memory.dmp


Microsoft (R) Windows Debugger Version 10.0.15063.468 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\WINDOWS\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.

Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 10586 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 10586.103.amd64fre.th2_release.160126-1819
Machine Name:
Kernel base = 0xfffff801`9ea1c000 PsLoadedModuleList = 0xfffff801`9ecfacf0
Debug session time: Sat Jul 22 21:41:24.423 2017 (UTC + 2:00)
System Uptime: 0 days 23:37:42.131
Loading Kernel Symbols
...............................................................
................................................................
.............................................
Loading User Symbols

Loading unloaded module list
.................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {5, d, 8, 5}

Probably caused by : ntkrnlmp.exe ( nt!KiPageFault+247 )

Followup:     MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000005, memory referenced
Arg2: 000000000000000d, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: 0000000000000005, address which referenced memory

Debugging Details:
------------------


DUMP_CLASS: 1

DUMP_QUALIFIER: 401

BUILD_VERSION_STRING:  10586.103.amd64fre.th2_release.160126-1819

SYSTEM_PRODUCT_NAME:  To Be Filled By O.E.M.

SYSTEM_SKU:  To Be Filled By O.E.M.

SYSTEM_VERSION:  To Be Filled By O.E.M.

BIOS_VENDOR:  American Megatrends Inc.

BIOS_VERSION:  P2.80

BIOS_DATE:  05/31/2016

BASEBOARD_MANUFACTURER:  ASRock

BASEBOARD_PRODUCT:  970 Pro3 R2.0

BASEBOARD_VERSION:

DUMP_TYPE:  1

BUGCHECK_P1: 5

BUGCHECK_P2: d

BUGCHECK_P3: 8

BUGCHECK_P4: 5

READ_ADDRESS:  0000000000000005

CURRENT_IRQL:  d

FAULTING_IP:
+0
00000000`00000005 ??              ???

PROCESS_NAME:  System

CPU_COUNT: 8

CPU_MHZ: f97

CPU_VENDOR:  AuthenticAMD

CPU_FAMILY: 15

CPU_MODEL: 2

CPU_STEPPING: 0

DEFAULT_BUCKET_ID:  WIN8_DRIVER_FAULT

BUGCHECK_STR:  AV

ANALYSIS_SESSION_HOST:  L934054

ANALYSIS_SESSION_TIME:  07-24-2017 08:07:03.0405

ANALYSIS_VERSION: 10.0.15063.468 amd64fre

TRAP_FRAME:  ffffd001626bbdf0 -- (.trap 0xffffd001626bbdf0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000af23675b8f01 rbx=0000000000000000 rcx=0000000000000240
rdx=0000af2300000000 rsi=0000000000000000 rdi=0000000000000000
rip=0000000000000005 rsp=ffffd001626bbf88 rbp=ffffd00100000000
 r8=000000000031833e  r9=0000000000000000 r10=ffffd0016268942c
r11=ffffd0016268fcc0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up ei pl nz na po nc
00000000`00000005 ??              ???
Resetting default scope

LAST_CONTROL_TRANSFER:  from fffff8019eb68fe9 to fffff8019eb5e480

FAILED_INSTRUCTION_ADDRESS:
+0
00000000`00000005 ??              ???

STACK_TEXT:
ffffd001`626bbca8 fffff801`9eb68fe9 : 00000000`0000000a 00000000`00000005 00000000`0000000d 00000000`00000008 : nt!KeBugCheckEx
ffffd001`626bbcb0 fffff801`9eb677c7 : 00000236`f9870d00 ffffd001`62683180 00000000`00000000 00000000`00000001 : nt!KiBugCheckDispatch+0x69
ffffd001`626bbdf0 00000000`00000005 : 00000000`00000000 0000004d`32a61e23 ffffd001`626ad760 ffffe001`4bc39010 : nt!KiPageFault+0x247
ffffd001`626bbf88 00000000`00000000 : 0000004d`32a61e23 ffffd001`626ad760 ffffe001`4bc39010 fffff801`9eb5f8aa : 0x5


STACK_COMMAND:  kb

THREAD_SHA1_HASH_MOD_FUNC:  bf99962f16aee8a6a536cfcc5454c0cd4db15ac9

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  3fc3928ee7b2857c7b0acb22199e00ab7dceb90c

THREAD_SHA1_HASH_MOD:  2a7ca9d3ab5386d53fea7498e1d81b9c4a4c036b

FOLLOWUP_IP:
nt!KiPageFault+247
fffff801`9eb677c7 33c0            xor     eax,eax

FAULT_INSTR_CODE:  ffb0c033

SYMBOL_STACK_INDEX:  2

SYMBOL_NAME:  nt!KiPageFault+247

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  56a849a9

BUCKET_ID_FUNC_OFFSET:  247

FAILURE_BUCKET_ID:  AV_CODE_AV_NULL_IP_nt!KiPageFault

BUCKET_ID:  AV_CODE_AV_NULL_IP_nt!KiPageFault

PRIMARY_PROBLEM_CLASS:  AV_CODE_AV_NULL_IP_nt!KiPageFault

TARGET_TIME:  2017-07-22T19:41:24.000Z

OSBUILD:  10586

OSSERVICEPACK:  0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  272

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE:

USER_LCID:  0

OSBUILD_TIMESTAMP:  2016-01-27 05:38:01

BUILDDATESTAMP_STR:  160126-1819

BUILDLAB_STR:  th2_release

BUILDOSVER_STR:  10.0.10586.103.amd64fre.th2_release.160126-1819

ANALYSIS_SESSION_ELAPSED_TIME:  90c

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:av_code_av_null_ip_nt!kipagefault

FAILURE_ID_HASH:  {4ce35ff9-c5cf-d66d-0323-0f05e33f6692}

Followup:     MachineOwner
---------