New
#1
help with bsod reading mini dump
Hi,
Got a new quad-core build and since first turn on iv been experiancing bsod problems. At first, it was while trying to install Windows 7, in the middle of unpacking files (random points) managed to ge installed but now happens randomly, thought it was when i plugged certain usb ports, but after unplugging everything it still hapens randomly.
The first mini dump was after i named the pc on first startup and it went to 'personalising desktop', the second same, and the last two at random points, any helps would give me the biggest stress relieve of my life!
thanks in advance
1.
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\020811-18236-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*C:\symbols*http://msdl.microsoft.com/download/s...ols;C:\Program Files\Debugging Tools for Windows (x64)
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`0261e000 PsLoadedModuleList = 0xfffff800`0285be50
Debug session time: Tue Feb 8 18:15:21.517 2011 (UTC - 8:00)
System Uptime: 0 days 0:00:58.328
Loading Kernel Symbols
...............................................................
................................................................
........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff880024feaa8, 0, fffff80002982d93, 0}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!ObReferenceObjectByHandleWithTag+133 )
Followup: MachineOwner
---------
3: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff880024feaa8, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002982d93, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800028c60e0
fffff880024feaa8
FAULTING_IP:
nt!ObReferenceObjectByHandleWithTag+133
fffff800`02982d93 8b8c24d8000000 mov ecx,dword ptr [rsp+0D8h]
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800247e840 -- (.trap 0xfffff8800247e840)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000001c rbx=0000000000000000 rcx=fffff80002840300
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002982d93 rsp=fffff8800247e9d0 rbp=fffffa8004311600
r8=fffff8a001e2b000 r9=0000000000000008 r10=0000000000000000
r11=0000000000120089 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!ObReferenceObjectByHandleWithTag+0x133:
fffff800`02982d93 8b8c24d8000000 mov ecx,dword ptr [rsp+0D8h] ss:0018:fffff880`0247eaa8=00000000
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000270ef14 to fffff8000268e740
STACK_TEXT:
fffff880`0247e6d8 fffff800`0270ef14 : 00000000`00000050 fffff880`024feaa8 00000000`00000000 fffff880`0247e840 : nt!KeBugCheckEx
fffff880`0247e6e0 fffff800`0268c82e : 00000000`00000000 fffff8a0`01e314f0 00000000`00000000 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x42837
fffff880`0247e840 fffff800`02982d93 : fffffa80`037ca710 fffffa80`04311630 00000000`00000000 fffffa80`036d7c00 : nt!KiPageFault+0x16e
fffff880`0247e9d0 fffff800`029772da : 00000000`80100000 fffffa80`00000000 00000000`00000000 fffff800`026a8701 : nt!ObReferenceObjectByHandleWithTag+0x133
fffff880`0247eaa0 fffff800`0268d993 : fffffa80`04238b60 00000000`01c5ea38 fffff880`0247ebc8 00000000`00000000 : nt!NtQueryObject+0xfa
fffff880`0247ebb0 00000000`7718fe5a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`01c5ea18 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x7718fe5a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ObReferenceObjectByHandleWithTag+133
fffff800`02982d93 8b8c24d8000000 mov ecx,dword ptr [rsp+0D8h]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!ObReferenceObjectByHandleWithTag+133
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x50_nt!ObReferenceObjectByHandleWithTag+133
BUCKET_ID: X64_0x50_nt!ObReferenceObjectByHandleWithTag+133
Followup: MachineOwner
---------
2.
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\020811-18610-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*C:\symbols*http://msdl.microsoft.com/download/symbols;C:\symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`0261a000 PsLoadedModuleList = 0xfffff800`02857e50
Debug session time: Tue Feb 8 18:17:33.774 2011 (UTC - 8:00)
System Uptime: 0 days 0:01:19.195
Loading Kernel Symbols
...............................................................
................................................................
........
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff8800b79b790, 0, fffff80002982c11, 2}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!ObpIncrementHandleCountEx+51 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8800b79b790, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80002982c11, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff800028c20e0
fffff8800b79b790
FAULTING_IP:
nt!ObpIncrementHandleCountEx+51
fffff800`02982c11 0fb68424e0000000 movzx eax,byte ptr [rsp+0E0h]
MM_INTERNAL_CODE: 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: lsass.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff8800379b520 -- (.trap 0xfffff8800379b520)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000005 rbx=0000000000000000 rcx=0000000000000000
rdx=fffff8800379b7c0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002982c11 rsp=fffff8800379b6b0 rbp=fffffa8003669f30
r8=0000000000000000 r9=fffff8a006acc060 r10=0000000000000001
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!ObpIncrementHandleCountEx+0x51:
fffff800`02982c11 0fb68424e0000000 movzx eax,byte ptr [rsp+0E0h] ss:0018:fffff880`0379b790=01
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800027098f2 to fffff8000268a740
STACK_TEXT:
fffff880`0379b3b8 fffff800`027098f2 : 00000000`00000050 fffff880`0b79b790 00000000`00000000 fffff880`0379b520 : nt!KeBugCheckEx
fffff880`0379b3c0 fffff800`0268882e : 00000000`00000000 fffff880`0379b8e0 fffff8a0`06acad00 fffff8a0`06acac60 : nt! ?? ::FNODOBFM::`string'+0x40ec0
fffff880`0379b520 fffff800`02982c11 : fffffa80`03669f7c fffff8a0`00000010 fffffa80`00000004 fffff8a0`06ac9b70 : nt!KiPageFault+0x16e
fffff880`0379b6b0 fffff800`0298262c : fffff8a0`00000000 fffff880`0379b7c0 fffffa80`04c7b930 fffff8a0`06acc060 : nt!ObpIncrementHandleCountEx+0x51
fffff880`0379b770 fffff800`0297b3d1 : fffff880`00000000 fffff8a0`06acc060 00000000`00000000 00000000`00000000 : nt!ObpCreateHandle+0x19c
fffff880`0379b880 fffff800`0295fcd5 : 00000000`00000000 fffff8a0`06acc970 fffff8a0`0653ea70 fffffa80`04d45060 : nt!ObInsertObjectEx+0x291
fffff880`0379bac0 fffff800`0295fd21 : fffffa80`04d45060 00000000`00000008 00000000`00000001 00000000`00000000 : nt!NtOpenThreadTokenEx+0x445
fffff880`0379bbe0 fffff800`02689993 : fffffa80`04d45060 00000000`00000000 00000000`01545460 00000000`00000784 : nt!NtOpenThreadToken+0x11
fffff880`0379bc20 00000000`774aff9a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0150e618 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x774aff9a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt!ObpIncrementHandleCountEx+51
fffff800`02982c11 0fb68424e0000000 movzx eax,byte ptr [rsp+0E0h]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: nt!ObpIncrementHandleCountEx+51
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x50_nt!ObpIncrementHandleCountEx+51
BUCKET_ID: X64_0x50_nt!ObpIncrementHandleCountEx+51
Followup: MachineOwner
---------
3.
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\020811-32167-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*C:\symbols*http://msdl.microsoft.com/download/symbols;C:\symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`0281b000 PsLoadedModuleList = 0xfffff800`02a58e50
Debug session time: Tue Feb 8 19:22:59.893 2011 (UTC - 8:00)
System Uptime: 0 days 0:23:05.313
Loading Kernel Symbols
...............................................................
................................................................
...............
Loading User Symbols
Loading unloaded module list
.....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck D1, {fffff88002fc50f8, 2, 1, fffff88001642293}
Probably caused by : tcpip.sys ( tcpip!UdpDeliverDatagrams+53 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: fffff88002fc50f8, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, value 0 = read operation, 1 = write operation
Arg4: fffff88001642293, address which referenced memory
Debugging Details:
------------------
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002ac30e0
fffff88002fc50f8
CURRENT_IRQL: 2
FAULTING_IP:
tcpip!UdpDeliverDatagrams+53
fffff880`01642293 4c89bc2448010000 mov qword ptr [rsp+148h],r15
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0xD1
PROCESS_NAME: System
TRAP_FRAME: fffff88002fc4620 -- (.trap 0xfffff88002fc4620)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffa8005d38280 rbx=0000000000000000 rcx=fffffa800457c820
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff88001642293 rsp=fffff88002fc47b0 rbp=fffffa800457c820
r8=fffffa80038a1080 r9=fffffa800396bc58 r10=fffffa8003b76600
r11=fffffa80046bd080 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
tcpip!UdpDeliverDatagrams+0x53:
fffff880`01642293 4c89bc2448010000 mov qword ptr [rsp+148h],r15 ss:0018:fffff880`02fc48f8=fffffa80038d22c8
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8000288aca9 to fffff8000288b740
STACK_TEXT:
fffff880`02fc44d8 fffff800`0288aca9 : 00000000`0000000a fffff880`02fc50f8 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
fffff880`02fc44e0 fffff800`02889920 : 00000000`00000001 fffffa80`03b1ed70 fffff880`02fc46d8 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff880`02fc4620 fffff880`01642293 : fffffa80`038fa080 00000000`00000000 fffffa80`0457c820 00000000`00000000 : nt!KiPageFault+0x260
fffff880`02fc47b0 fffff880`0164276d : fffffa80`00000000 fffffa80`03b1ed70 fffffa80`0457c820 fffffa80`0396bc58 : tcpip!UdpDeliverDatagrams+0x53
fffff880`02fc4940 fffff880`01660727 : fffffa80`0456cc60 fffff800`02897d01 fffffa80`038d0002 fffff880`0141da47 : tcpip!UdpReceiveDatagrams+0x1ed
fffff880`02fc4a30 fffff880`01660799 : fffff880`02fc4bb0 fffff880`0176e9a0 fffff880`02fc4bc0 fffff880`0177d180 : tcpip!IppDeliverListToProtocol+0xf7
fffff880`02fc4af0 fffff880`01660c90 : fffff880`0176e9a0 fffffa80`0396baf0 00000000`00000011 fffff880`02fc4bb0 : tcpip!IppProcessDeliverList+0x59
fffff880`02fc4b60 fffff880`016377c2 : fffffa80`036f4040 fffff880`0150f9b9 00000000`00000000 fffffa80`0450ea90 : tcpip!IppReceiveHeaderBatch+0x231
fffff880`02fc4c40 fffff800`02b87c43 : fffffa80`0450ea90 fffff800`02a305f8 fffffa80`036f4040 fffffa80`0456c8c0 : tcpip!IppLoopbackTransmit+0x72
fffff880`02fc4c80 fffff800`02898961 : fffff800`02a30500 fffff800`02b87c20 fffffa80`036f4040 fffff800`02a305f8 : nt!IopProcessWorkItem+0x23
fffff880`02fc4cb0 fffff800`02b2fc06 : 00000000`00000000 fffffa80`036f4040 00000000`00000080 fffffa80`03664890 : nt!ExpWorkerThread+0x111
fffff880`02fc4d40 fffff800`02869c26 : fffff880`02d63180 fffffa80`036f4040 fffff880`02d6dfc0 00000000`00000000 : nt!PspSystemThreadStartup+0x5a
fffff880`02fc4d80 00000000`00000000 : fffff880`02fc5000 fffff880`02fbf000 fffff880`02fc49f0 00000000`00000000 : nt!KxStartSystemThread+0x16
STACK_COMMAND: kb
FOLLOWUP_IP:
tcpip!UdpDeliverDatagrams+53
fffff880`01642293 4c89bc2448010000 mov qword ptr [rsp+148h],r15
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: tcpip!UdpDeliverDatagrams+53
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: tcpip
IMAGE_NAME: tcpip.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 4c15a458
FAILURE_BUCKET_ID: X64_0xD1_tcpip!UdpDeliverDatagrams+53
BUCKET_ID: X64_0xD1_tcpip!UdpDeliverDatagrams+53
Followup: MachineOwner
---------
4.
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\020811-36426-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*C:\symbols*http://msdl.microsoft.com/download/symbols;C:\symbols
Executable search path is:
Windows 7 Kernel Version 7600 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7600.16617.amd64fre.win7_gdr.100618-1621
Machine Name:
Kernel base = 0xfffff800`02851000 PsLoadedModuleList = 0xfffff800`02a8ee50
Debug session time: Tue Feb 8 18:58:49.969 2011 (UTC - 8:00)
System Uptime: 0 days 0:00:43.389
Loading Kernel Symbols
...............................................................
................................................................
..............
Loading User Symbols
Loading unloaded module list
....
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffff88005d7f930, 1, fffff80002817695, 0}
Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+42837 )
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff88005d7f930, memory referenced.
Arg2: 0000000000000001, value 0 = read operation, 1 = write operation.
Arg3: fffff80002817695, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
WRITE_ADDRESS: GetPointerFromAddress: unable to read from fffff80002af90e0
fffff88005d7f930
FAULTING_IP:
hal!KeQueryPerformanceCounter+bd
fffff800`02817695 4889442430 mov qword ptr [rsp+30h],rax
MM_INTERNAL_CODE: 0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: VISTA_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: services.exe
CURRENT_IRQL: 0
TRAP_FRAME: fffff88005d77770 -- (.trap 0xfffff88005d77770)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000002ce7d1 rbx=0000000000000000 rcx=000000006d8c8f00
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80002817695 rsp=fffff88005d77900 rbp=0000000000008000
r8=fffff88005d77a00 r9=000000000000000f r10=fffffa80057bdc80
r11=0000000000000008 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac po cy
hal!KeQueryPerformanceCounter+0xbd:
fffff800`02817695 4889442430 mov qword ptr [rsp+30h],rax ss:0018:fffff880`05d77930=0000000000000001
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002941f14 to fffff800028c1740
STACK_TEXT:
fffff880`05d77608 fffff800`02941f14 : 00000000`00000050 fffff880`05d7f930 00000000`00000001 fffff880`05d77770 : nt!KeBugCheckEx
fffff880`05d77610 fffff800`028bf82e : 00000000`00000001 fffffa80`057c7000 fffffa80`00000000 fffff880`05d777d0 : nt! ?? ::FNODOBFM::`string'+0x42837
fffff880`05d77770 fffff800`02817695 : fffff880`02fd3180 00000000`00000001 fffffa80`05e52660 fffff880`02fd3180 : nt!KiPageFault+0x16e
fffff880`05d77900 fffff800`028a7b45 : 00000000`00000001 fffffa80`057c7000 fffffa80`036572c0 fffff800`028c8992 : hal!KeQueryPerformanceCounter+0xbd
fffff880`05d77930 fffff800`028842ef : fffff880`00008000 00000000`00000000 fffff8a0`01348c50 fffff880`05d77a68 : nt!EtwpReserveTraceBuffer+0xe1
fffff880`05d779d0 fffff800`028a77a5 : 00000028`00000001 00000000`0000006b 00000000`01f5ebe8 000007fe`feb20015 : nt!EtwpTraceMessageVa+0x33f
fffff880`05d77ae0 fffff800`028c0993 : fffffa80`05e52660 00000000`00000000 00000000`0025fd60 00000000`00000000 : nt!NtTraceEvent+0x12c
fffff880`05d77c20 00000000`76db033a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`01f5eb68 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x76db033a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+42837
fffff800`02941f14 cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+42837
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 4c1c44a9
FAILURE_BUCKET_ID: X64_0x50_nt!_??_::FNODOBFM::_string_+42837
BUCKET_ID: X64_0x50_nt!_??_::FNODOBFM::_string_+42837
Followup: MachineOwner
---------