013512f8b0 r15=fffff78100000000
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010282
nt!MiDemoteCombinedPte+0x42:
fffff800`c579fd8a 49394520 cmp qword ptr [r13+20h],rax ds:002b:7fffffff`fffffff0=????????????????
Resetting default scope
CPU_COUNT: 4
CPU_MHZ: 9bf
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 15
CPU_MODEL: 13
CPU_STEPPING: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
FOLLOWUP_IP:
nt!MiDemoteCombinedPte+42
fffff800`c579fd8a 49394520 cmp qword ptr [r13+20h],rax
BUGCHECK_STR: AV
READ_ADDRESS: GetUlongPtrFromAddress: unable to read from fffff800c59dc298
GetUlongPtrFromAddress: unable to read from fffff800c59dc520
ffffffffffffffff
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: ffffffffffffffff
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 02-01-2020 18:42:33.0828
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff800c582e5dd to fffff800c579fd8a
STACK_TEXT:
ffffd001`3512f780 fffff800`c582e5dd : 00000000`00000001 fffff800`c59d4dc0 00000000`00000000 fffff781`00003b98 : nt!MiDemoteCombinedPte+0x42
ffffd001`3512f870 fffff800`c571d4c8 : fffff800`c59d4dc0 fffff800`c59d4dc0 00000000`00000000 00000000`00000001 : nt! ?? ::FNODOBFM::`string'+0x5472d
ffffd001`3512f9b0 fffff800`c571c4a8 : 00000000`00000000 ffffd001`3512fa79 fffff800`c59d4dc0 00000000`00000000 : nt!MiTrimOrAgeWorkingSet+0x200
ffffd001`3512f9f0 fffff800`c56feb4e : 00000000`00000000 ffffe000`ab463880 00000000`00000001 ffffe000`ab463880 : nt!MiProcessWorkingSets+0x1c8
ffffd001`3512fae0 fffff800`c57b0103 : 00000000`00000008 ffffd001`3512fb50 00000000`00000008 00000000`00000000 : nt!MmWorkingSetManager+0x4a
ffffd001`3512fb10 fffff800`c577ac70 : ffffe000`ab463880 00000000`00000000 00000000`00000080 00000000`00000000 : nt!KeBalanceSetManager+0x1b3
ffffd001`3512fb80 fffff800`c57cffc6 : ffffd001`391bb180 ffffe000`ab463880 ffffd001`391c72c0 00000000`00000000 : nt!PspSystemThreadStartup+0x58
ffffd001`3512fbe0 00000000`00000000 : ffffd001`35130000 ffffd001`35129000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
THREAD_SHA1_HASH_MOD_FUNC: 347fbe2f34e1725fc5b23f7650fe3d9058f1f815
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: fb5a48110227eddeff0efb575d5580b899bcdf87
THREAD_SHA1_HASH_MOD: cb5f414824c2521bcc505eaa03e92fa10922dad8
FAULT_INSTR_CODE: 20453949
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MiDemoteCombinedPte+42
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 54503718
IMAGE_VERSION: 6.3.9600.17415
STACK_COMMAND: .cxr 0xffffd0013512ed50 ; kb
IMAGE_NAME: memory_corruption
BUCKET_ID_FUNC_OFFSET: 42
FAILURE_BUCKET_ID: AV_nt!MiDemoteCombinedPte
BUCKET_ID: AV_nt!MiDemoteCombinedPte
PRIMARY_PROBLEM_CLASS: AV_nt!MiDemoteCombinedPte
TARGET_TIME: 2020-01-28T09:10:11.000Z
OSBUILD: 9600
OSSERVICEPACK: 17415
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2014-10-29 03:38:48
BUILDDATESTAMP_STR: 141028-1500
BUILDLAB_STR: winblue_r4
BUILDOSVER_STR: 6.3.9600.17415.amd64fre.winblue_r4.141028-1500
ANALYSIS_SESSION_ELAPSED_TIME: 776
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_nt!midemotecombinedpte
FAILURE_ID_HASH: {c577c73b-79a7-0c44-6c62-58e1d697b6d8}
Followup: MachineOwner
---------
