Command - Dump C:UsersLoverDesktopdumpsFlashUtil32_32_0_0_303_pepper.exe_200126_092324.dmp - WinDbg:6.12.0002.633 AMD64

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:UsersLoverDesktopdumpsFlashUtil32_32_0_0_303_pepper.exe_200126_092324.dmp]
User Mini Dump File with Full Memory: Only application data is available

Comment: '
*** "C:Program FilesSysinternalsSuiteprocdump.exe" -accepteula -ma -j "C:UsersLoverDesktopdumps" 5056 188 03C70000
*** Just-In-Time debugger. PID: 5056 Event Handle: 188 JIT Context: .jdinfo 0x3c70000'
Symbol search path is: C:Symbols;srv*C:Symbols*https://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Version 7601 (Service Pack 1) MP (4 procs) Free x86 compatible
Product: WinNt, suite: SingleUserTS
Machine Name:
Debug session time: Sun Jan 26 09:23:24.000 2020 (UTC - 8:00)
System Uptime: 0 days 0:00:50.428
Process Uptime: 0 days 0:00:34.000
...................................................
Loading unloaded module list
................................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(13c0.13c4): Access violation - code c0000005 (first/second chance not available)
eax=00000000 ebx=0035e36c ecx=02e007d0 edx=0064bf0c esi=00000002 edi=00000000
eip=7781015d esp=0035e31c ebp=0035e3b8 iopl=0         nv up ei pl zr na pe nc
cs=0023  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000246
ntdll!ZwWaitForMultipleObjects+0x15:
7781015d 83c404          add     esp,4
0:000> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** ERROR: Module load completed but symbols could not be loaded for FlashUtil32_32_0_0_303_pepper.exe

FAULTING_IP:
LvHook+6461a
3aa6461a ??              ???

EXCEPTION_RECORD:  ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 3aa6461a (<Unloaded_LvHook.dll>+0x0006461a)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000008
   Parameter[1]: 3aa6461a
Attempt to execute non-executable address 3aa6461a

PROCESS_NAME:  FlashUtil32_32_0_0_303_pepper.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s.

EXCEPTION_PARAMETER1:  00000008

EXCEPTION_PARAMETER2:  3aa6461a

WRITE_ADDRESS:  3aa6461a

FOLLOWUP_IP:
LvHook+6461a
3aa6461a ??              ???

MOD_LIST: <ANALYSIS/>

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

FAULTING_THREAD:  000013c4

BUGCHECK_STR:  APPLICATION_FAULT_BAD_INSTRUCTION_PTR_SOFTWARE_NX_FAULT_INVALID_SHUTDOWN

PRIMARY_PROBLEM_CLASS:  BAD_INSTRUCTION_PTR_INVALID_SHUTDOWN

DEFAULT_BUCKET_ID:  BAD_INSTRUCTION_PTR_INVALID_SHUTDOWN

LAST_CONTROL_TRANSFER:  from 77829b01 to 3aa6461a

STACK_TEXT:
WARNING: Frame IP not in any known module. Following frames may be wrong.
0035eb18 77829b01 02e007d0 7efde000 7efdd000 <Unloaded_LvHook.dll>+0x6461a
0035eb34 7783d658 0064bcb0 77baf56c 778f20c0 ntdll!RtlProcessFlsData+0x57
0035ebcc 7783d5a4 0065d0a0 0065d0a0 00000400 ntdll!LdrShutdownProcess+0xbd
0035ebe0 76f97a0c 00000000 77e8f3b0 ffffffff ntdll!RtlExitUserProcess+0x74
0035ebf4 011cadd4 0000040f 0065d2f0 0065d0a0 kernel32!ExitProcessStub+0x12
0035ec08 011cd5b6 0000040f 3e7c567b 0065d0a0 FlashUtil32_32_0_0_303_pepper+0xadd4
0035ec38 011d0605 00000000 00000002 0000040f FlashUtil32_32_0_0_303_pepper+0xd5b6
0035ed0c 011d5ab1 00000000 0121aac4 7efde000 FlashUtil32_32_0_0_303_pepper+0x10605
0035f7a4 011e8176 011c0000 00000000 0062698f FlashUtil32_32_0_0_303_pepper+0x15ab1
0035f7f0 76f933aa 7efde000 0035f83c 77829f72 FlashUtil32_32_0_0_303_pepper+0x28176
0035f7fc 77829f72 7efde000 77bae69c 00000000 kernel32!BaseThreadInitThunk+0xe
0035f83c 77829f45 011e81e8 7efde000 ffffffff ntdll!__RtlUserThreadStart+0x70
0035f854 00000000 011e81e8 7efde000 00000000 ntdll!_RtlUserThreadStart+0x1b


STACK_COMMAND:  ~0s; .ecxr ; kb

SYMBOL_STACK_INDEX:  0

SYMBOL_NAME:  lvhook!unloaded+6461a

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: LvHook

IMAGE_NAME:  LvHook.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  4ef99d42

FAILURE_BUCKET_ID:  BAD_INSTRUCTION_PTR_INVALID_SHUTDOWN_c0000005_LvHook.dll!unloaded

BUCKET_ID:  APPLICATION_FAULT_BAD_INSTRUCTION_PTR_SOFTWARE_NX_FAULT_INVALID_SHUTDOWN_lvhook!unloaded+6461a

Followup: MachineOwner
---------