S
SinghMayank
Guest
[COLOR=rgba(30, 30, 30, 1)]Microsoft (R) Windows Debugger Version 10.0.21306.1007 AMD64[/COLOR]
[COLOR=rgba(30, 30, 30, 1)]Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 18362 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Kernel base = 0xfffff807`50600000 PsLoadedModuleList = 0xfffff807`50a432f0
Debug session time: Wed Apr 14 08:09:34.315 2021 (UTC + 5:30)
System Uptime: 0 days 0:04:11.971
Loading Kernel Symbols
...............................................................
................................................................
...........Page 122fc7 not present in the dump file. Type ".hh dbgerr004" for details
.Page 11635d not present in the dump file. Type ".hh dbgerr004" for details
..............................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000000b1`2032b018). Type ".hh dbgerr001" for details
Loading unloaded module list
.......
For analysis of this file, run [/COLOR][COLOR=rgba(0, 0, 255, 1)]!analyze -v
[/COLOR][COLOR=rgba(30, 30, 30, 1)]nt!KeBugCheckEx:
fffff807`507bc900 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffffa85`b1f87450=000000000000001a
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041201, The subtype of the bugcheck.
Arg2: ffff9f3ffd62d000
Arg3: 0400020097ba7005
Arg4: ffffb605cbf9c2b0
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2780
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 11043
Key : Analysis.Init.CPU.mSec
Value: 1124
Key : Analysis.Init.Elapsed.mSec
Value: 36696
Key : Analysis.Memory.CommitPeak.Mb
Value: 71
Key : WER.OS.Branch
Value: 19h1_release
Key : WER.OS.Timestamp
Value: 2019-03-18T12:02:00Z
Key : WER.OS.Version
Value: 10.0.18362.1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41201
BUGCHECK_P2: ffff9f3ffd62d000
BUGCHECK_P3: 400020097ba7005
BUGCHECK_P4: ffffb605cbf9c2b0
BLACKBOXBSD: 1 ([/COLOR][COLOR=rgba(0, 0, 255, 1)]!blackboxbsd[/COLOR][COLOR=rgba(30, 30, 30, 1)])
BLACKBOXNTFS: 1 ([/COLOR][COLOR=rgba(0, 0, 255, 1)]!blackboxntfs[/COLOR][COLOR=rgba(30, 30, 30, 1)])
BLACKBOXWINLOGON: 1
PROCESS_NAME: msedge.exe
STACK_TEXT:
fffffa85`b1f87448 fffff807`5080d30a : 00000000`0000001a 00000000`00041201 ffff9f3f`fd62d000 04000200`97ba7005 : nt!KeBugCheckEx
fffffa85`b1f87450 fffff807`50676b41 : ffff9f3f`fd62d008 04000200`97ba7005 00000000`00000002 ffff9f4f`9ffeb168 : nt!MiGetPageProtection+0x19728a
fffffa85`b1f874c0 fffff807`50706414 : ffffb605`cc1ba5c0 00007ffa`be2de000 00000000`00040282 fffff807`50634ba4 : nt!MiQueryAddressState+0x5c1
fffffa85`b1f876e0 fffff807`50c56ba7 : fffffa85`00000000 00007ffa`00000003 fffffa85`00000003 000000ce`00000001 : nt!MiQueryAddressSpan+0x1d4
fffffa85`b1f877a0 fffff807`50c56645 : ffff9f4f`8bd70000 ffff9f4f`a7c5eb80 ffff9f4f`a7d3e2f0 000000ce`c19ff308 : nt!MmQueryVirtualMemory+0x557
fffffa85`b1f87940 fffff807`507ce115 : 00000000`00000000 00000000`00000001 00007ffa`be0fc000 fffffa85`b1f87a80 : nt!NtQueryVirtualMemory+0x25
fffffa85`b1f87990 00007ffa`ec41c4c4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000ce`c19fe788 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`ec41c4c4
SYMBOL_NAME: nt!MiGetPageProtection+19728a
MODULE_NAME: [/COLOR][COLOR=rgba(0, 0, 255, 1)]nt
[/COLOR][COLOR=rgba(30, 30, 30, 1)]STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 19728a
FAILURE_BUCKET_ID: 0x1a_41201_nt!MiGetPageProtection
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {c1fe3b27-3ba8-d99e-656f-85f3d58dc669}
Followup: MachineOwner
---------
2: kd> !blackboxbsd
Stream size mismatch (expected = 192, read = 168)
2: kd> !blackboxntfs
NTFS Blackbox Data
0 Slow I/O Timeout Records Found
0 Oplock Break Timeout Records Found[/COLOR]
[COLOR=rgba(30, 30, 30, 1)]these are the Memory.dmp file Bugcheck error[/COLOR]
[COLOR=rgba(30, 30, 30, 1)]Below is the 2nd error[/COLOR]
[COLOR=rgba(30, 30, 30, 1)]A timeout was reached (45000 milliseconds) while waiting for the asComSvc service to connect.[/COLOR]
Below is the warning:
1. Distributed COM
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
to the user DESKTOP-JKHH23P\Mayank SID (S-1-5-21-3452906758-3148296582-676549801-1001) from address
LocalHost (Using LRPC) running in the application container
Microsoft.Windows.ShellExperienceHost_10.0.18362.145_neutral_neutral_cw5n1h2txyewy
SID (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708).
This security permission can be modified using the Component Services administrative tool.
2. Serviciting (under setup - event viewer)
[COLOR=rgba(30, 30, 30, 1)]0 of 67 instances of system store corruption have been repaired. Unrepaired corruptions may lead to failures in future system servicing.[/COLOR]
Continue reading...
[COLOR=rgba(30, 30, 30, 1)]Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 18362 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 18362.1.amd64fre.19h1_release.190318-1202
Machine Name:
Kernel base = 0xfffff807`50600000 PsLoadedModuleList = 0xfffff807`50a432f0
Debug session time: Wed Apr 14 08:09:34.315 2021 (UTC + 5:30)
System Uptime: 0 days 0:04:11.971
Loading Kernel Symbols
...............................................................
................................................................
...........Page 122fc7 not present in the dump file. Type ".hh dbgerr004" for details
.Page 11635d not present in the dump file. Type ".hh dbgerr004" for details
..............................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 000000b1`2032b018). Type ".hh dbgerr001" for details
Loading unloaded module list
.......
For analysis of this file, run [/COLOR][COLOR=rgba(0, 0, 255, 1)]!analyze -v
[/COLOR][COLOR=rgba(30, 30, 30, 1)]nt!KeBugCheckEx:
fffff807`507bc900 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffffa85`b1f87450=000000000000001a
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041201, The subtype of the bugcheck.
Arg2: ffff9f3ffd62d000
Arg3: 0400020097ba7005
Arg4: ffffb605cbf9c2b0
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2780
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 11043
Key : Analysis.Init.CPU.mSec
Value: 1124
Key : Analysis.Init.Elapsed.mSec
Value: 36696
Key : Analysis.Memory.CommitPeak.Mb
Value: 71
Key : WER.OS.Branch
Value: 19h1_release
Key : WER.OS.Timestamp
Value: 2019-03-18T12:02:00Z
Key : WER.OS.Version
Value: 10.0.18362.1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41201
BUGCHECK_P2: ffff9f3ffd62d000
BUGCHECK_P3: 400020097ba7005
BUGCHECK_P4: ffffb605cbf9c2b0
BLACKBOXBSD: 1 ([/COLOR][COLOR=rgba(0, 0, 255, 1)]!blackboxbsd[/COLOR][COLOR=rgba(30, 30, 30, 1)])
BLACKBOXNTFS: 1 ([/COLOR][COLOR=rgba(0, 0, 255, 1)]!blackboxntfs[/COLOR][COLOR=rgba(30, 30, 30, 1)])
BLACKBOXWINLOGON: 1
PROCESS_NAME: msedge.exe
STACK_TEXT:
fffffa85`b1f87448 fffff807`5080d30a : 00000000`0000001a 00000000`00041201 ffff9f3f`fd62d000 04000200`97ba7005 : nt!KeBugCheckEx
fffffa85`b1f87450 fffff807`50676b41 : ffff9f3f`fd62d008 04000200`97ba7005 00000000`00000002 ffff9f4f`9ffeb168 : nt!MiGetPageProtection+0x19728a
fffffa85`b1f874c0 fffff807`50706414 : ffffb605`cc1ba5c0 00007ffa`be2de000 00000000`00040282 fffff807`50634ba4 : nt!MiQueryAddressState+0x5c1
fffffa85`b1f876e0 fffff807`50c56ba7 : fffffa85`00000000 00007ffa`00000003 fffffa85`00000003 000000ce`00000001 : nt!MiQueryAddressSpan+0x1d4
fffffa85`b1f877a0 fffff807`50c56645 : ffff9f4f`8bd70000 ffff9f4f`a7c5eb80 ffff9f4f`a7d3e2f0 000000ce`c19ff308 : nt!MmQueryVirtualMemory+0x557
fffffa85`b1f87940 fffff807`507ce115 : 00000000`00000000 00000000`00000001 00007ffa`be0fc000 fffffa85`b1f87a80 : nt!NtQueryVirtualMemory+0x25
fffffa85`b1f87990 00007ffa`ec41c4c4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000ce`c19fe788 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`ec41c4c4
SYMBOL_NAME: nt!MiGetPageProtection+19728a
MODULE_NAME: [/COLOR][COLOR=rgba(0, 0, 255, 1)]nt
[/COLOR][COLOR=rgba(30, 30, 30, 1)]STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 19728a
FAILURE_BUCKET_ID: 0x1a_41201_nt!MiGetPageProtection
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {c1fe3b27-3ba8-d99e-656f-85f3d58dc669}
Followup: MachineOwner
---------
2: kd> !blackboxbsd
Stream size mismatch (expected = 192, read = 168)
2: kd> !blackboxntfs
NTFS Blackbox Data
0 Slow I/O Timeout Records Found
0 Oplock Break Timeout Records Found[/COLOR]
[COLOR=rgba(30, 30, 30, 1)]these are the Memory.dmp file Bugcheck error[/COLOR]
[COLOR=rgba(30, 30, 30, 1)]Below is the 2nd error[/COLOR]
[COLOR=rgba(30, 30, 30, 1)]A timeout was reached (45000 milliseconds) while waiting for the asComSvc service to connect.[/COLOR]
Below is the warning:
1. Distributed COM
The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID
{C2F03A33-21F5-47FA-B4BB-156362A2F239}
and APPID
{316CDED5-E4AE-4B15-9113-7055D84DCC97}
to the user DESKTOP-JKHH23P\Mayank SID (S-1-5-21-3452906758-3148296582-676549801-1001) from address
LocalHost (Using LRPC) running in the application container
Microsoft.Windows.ShellExperienceHost_10.0.18362.145_neutral_neutral_cw5n1h2txyewy
SID (S-1-15-2-155514346-2573954481-755741238-1654018636-1233331829-3075935687-2861478708).
This security permission can be modified using the Component Services administrative tool.
2. Serviciting (under setup - event viewer)
[COLOR=rgba(30, 30, 30, 1)]0 of 67 instances of system store corruption have been repaired. Unrepaired corruptions may lead to failures in future system servicing.[/COLOR]
Continue reading...