Microsoft (R) Windows Debugger Version 6.3.9600.17298 X86
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Only kernel address space is available
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred SRV*C:\symbols*
http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*C:\symbols*
http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 8 Kernel Version 10240 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 10240.16463.amd64fre.th1.150819-1946
Machine Name:
Kernel base = 0xfffff804`0060b000 PsLoadedModuleList = 0xfffff804`00930030
Debug session time: Sun Sep 6 16:54:12.546 2015 (UTC + 1:00)
System Uptime: 0 days 6:03:59.184
Loading Kernel Symbols
...............................................................
................................................................
.........................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00007ff6`f8975018). Type ".hh dbgerr001" for details
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 1A, {41793, fffff6bffcbb6ff0, dc, db}
Probably caused by : ntkrnlmp.exe ( nt! ?? ::FNODOBFM::`string'+20a0e )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041793, The subtype of the bugcheck.
Arg2: fffff6bffcbb6ff0
Arg3: 00000000000000dc
Arg4: 00000000000000db
Debugging Details:
------------------
BUGCHECK_STR: 0x1a_41793
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 2
ANALYSIS_VERSION: 6.3.9600.17336 (debuggers(dbg).150226-1500) x86fre
LAST_CONTROL_TRANSFER: from fffff8040078880e to fffff80400759240
STACK_TEXT:
ffffd000`236bc6a8 fffff804`0078880e : 00000000`0000001a 00000000`00041793 fffff6bf`fcbb6ff0 00000000`000000dc : nt!KeBugCheckEx
ffffd000`236bc6b0 fffff804`00637df0 : 00007ff9`01401903 fffff804`00000003 ffffe001`79f7ad38 00000000`0000072c : nt! ?? ::FNODOBFM::`string'+0x20a0e
ffffd000`236bc8b0 fffff804`00a172ac : 00000000`002e2000 ffffe001`79a71c90 ffffe001`7a039c40 00007ff9`76c50000 : nt!MiDeleteVad+0x4b0
ffffd000`236bc9e0 fffff804`00a17967 : 000000a5`17bff100 00000000`00000008 00007ff9`76c50000 00000000`00000001 : nt!MiUnmapViewOfSection+0xec
ffffd000`236bcab0 fffff804`00763863 : ffffe001`77873840 ffffe001`77873840 ffffe001`77873840 ffffe001`79f7a840 : nt!NtUnmapViewOfSectionEx+0x77
ffffd000`236bcb00 00007ff9`8240379a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
000000a5`17bff218 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`8240379a
STACK_COMMAND: kb
FOLLOWUP_IP:
nt! ?? ::FNODOBFM::`string'+20a0e
fffff804`0078880e cc int 3
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt! ?? ::FNODOBFM::`string'+20a0e
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 55d5626b
BUCKET_ID_FUNC_OFFSET: 20a0e
FAILURE_BUCKET_ID: 0x1a_41793_nt!_??_::FNODOBFM::_string_
BUCKET_ID: 0x1a_41793_nt!_??_::FNODOBFM::_string_
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x1a_41793_nt!_??_::fnodobfm::_string_
FAILURE_ID_HASH: {2bb49b32-09fa-a96d-8b93-292cf7a50b3f}
Followup: MachineOwner
---------
