Microsoft (R) Windows Debugger Version 10.0.17763.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\Minidump\102018-12609-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 17134 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Machine Name:
Kernel base = 0xfffff800`f6804000 PsLoadedModuleList = 0xfffff800`f6bb2290
Debug session time: Sat Oct 20 14:35:38.437 2018 (UTC + 8:00)
System Uptime: 1 days 22:09:55.546
Loading Kernel Symbols
..
Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.
.............................................................
................................................................
................................................................
..........................................
Loading User Symbols
Loading unloaded module list
..................................................
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck A, {200000007, 2, 0, fffff800f684084c}
Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+425 )
Followup: MachineOwner
---------
2: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000200000007, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff800f684084c, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
SYSTEM_MANUFACTURER: LENOVO
SYSTEM_PRODUCT_NAME: 20L7002XCD
SYSTEM_SKU: LENOVO_MT_20L7_BU_Think_FM_ThinkPad T480s
SYSTEM_VERSION: ThinkPad T480s
BIOS_VENDOR: LENOVO
BIOS_VERSION: N22ET31W (1.08 )
BIOS_DATE: 01/22/2018
BASEBOARD_MANUFACTURER: LENOVO
BASEBOARD_PRODUCT: 20L7002XCD
BASEBOARD_VERSION: SDK0L77769 WIN
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
DUMP_TYPE: 2
BUGCHECK_P1: 200000007
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff800f684084c
READ_ADDRESS: fffff800f6c51388: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
0000000200000007
CURRENT_IRQL: 2
FAULTING_IP:
nt!IopCompleteRequest+e3c
fffff800`f684084c 48395108 cmp qword ptr [rcx+8],rdx
CPU_COUNT: 8
CPU_MHZ: 7c8
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 8e
CPU_STEPPING: a
CPU_MICROCODE: 6,8e,a,0 (F,M,S,R) SIG: 84'00000000 (cache) 84'00000000 (init)
BLACKBOXPNP: 1 (!blackboxpnp)
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: iexplore.exe
ANALYSIS_SESSION_HOST: LAPTOP-0FTB5TN5
ANALYSIS_SESSION_TIME: 10-20-2018 14:59:10.0450
ANALYSIS_VERSION: 10.0.17763.1 amd64fre
IRP_ADDRESS: ffffc780f13c9108
TRAP_FRAME: ffff88894acaea50 -- (.trap 0xffff88894acaea50)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffff600000002 rbx=0000000000000000 rcx=00000001ffffffff
rdx=ffff88894acae9a0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800f684084c rsp=ffff88894acaebe0 rbp=ffff88894acaed28
r8=0000000000000002 r9=ffffc780f1500000 r10=0000000000000fff
r11=0000000000000280 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!IopCompleteRequest+0xe3c:
fffff800`f684084c 48395108 cmp qword ptr [rcx+8],rdx ds:00000002`00000007=????????????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff800f69be069 to fffff800f69ad490
STACK_TEXT:
ffff8889`4acae908 fffff800`f69be069 : 00000000`0000000a 00000002`00000007 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffff8889`4acae910 fffff800`f69bace5 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffff8889`4acaea50 fffff800`f684084c : ffff9d05`bf4126e0 00000000`00000001 ffffed80`000009c8 00000000`20206f49 : nt!KiPageFault+0x425
ffff8889`4acaebe0 fffff800`f683f5e1 : ffffc780`f13c9180 ffffd7ec`45200108 80000002`4845b800 ffff8889`00000000 : nt!IopCompleteRequest+0xe3c
ffff8889`4acaecd0 fffff800`f69b133c : fffff800`f6bd4c40 00000000`00000000 ffffed80`00000000 ffffed80`06d8d118 : nt!KiDeliverApc+0x171
ffff8889`4acaed60 fffff800`f68fc11c : 00000000`00000114 00000000`00000000 ffffd88a`40021000 ffffd7eb`f5fafd78 : nt!KiApcInterrupt+0x29c
ffff8889`4acaeef0 fffff800`f6854db3 : 00000000`0002f000 ffffed80`04062b40 00000000`00000000 ffffd7ec`45200108 : nt!MmAccessFault+0x12c
ffff8889`4acaf060 fffff800`f6847ba7 : ffff9d05`00000000 ffff9d05`00000000 00000000`000a1000 ffff8889`4acaf28c : nt!MmCheckCachedPageStates+0x1623
ffff8889`4acaf240 fffff800`f688a097 : ffff9d05`bcbe4130 00000000`0b317f80 ffff8889`4acaf420 00000000`00000000 : nt!CcMapAndCopyInToCache+0x6b7
ffff8889`4acaf3c0 fffff800`ec3fbae3 : 00000000`000a101e ffffb284`a19b9c00 ffff9d05`b71eb5e0 00000000`00000126 : nt!CcCopyWriteEx+0x107
ffff8889`4acaf440 fffff800`eb927a4b : 00000000`000002c0 00000000`00000000 00000000`0000000d 00000000`0b317e78 : Ntfs!NtfsCopyWriteA+0x3d3
ffff8889`4acaf710 fffff800`eb925017 : ffff8889`4acaf800 ffff9d05`b71eb500 ffff9d05`b70d8110 ffff9d05`b70d8010 : FLTMGR!FltpPerformFastIoCall+0x10b
ffff8889`4acaf770 fffff800`eb95b41c : 00000000`00000008 00000000`0000000e 00000000`0649e820 00000000`00000000 : FLTMGR!FltpPassThroughFastIo+0xc7
ffff8889`4acaf7d0 fffff800`f6cbfefb : 00000000`00000000 ffff9d05`b71eb5e0 00000000`4acaf801 00000000`00000000 : FLTMGR!FltpFastIoWrite+0x15c
ffff8889`4acaf870 fffff800`f69bdb43 : 00000000`00000701 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtWriteFile+0x65b
ffff8889`4acaf990 00000000`779e1e4c : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000000`0649f198 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x779e1e4c
THREAD_SHA1_HASH_MOD_FUNC: d9e33816543081d309c85b4422b3edc5b3244a0a
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 942c42d65cc5ee356f495d9351f084e7bcf9c672
THREAD_SHA1_HASH_MOD: d584a642e0dc5e2cdd7b2fe8bf7f1e20e35ddefa
FOLLOWUP_IP:
nt!KiPageFault+425
fffff800`f69bace5 33c0 xor eax,eax
FAULT_INSTR_CODE: ffb0c033
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiPageFault+425
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5ba316ae
IMAGE_VERSION: 10.0.17134.345
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 425
FAILURE_BUCKET_ID: AV_nt!KiPageFault
BUCKET_ID: AV_nt!KiPageFault
PRIMARY_PROBLEM_CLASS: AV_nt!KiPageFault
TARGET_TIME: 2018-10-20T06:35:38.000Z
OSBUILD: 17134
OSSERVICEPACK: 345
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 784
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS Personal
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2018-09-20 11:40:30
ANALYSIS_SESSION_ELAPSED_TIME: 4a7
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_nt!kipagefault
FAILURE_ID_HASH: {ec3e2762-48ae-ffe9-5b16-fbcb853e8320}
Followup: MachineOwner
---------
2: kd> lmvm nt
Browse full module list
start end module name
fffff800`f6804000 fffff800`f7157000 nt (pdb symbols) C:\Program Files\Windows Kits\10\Debuggers\x64\sym\ntkrnlmp.pdb\DD0D1D2022E0401BB9551D9DD9ECDF581\ntkrnlmp.pdb
Loaded symbol image file: ntkrnlmp.exe
Mapped memory image file: C:\Program Files\Windows Kits\10\Debuggers\x64\sym\ntoskrnl.exe\5BA316AE953000\ntoskrnl.exe
Image path: ntkrnlmp.exe
Image name: ntkrnlmp.exe
Browse all global symbols functions data
Timestamp: Wed Sep 19 20:40:30 2018 (5BA316AE)
CheckSum: 008B3C39
ImageSize: 00953000
File version: 10.0.17134.345
Product version: 10.0.17134.345
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: ntkrnlmp.exe
OriginalFilename: ntkrnlmp.exe
ProductVersion: 10.0.17134.345
FileVersion: 10.0.17134.345 (WinBuild.160101.0800)
FileDescription: NT Kernel & System
LegalCopyright: © Microsoft Corporation. All rights reserved.