Loading Dump File [C:\Users\Cosy\AppData\Roaming\Skype\My Skype Received Files\062117-13703-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*
https://msdl.microsoft.com/download/symbols
Symbol search path is: srv*
https://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 8 Kernel Version 15063 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 15063.0.amd64fre.rs2_release.170317-1834
Machine Name:
Kernel base = 0xfffff800`c2e8c000 PsLoadedModuleList = 0xfffff800`c31d85a0
Debug session time: Wed Jun 21 13:33:54.224 2017 (UTC + 3:00)
System Uptime: 0 days 0:22:28.860
Loading Kernel Symbols
.................................................. .............
.................................................. ..............
.................................................. ..............
Loading User Symbols
Loading unloaded module list
........
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************
Use !analyze -v to get detailed debugging information.
BugCheck 96, {ffffb28c63352ce0, fffff800c3284650, fffff800c3284380, fffff800c2eaad90}
Probably caused by : ntkrnlmp.exe ( nt!IopProcessWorkItem+0 )
Followup: MachineOwner
---------
4: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************
INVALID_WORK_QUEUE_ITEM (96)
This message occurs when KeRemoveQueue removes a queue entry whose flink
or blink field is null. This is almost always called by code misusing
worker thread work items, but any queue misuse can cause this. The rule
is that an entry on a queue may only be inserted on the list once. When an
item is removed from a queue, it's flink field is set to NULL. This bugcheck
occurs when remove queue attempts to remove an entry, but the flink or blink
field is NULL. In order to debug this problem, you need to know the queue being
referenced.
In an attempt to help identify the guilty driver, this bugcheck assumes the
queue is a worker queue (ExWorkerQueue) and prints the worker routine as
parameter 4 below.
Arguments:
Arg1: ffffb28c63352ce0, The address of the queue entry whose flink/blink field is NULL
Arg2: fffff800c3284650, The address of the queue being references. Usually this is one
of the ExWorkerQueues.
Arg3: fffff800c3284380, The base address of the ExWorkerQueue array. This will help determine
if the queue in question is an ExWorkerQueue and if so, the offset from
this parameter will isolate the queue.
Arg4: fffff800c2eaad90, If this is an ExWorkerQueue (which it usually is), this is the address
of the worker routine that would have been called if the work item was
valid. This can be used to isolate the driver that is misusing the work
queue.
Debugging Details:
------------------
WORKER_ROUTINE:
nt!IopProcessWorkItem+0
fffff800`c2eaad90 48895c2410 mov qword ptr [rsp+10h],rbx
FAULTING_IP:
nt!IopProcessWorkItem+0
fffff800`c2eaad90 48895c2410 mov qword ptr [rsp+10h],rbx
WORK_ITEM: ffffb28c63352ce0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x96
PROCESS_NAME: System
CURRENT_IRQL: 2
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
LAST_CONTROL_TRANSFER: from fffff800c304bdbc to fffff800c2ff83f0
STACK_TEXT:
ffff8b80`621c6ac8 fffff800`c304bdbc : 00000000`00000096 ffffb28c`63352ce0 fffff800`c3284650 fffff800`c3284380 : nt!KeBugCheckEx
ffff8b80`621c6ad0 fffff800`c2eca00e : 00000000`00000000 00000000`00000000 fffff800`c3284650 ffffb28c`6c65e040 : nt!KiAttemptFastRemovePriQueue+0xc929c
ffff8b80`621c6b10 fffff800`c2ec9c50 : 00000000`00000100 ffffb28c`6c65e000 fffff800`c2eaad90 00000000`0000000c : nt!KeRemovePriQueue+0x19e
ffff8b80`621c6b80 fffff800`c2f68a37 : ffffb28c`65772cc0 00000000`00000080 ffffb28c`5ea7d040 ffffb28c`6c65e040 : nt!ExpWorkerThread+0x80
ffff8b80`621c6c10 fffff800`c2ffd876 : ffff8b80`1abde180 ffffb28c`6c65e040 fffff800`c2f689f0 ffff813c`029eaa01 : nt!PspSystemThreadStartup+0x47
ffff8b80`621c6c60 00000000`00000000 : ffff8b80`621c7000 ffff8b80`621c1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nt!IopProcessWorkItem+0
fffff800`c2eaad90 48895c2410 mov qword ptr [rsp+10h],rbx
SYMBOL_NAME: nt!IopProcessWorkItem+0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 59327910
IMAGE_VERSION: 10.0.15063.413
BUCKET_ID_FUNC_OFFSET: 0
FAILURE_BUCKET_ID: 0x96_nt!IopProcessWorkItem
BUCKET_ID: 0x96_nt!IopProcessWorkItem
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x96_nt!iopprocessworkitem
FAILURE_ID_HASH: {9b586d9a-c1f6-a6de-4692-9ceab4008b6f}
Followup: MachineOwner
---------
4: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************
INVALID_WORK_QUEUE_ITEM (96)
This message occurs when KeRemoveQueue removes a queue entry whose flink
or blink field is null. This is almost always called by code misusing
worker thread work items, but any queue misuse can cause this. The rule
is that an entry on a queue may only be inserted on the list once. When an
item is removed from a queue, it's flink field is set to NULL. This bugcheck
occurs when remove queue attempts to remove an entry, but the flink or blink
field is NULL. In order to debug this problem, you need to know the queue being
referenced.
In an attempt to help identify the guilty driver, this bugcheck assumes the
queue is a worker queue (ExWorkerQueue) and prints the worker routine as
parameter 4 below.
Arguments:
Arg1: ffffb28c63352ce0, The address of the queue entry whose flink/blink field is NULL
Arg2: fffff800c3284650, The address of the queue being references. Usually this is one
of the ExWorkerQueues.
Arg3: fffff800c3284380, The base address of the ExWorkerQueue array. This will help determine
if the queue in question is an ExWorkerQueue and if so, the offset from
this parameter will isolate the queue.
Arg4: fffff800c2eaad90, If this is an ExWorkerQueue (which it usually is), this is the address
of the worker routine that would have been called if the work item was
valid. This can be used to isolate the driver that is misusing the work
queue.
Debugging Details:
------------------
WORKER_ROUTINE:
nt!IopProcessWorkItem+0
fffff800`c2eaad90 48895c2410 mov qword ptr [rsp+10h],rbx
FAULTING_IP:
nt!IopProcessWorkItem+0
fffff800`c2eaad90 48895c2410 mov qword ptr [rsp+10h],rbx
WORK_ITEM: ffffb28c63352ce0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x96
PROCESS_NAME: System
CURRENT_IRQL: 2
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
LAST_CONTROL_TRANSFER: from fffff800c304bdbc to fffff800c2ff83f0
STACK_TEXT:
ffff8b80`621c6ac8 fffff800`c304bdbc : 00000000`00000096 ffffb28c`63352ce0 fffff800`c3284650 fffff800`c3284380 : nt!KeBugCheckEx
ffff8b80`621c6ad0 fffff800`c2eca00e : 00000000`00000000 00000000`00000000 fffff800`c3284650 ffffb28c`6c65e040 : nt!KiAttemptFastRemovePriQueue+0xc929c
ffff8b80`621c6b10 fffff800`c2ec9c50 : 00000000`00000100 ffffb28c`6c65e000 fffff800`c2eaad90 00000000`0000000c : nt!KeRemovePriQueue+0x19e
ffff8b80`621c6b80 fffff800`c2f68a37 : ffffb28c`65772cc0 00000000`00000080 ffffb28c`5ea7d040 ffffb28c`6c65e040 : nt!ExpWorkerThread+0x80
ffff8b80`621c6c10 fffff800`c2ffd876 : ffff8b80`1abde180 ffffb28c`6c65e040 fffff800`c2f689f0 ffff813c`029eaa01 : nt!PspSystemThreadStartup+0x47
ffff8b80`621c6c60 00000000`00000000 : ffff8b80`621c7000 ffff8b80`621c1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nt!IopProcessWorkItem+0
fffff800`c2eaad90 48895c2410 mov qword ptr [rsp+10h],rbx
SYMBOL_NAME: nt!IopProcessWorkItem+0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 59327910
IMAGE_VERSION: 10.0.15063.413
BUCKET_ID_FUNC_OFFSET: 0
FAILURE_BUCKET_ID: 0x96_nt!IopProcessWorkItem
BUCKET_ID: 0x96_nt!IopProcessWorkItem
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x96_nt!iopprocessworkitem
FAILURE_ID_HASH: {9b586d9a-c1f6-a6de-4692-9ceab4008b6f}
Followup: MachineOwner
---------
4: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************
INVALID_WORK_QUEUE_ITEM (96)
This message occurs when KeRemoveQueue removes a queue entry whose flink
or blink field is null. This is almost always called by code misusing
worker thread work items, but any queue misuse can cause this. The rule
is that an entry on a queue may only be inserted on the list once. When an
item is removed from a queue, it's flink field is set to NULL. This bugcheck
occurs when remove queue attempts to remove an entry, but the flink or blink
field is NULL. In order to debug this problem, you need to know the queue being
referenced.
In an attempt to help identify the guilty driver, this bugcheck assumes the
queue is a worker queue (ExWorkerQueue) and prints the worker routine as
parameter 4 below.
Arguments:
Arg1: ffffb28c63352ce0, The address of the queue entry whose flink/blink field is NULL
Arg2: fffff800c3284650, The address of the queue being references. Usually this is one
of the ExWorkerQueues.
Arg3: fffff800c3284380, The base address of the ExWorkerQueue array. This will help determine
if the queue in question is an ExWorkerQueue and if so, the offset from
this parameter will isolate the queue.
Arg4: fffff800c2eaad90, If this is an ExWorkerQueue (which it usually is), this is the address
of the worker routine that would have been called if the work item was
valid. This can be used to isolate the driver that is misusing the work
queue.
Debugging Details:
------------------
WORKER_ROUTINE:
nt!IopProcessWorkItem+0
fffff800`c2eaad90 48895c2410 mov qword ptr [rsp+10h],rbx
FAULTING_IP:
nt!IopProcessWorkItem+0
fffff800`c2eaad90 48895c2410 mov qword ptr [rsp+10h],rbx
WORK_ITEM: ffffb28c63352ce0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x96
PROCESS_NAME: System
CURRENT_IRQL: 2
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
LAST_CONTROL_TRANSFER: from fffff800c304bdbc to fffff800c2ff83f0
STACK_TEXT:
ffff8b80`621c6ac8 fffff800`c304bdbc : 00000000`00000096 ffffb28c`63352ce0 fffff800`c3284650 fffff800`c3284380 : nt!KeBugCheckEx
ffff8b80`621c6ad0 fffff800`c2eca00e : 00000000`00000000 00000000`00000000 fffff800`c3284650 ffffb28c`6c65e040 : nt!KiAttemptFastRemovePriQueue+0xc929c
ffff8b80`621c6b10 fffff800`c2ec9c50 : 00000000`00000100 ffffb28c`6c65e000 fffff800`c2eaad90 00000000`0000000c : nt!KeRemovePriQueue+0x19e
ffff8b80`621c6b80 fffff800`c2f68a37 : ffffb28c`65772cc0 00000000`00000080 ffffb28c`5ea7d040 ffffb28c`6c65e040 : nt!ExpWorkerThread+0x80
ffff8b80`621c6c10 fffff800`c2ffd876 : ffff8b80`1abde180 ffffb28c`6c65e040 fffff800`c2f689f0 ffff813c`029eaa01 : nt!PspSystemThreadStartup+0x47
ffff8b80`621c6c60 00000000`00000000 : ffff8b80`621c7000 ffff8b80`621c1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nt!IopProcessWorkItem+0
fffff800`c2eaad90 48895c2410 mov qword ptr [rsp+10h],rbx
SYMBOL_NAME: nt!IopProcessWorkItem+0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 59327910
IMAGE_VERSION: 10.0.15063.413
BUCKET_ID_FUNC_OFFSET: 0
FAILURE_BUCKET_ID: 0x96_nt!IopProcessWorkItem
BUCKET_ID: 0x96_nt!IopProcessWorkItem
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x96_nt!iopprocessworkitem
FAILURE_ID_HASH: {9b586d9a-c1f6-a6de-4692-9ceab4008b6f}
Followup: MachineOwner
---------
4: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************
INVALID_WORK_QUEUE_ITEM (96)
This message occurs when KeRemoveQueue removes a queue entry whose flink
or blink field is null. This is almost always called by code misusing
worker thread work items, but any queue misuse can cause this. The rule
is that an entry on a queue may only be inserted on the list once. When an
item is removed from a queue, it's flink field is set to NULL. This bugcheck
occurs when remove queue attempts to remove an entry, but the flink or blink
field is NULL. In order to debug this problem, you need to know the queue being
referenced.
In an attempt to help identify the guilty driver, this bugcheck assumes the
queue is a worker queue (ExWorkerQueue) and prints the worker routine as
parameter 4 below.
Arguments:
Arg1: ffffb28c63352ce0, The address of the queue entry whose flink/blink field is NULL
Arg2: fffff800c3284650, The address of the queue being references. Usually this is one
of the ExWorkerQueues.
Arg3: fffff800c3284380, The base address of the ExWorkerQueue array. This will help determine
if the queue in question is an ExWorkerQueue and if so, the offset from
this parameter will isolate the queue.
Arg4: fffff800c2eaad90, If this is an ExWorkerQueue (which it usually is), this is the address
of the worker routine that would have been called if the work item was
valid. This can be used to isolate the driver that is misusing the work
queue.
Debugging Details:
------------------
WORKER_ROUTINE:
nt!IopProcessWorkItem+0
fffff800`c2eaad90 48895c2410 mov qword ptr [rsp+10h],rbx
FAULTING_IP:
nt!IopProcessWorkItem+0
fffff800`c2eaad90 48895c2410 mov qword ptr [rsp+10h],rbx
WORK_ITEM: ffffb28c63352ce0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x96
PROCESS_NAME: System
CURRENT_IRQL: 2
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
LAST_CONTROL_TRANSFER: from fffff800c304bdbc to fffff800c2ff83f0
STACK_TEXT:
ffff8b80`621c6ac8 fffff800`c304bdbc : 00000000`00000096 ffffb28c`63352ce0 fffff800`c3284650 fffff800`c3284380 : nt!KeBugCheckEx
ffff8b80`621c6ad0 fffff800`c2eca00e : 00000000`00000000 00000000`00000000 fffff800`c3284650 ffffb28c`6c65e040 : nt!KiAttemptFastRemovePriQueue+0xc929c
ffff8b80`621c6b10 fffff800`c2ec9c50 : 00000000`00000100 ffffb28c`6c65e000 fffff800`c2eaad90 00000000`0000000c : nt!KeRemovePriQueue+0x19e
ffff8b80`621c6b80 fffff800`c2f68a37 : ffffb28c`65772cc0 00000000`00000080 ffffb28c`5ea7d040 ffffb28c`6c65e040 : nt!ExpWorkerThread+0x80
ffff8b80`621c6c10 fffff800`c2ffd876 : ffff8b80`1abde180 ffffb28c`6c65e040 fffff800`c2f689f0 ffff813c`029eaa01 : nt!PspSystemThreadStartup+0x47
ffff8b80`621c6c60 00000000`00000000 : ffff8b80`621c7000 ffff8b80`621c1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nt!IopProcessWorkItem+0
fffff800`c2eaad90 48895c2410 mov qword ptr [rsp+10h],rbx
SYMBOL_NAME: nt!IopProcessWorkItem+0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 59327910
IMAGE_VERSION: 10.0.15063.413
BUCKET_ID_FUNC_OFFSET: 0
FAILURE_BUCKET_ID: 0x96_nt!IopProcessWorkItem
BUCKET_ID: 0x96_nt!IopProcessWorkItem
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x96_nt!iopprocessworkitem
FAILURE_ID_HASH: {9b586d9a-c1f6-a6de-4692-9ceab4008b6f}
Followup: MachineOwner
---------
4: kd> !analyze -v
************************************************** *****************************
* *
* Bugcheck Analysis *
* *
************************************************** *****************************
INVALID_WORK_QUEUE_ITEM (96)
This message occurs when KeRemoveQueue removes a queue entry whose flink
or blink field is null. This is almost always called by code misusing
worker thread work items, but any queue misuse can cause this. The rule
is that an entry on a queue may only be inserted on the list once. When an
item is removed from a queue, it's flink field is set to NULL. This bugcheck
occurs when remove queue attempts to remove an entry, but the flink or blink
field is NULL. In order to debug this problem, you need to know the queue being
referenced.
In an attempt to help identify the guilty driver, this bugcheck assumes the
queue is a worker queue (ExWorkerQueue) and prints the worker routine as
parameter 4 below.
Arguments:
Arg1: ffffb28c63352ce0, The address of the queue entry whose flink/blink field is NULL
Arg2: fffff800c3284650, The address of the queue being references. Usually this is one
of the ExWorkerQueues.
Arg3: fffff800c3284380, The base address of the ExWorkerQueue array. This will help determine
if the queue in question is an ExWorkerQueue and if so, the offset from
this parameter will isolate the queue.
Arg4: fffff800c2eaad90, If this is an ExWorkerQueue (which it usually is), this is the address
of the worker routine that would have been called if the work item was
valid. This can be used to isolate the driver that is misusing the work
queue.
Debugging Details:
------------------
WORKER_ROUTINE:
nt!IopProcessWorkItem+0
fffff800`c2eaad90 48895c2410 mov qword ptr [rsp+10h],rbx
FAULTING_IP:
nt!IopProcessWorkItem+0
fffff800`c2eaad90 48895c2410 mov qword ptr [rsp+10h],rbx
WORK_ITEM: ffffb28c63352ce0
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x96
PROCESS_NAME: System
CURRENT_IRQL: 2
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
LAST_CONTROL_TRANSFER: from fffff800c304bdbc to fffff800c2ff83f0
STACK_TEXT:
ffff8b80`621c6ac8 fffff800`c304bdbc : 00000000`00000096 ffffb28c`63352ce0 fffff800`c3284650 fffff800`c3284380 : nt!KeBugCheckEx
ffff8b80`621c6ad0 fffff800`c2eca00e : 00000000`00000000 00000000`00000000 fffff800`c3284650 ffffb28c`6c65e040 : nt!KiAttemptFastRemovePriQueue+0xc929c
ffff8b80`621c6b10 fffff800`c2ec9c50 : 00000000`00000100 ffffb28c`6c65e000 fffff800`c2eaad90 00000000`0000000c : nt!KeRemovePriQueue+0x19e
ffff8b80`621c6b80 fffff800`c2f68a37 : ffffb28c`65772cc0 00000000`00000080 ffffb28c`5ea7d040 ffffb28c`6c65e040 : nt!ExpWorkerThread+0x80
ffff8b80`621c6c10 fffff800`c2ffd876 : ffff8b80`1abde180 ffffb28c`6c65e040 fffff800`c2f689f0 ffff813c`029eaa01 : nt!PspSystemThreadStartup+0x47
ffff8b80`621c6c60 00000000`00000000 : ffff8b80`621c7000 ffff8b80`621c1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16
STACK_COMMAND: .bugcheck ; kb
FOLLOWUP_IP:
nt!IopProcessWorkItem+0
fffff800`c2eaad90 48895c2410 mov qword ptr [rsp+10h],rbx
SYMBOL_NAME: nt!IopProcessWorkItem+0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 59327910
IMAGE_VERSION: 10.0.15063.413
BUCKET_ID_FUNC_OFFSET: 0
FAILURE_BUCKET_ID: 0x96_nt!IopProcessWorkItem
BUCKET_ID: 0x96_nt!IopProcessWorkItem
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x96_nt!iopprocessworkitem
FAILURE_ID_HASH: {9b586d9a-c1f6-a6de-4692-9ceab4008b6f}
Followup: MachineOwner
---------
4: kd>
Viziteaza-ne pe Facebook
Urmareste-ne pe Twitter
Vezi ce facem pe YouTube