Skip to main content
B
bww00bww00
Participant
January 23, 2020
Question

crash need help of next steps

  • January 23, 2020
  • 0 replies
  • 930 views

need some help on where to go next

this happens intermittently

 

Thanks for any help

 

Timeline: Process.Start

    Name: <blank>

    Time: 2020-01-16T21:46:36.0Z

    Diff: 245000 mSec

 

 

DUMP_CLASS: 2

 

DUMP_QUALIFIER: 400

 

CONTEXT:  (.ecxr)

rax=0000008b66bdf4f0 rbx=00007ff82d721980 rcx=0000000000060354

rdx=0000000000000219 rsi=0000008b66bded80 rdi=0000008b66bdf270

rip=0000000071067268 rsp=0000008b66bdf488 rbp=0000008b66bdf640

r8=0000000000000007  r9=0000000000000000 r10=0000000000060354

r11=0000000000000246 r12=0000000000000007 r13=0000000000000000

r14=0000000000000000 r15=0000000071067268

iopl=0         nv up ei pl zr na po nc

cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010244

AcroPDFImpl64+0x47268:

00000000`71067268 ??              ???

Resetting default scope

 

FAULTING_IP:

AcroPDFImpl64.dll!Unloaded+47268

00000000`71067268 ??              ???

 

EXCEPTION_RECORD:  (.exr -1)

ExceptionAddress: 0000000071067268 (AcroPDFImpl64+0x0000000000047268)

   ExceptionCode: c000041d

  ExceptionFlags: 00000001

NumberParameters: 0

 

ERROR_CODE: (NTSTATUS) 0xc000041d - An unhandled exception was encountered during a user callback.

 

EXCEPTION_CODE: (NTSTATUS) 0xc000041d - An unhandled exception was encountered during a user callback.

 

EXCEPTION_CODE_STR:  c000041d

 

WATSON_BKT_PROCSTAMP:  5200b07b

 

WATSON_BKT_PROCVER:  8.0.0.20

 

WATSON_BKT_MODULE:  unknown

 

WATSON_BKT_MODVER:  0.0.0.0

 

WATSON_BKT_MODOFFSET:  71067268

 

BUILD_VERSION_STRING:  6.3.9600.18217 (winblue_ltsb.160124-0053)

 

MODLIST_WITH_TSCHKSUM_HASH:  773766f70c710170b94564e6c0dc54913e4bbd14

 

MODLIST_SHA1_HASH:  6a32fcfce81b1f3c463b25db95643730c78ad69a

 

NTGLOBALFLAG:  400

 

PROCESS_BAM_CURRENT_THROTTLED: 0

 

PROCESS_BAM_PREVIOUS_THROTTLED: 0

 

DUMP_FLAGS:  c8e

 

DUMP_TYPE:  1

 

PROCESS_NAME:  unknown

 

MISSING_CLR_SYMBOL: 0

 

ANALYSIS_SESSION_HOST:  2UA7491L7N

 

ANALYSIS_SESSION_TIME:  01-22-2020 13:30:20.0116

 

ANALYSIS_VERSION: 10.0.17763.132 amd64fre

 

MANAGED_CODE: 1

 

MANAGED_ENGINE_MODULE:  clr

 

MANAGED_ANALYSIS_PROVIDER:  SOS

 

THREAD_ATTRIBUTES:

OS_LOCALE:  ENU

 

ADDITIONAL_DEBUG_TEXT:  SOS.DLL is not loaded for managed code. Analysis might be incomplete

 

BUGCHECK_STR:  BAD_INSTRUCTION_PTR_NOSOS

 

DEFAULT_BUCKET_ID:  BAD_INSTRUCTION_PTR_NOSOS

 

PRIMARY_PROBLEM_CLASS:  BAD_INSTRUCTION_PTR

 

PROBLEM_CLASSES:

 

    ID:     [0n296]

    Type:   [BAD_INSTRUCTION_PTR]

    Class:  Primary

    Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)

            BUCKET_ID

    Name:   Add

    Data:   Omit

    PID:    [0x545c]

    TID:    [0x56f4]

    Frame:  [0] : AcroPDFImpl64.dll!Unloaded

 

    ID:     [0n251]

    Type:   [NOSOS]

    Class:  Addendum

    Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)

            BUCKET_ID

    Name:   Add

    Data:   Omit

    PID:    [Unspecified]

    TID:    [Unspecified]

    Frame:  [0]

 

LAST_CONTROL_TRANSFER:  from 00007ff82dc924fd to 0000000071067268

 

STACK_TEXT: 

0000008b`66bdf488 00007ff8`2dc924fd : 00000000`00000001 00000000`00000001 00000000`00000219 00000000`000301f0 : AcroPDFImpl64+0x47268

0000008b`66bdf490 00007ff8`2dc93902 : 00000000`00000000 00000000`00000000 00000000`00060354 00000000`00000000 : user32!UserCallWinProcCheckWow+0x149

0000008b`66bdf560 00007ff8`2dcb2fa2 : 00007ff8`30420680 0000008b`66bdf6d8 00000000`00000000 00000000`00000113 : user32!DispatchClientMessage+0xa2

0000008b`66bdf5c0 00007ff8`304225c4 : 00000083`436342c8 00000000`00000000 00000000`00000000 00000000`00000000 : user32!__fnINDEVICECHANGE+0x72

0000008b`66bdf680 00007ff8`2dc926ba : 00007ff8`2dc96104 00007fff`fd932872 00000000`00000000 00000000`00000002 : ntdll!KiUserCallbackDispatcherContinue

0000008b`66bdf748 00007ff8`2dc96104 : 00007fff`fd932872 00000000`00000000 00000000`00000002 00007ff8`1b06e6f4 : user32!NtUserGetMessage+0xa

0000008b`66bdf750 00007ff8`1b06da3c : 00000083`42b242b0 00000083`434abe60 00000083`434abe60 00007fff`00000001 : user32!GetMessageA+0x44

0000008b`66bdf780 00007ff8`1b06e4d4 : 00007fff`fd932872 00000083`434abe60 00000083`434abe60 00000000`00000001 : mfc140!AfxInternalPumpMessage+0x2c

0000008b`66bdf7b0 00007ff8`1b06d986 : 00007fff`fd8e1d40 00000000`00000000 00000083`3e74eb10 00000083`434abe60 : mfc140!CWinThread::Run+0x84

0000008b`66bdf7f0 00007ff8`1f6af4a0 : 00000083`3e74eb10 00000083`434abe60 00000000`00000000 00000083`40b986a0 : mfc140!_AfxThreadEntry+0x146

0000008b`66bdf930 00007ff8`2e0513f2 : 00000000`00000000 00007ff8`1f6af460 00000000`00000000 00000000`00000000 : ucrtbase!thread_start<unsigned int (__cdecl*)(void * __ptr64)>+0x40

0000008b`66bdf960 00007ff8`303a54f4 : 00007ff8`2e0513d0 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x22

0000008b`66bdf990 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x34

 

 

THREAD_SHA1_HASH_MOD_FUNC:  f3b1319d233bd8f48115aa33d6ed15b3350b084e

 

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  3ae38e11adb41cb2d3a6be6309ac011c26e74d59

 

THREAD_SHA1_HASH_MOD:  27ffe611aa8af53a6af18761705d6bc3ec2c35d2

 

FOLLOWUP_IP:

AcroPDFImpl64.dll!Unloaded+47268

00000000`70de7268 ??              ???

 

SYMBOL_STACK_INDEX:  0

 

SYMBOL_NAME:  AcroPDFImpl64.dll!Unloaded+47268

 

FOLLOWUP_NAME:  MachineOwner

 

MODULE_NAME: AcroPDFImpl64

 

IMAGE_NAME:  AcroPDFImpl64.dll

 

DEBUG_FLR_IMAGE_TIMESTAMP:  5507d127

 

STACK_COMMAND:  ~21s ; .ecxr ; kb

 

FAILURE_BUCKET_ID:  BAD_INSTRUCTION_PTR_NOSOS_c000041d_AcroPDFImpl64.dll!Unloaded

 

BUCKET_ID:  BAD_INSTRUCTION_PTR_NOSOS_AcroPDFImpl64.dll!Unloaded+47268

 

FAILURE_EXCEPTION_CODE:  c000041d

 

FAILURE_IMAGE_NAME:  AcroPDFImpl64.dll

 

BUCKET_ID_IMAGE_STR:  AcroPDFImpl64.dll

 

FAILURE_MODULE_NAME:  AcroPDFImpl64

 

BUCKET_ID_MODULE_STR:  AcroPDFImpl64

 

FAILURE_FUNCTION_NAME:  Unloaded

 

BUCKET_ID_FUNCTION_STR:  Unloaded

 

BUCKET_ID_OFFSET:  47268

 

BUCKET_ID_MODTIMEDATESTAMP:  5507d127

 

BUCKET_ID_MODCHECKSUM:  104b7f

 

BUCKET_ID_MODVER_STR:  0.0.0.0

 

BUCKET_ID_PREFIX_STR:  BAD_INSTRUCTION_PTR_NOSOS_

 

FAILURE_PROBLEM_CLASS:  BAD_INSTRUCTION_PTR

 

FAILURE_SYMBOL_NAME:  AcroPDFImpl64.dll!Unloaded

 

TARGET_TIME:  2020-01-16T21:50:41.000Z

 

OSBUILD:  9600

 

OSSERVICEPACK:  19358

 

SERVICEPACK_NUMBER: 0

 

OS_REVISION: 0

 

SUITE_MASK:  144

 

PRODUCT_TYPE:  3

 

OSPLATFORM_TYPE:  x64

 

OSNAME:  Windows 8.1

 

OSEDITION:  Windows 8.1 Server TerminalServer DataCenter

 

USER_LCID:  0

 

OSBUILD_TIMESTAMP:  2019-05-05 21:41:50

 

BUILDDATESTAMP_STR:  160124-0053

 

BUILDLAB_STR:  winblue_ltsb

 

BUILDOSVER_STR:  6.3.9600.18217

 

ANALYSIS_SESSION_ELAPSED_TIME:  52f3

 

ANALYSIS_SOURCE:  UM

 

FAILURE_ID_HASH_STRING:  um:bad_instruction_ptr_nosos_c000041d_acropdfimpl64.dll!unloaded

 

FAILURE_ID_HASH:  {1c4b2a78-db07-ece0-9026-36165c10dd55}

 

Followup:     MachineOwner

---------

 

Timeline: Process.Start

    Name: <blank>

    Time: 2020-01-16T21:46:36.0Z

    Diff: 245000 mSec

 

 

DUMP_CLASS: 2

 

DUMP_QUALIFIER: 400

 

CONTEXT:  (.ecxr)

rax=0000008b66bdf4f0 rbx=00007ff82d721980 rcx=0000000000060354

rdx=0000000000000219 rsi=0000008b66bded80 rdi=0000008b66bdf270

rip=0000000071067268 rsp=0000008b66bdf488 rbp=0000008b66bdf640

r8=0000000000000007  r9=0000000000000000 r10=0000000000060354

r11=0000000000000246 r12=0000000000000007 r13=0000000000000000

r14=0000000000000000 r15=0000000071067268

iopl=0         nv up ei pl zr na po nc

cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010244

AcroPDFImpl64+0x47268:

00000000`71067268 ??              ???

Resetting default scope

 

FAULTING_IP:

AcroPDFImpl64.dll!Unloaded+47268

00000000`71067268 ??              ???

 

EXCEPTION_RECORD:  (.exr -1)

ExceptionAddress: 0000000071067268 (AcroPDFImpl64+0x0000000000047268)

   ExceptionCode: c000041d

  ExceptionFlags: 00000001

NumberParameters: 0

 

ERROR_CODE: (NTSTATUS) 0xc000041d - An unhandled exception was encountered during a user callback.

 

EXCEPTION_CODE: (NTSTATUS) 0xc000041d - An unhandled exception was encountered during a user callback.

 

EXCEPTION_CODE_STR:  c000041d

 

WATSON_BKT_PROCSTAMP:  5200b07b

 

WATSON_BKT_PROCVER:  8.0.0.20

 

WATSON_BKT_MODULE:  unknown

 

WATSON_BKT_MODVER:  0.0.0.0

 

WATSON_BKT_MODOFFSET:  71067268

 

BUILD_VERSION_STRING:  6.3.9600.18217 (winblue_ltsb.160124-0053)

 

MODLIST_WITH_TSCHKSUM_HASH:  773766f70c710170b94564e6c0dc54913e4bbd14

 

MODLIST_SHA1_HASH:  6a32fcfce81b1f3c463b25db95643730c78ad69a

 

NTGLOBALFLAG:  400

 

PROCESS_BAM_CURRENT_THROTTLED: 0

 

PROCESS_BAM_PREVIOUS_THROTTLED: 0

 

DUMP_FLAGS:  c8e

 

DUMP_TYPE:  1

 

PROCESS_NAME:  unknown

 

MISSING_CLR_SYMBOL: 0

 

ANALYSIS_SESSION_HOST:  2UA7491L7N

 

ANALYSIS_SESSION_TIME:  01-22-2020 13:30:20.0116

 

ANALYSIS_VERSION: 10.0.17763.132 amd64fre

 

MANAGED_CODE: 1

 

MANAGED_ENGINE_MODULE:  clr

 

MANAGED_ANALYSIS_PROVIDER:  SOS

 

THREAD_ATTRIBUTES:

OS_LOCALE:  ENU

 

ADDITIONAL_DEBUG_TEXT:  SOS.DLL is not loaded for managed code. Analysis might be incomplete

 

BUGCHECK_STR:  BAD_INSTRUCTION_PTR_NOSOS

 

DEFAULT_BUCKET_ID:  BAD_INSTRUCTION_PTR_NOSOS

 

PRIMARY_PROBLEM_CLASS:  BAD_INSTRUCTION_PTR

 

PROBLEM_CLASSES:

 

    ID:     [0n296]

    Type:   [BAD_INSTRUCTION_PTR]

    Class:  Primary

    Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)

            BUCKET_ID

    Name:   Add

    Data:   Omit

    PID:    [0x545c]

    TID:    [0x56f4]

    Frame:  [0] : AcroPDFImpl64.dll!Unloaded

 

    ID:     [0n251]

    Type:   [NOSOS]

    Class:  Addendum

    Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)

            BUCKET_ID

    Name:   Add

    Data:   Omit

    PID:    [Unspecified]

    TID:    [Unspecified]

    Frame:  [0]

 

LAST_CONTROL_TRANSFER:  from 00007ff82dc924fd to 0000000071067268

 

STACK_TEXT: 

0000008b`66bdf488 00007ff8`2dc924fd : 00000000`00000001 00000000`00000001 00000000`00000219 00000000`000301f0 : AcroPDFImpl64+0x47268

0000008b`66bdf490 00007ff8`2dc93902 : 00000000`00000000 00000000`00000000 00000000`00060354 00000000`00000000 : user32!UserCallWinProcCheckWow+0x149

0000008b`66bdf560 00007ff8`2dcb2fa2 : 00007ff8`30420680 0000008b`66bdf6d8 00000000`00000000 00000000`00000113 : user32!DispatchClientMessage+0xa2

0000008b`66bdf5c0 00007ff8`304225c4 : 00000083`436342c8 00000000`00000000 00000000`00000000 00000000`00000000 : user32!__fnINDEVICECHANGE+0x72

0000008b`66bdf680 00007ff8`2dc926ba : 00007ff8`2dc96104 00007fff`fd932872 00000000`00000000 00000000`00000002 : ntdll!KiUserCallbackDispatcherContinue

0000008b`66bdf748 00007ff8`2dc96104 : 00007fff`fd932872 00000000`00000000 00000000`00000002 00007ff8`1b06e6f4 : user32!NtUserGetMessage+0xa

0000008b`66bdf750 00007ff8`1b06da3c : 00000083`42b242b0 00000083`434abe60 00000083`434abe60 00007fff`00000001 : user32!GetMessageA+0x44

0000008b`66bdf780 00007ff8`1b06e4d4 : 00007fff`fd932872 00000083`434abe60 00000083`434abe60 00000000`00000001 : mfc140!AfxInternalPumpMessage+0x2c

0000008b`66bdf7b0 00007ff8`1b06d986 : 00007fff`fd8e1d40 00000000`00000000 00000083`3e74eb10 00000083`434abe60 : mfc140!CWinThread::Run+0x84

0000008b`66bdf7f0 00007ff8`1f6af4a0 : 00000083`3e74eb10 00000083`434abe60 00000000`00000000 00000083`40b986a0 : mfc140!_AfxThreadEntry+0x146

0000008b`66bdf930 00007ff8`2e0513f2 : 00000000`00000000 00007ff8`1f6af460 00000000`00000000 00000000`00000000 : ucrtbase!thread_start<unsigned int (__cdecl*)(void * __ptr64)>+0x40

0000008b`66bdf960 00007ff8`303a54f4 : 00007ff8`2e0513d0 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0x22

0000008b`66bdf990 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x34

 

 

THREAD_SHA1_HASH_MOD_FUNC:  f3b1319d233bd8f48115aa33d6ed15b3350b084e

 

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  3ae38e11adb41cb2d3a6be6309ac011c26e74d59

 

THREAD_SHA1_HASH_MOD:  27ffe611aa8af53a6af18761705d6bc3ec2c35d2

 

FOLLOWUP_IP:

AcroPDFImpl64.dll!Unloaded+47268

00000000`70de7268 ??              ???

 

SYMBOL_STACK_INDEX:  0

 

SYMBOL_NAME:  AcroPDFImpl64.dll!Unloaded+47268

 

FOLLOWUP_NAME:  MachineOwner

 

MODULE_NAME: AcroPDFImpl64

 

IMAGE_NAME:  AcroPDFImpl64.dll

 

DEBUG_FLR_IMAGE_TIMESTAMP:  5507d127

 

STACK_COMMAND:  ~21s ; .ecxr ; kb

 

FAILURE_BUCKET_ID:  BAD_INSTRUCTION_PTR_NOSOS_c000041d_AcroPDFImpl64.dll!Unloaded

 

BUCKET_ID:  BAD_INSTRUCTION_PTR_NOSOS_AcroPDFImpl64.dll!Unloaded+47268

 

FAILURE_EXCEPTION_CODE:  c000041d

 

FAILURE_IMAGE_NAME:  AcroPDFImpl64.dll

 

BUCKET_ID_IMAGE_STR:  AcroPDFImpl64.dll

 

FAILURE_MODULE_NAME:  AcroPDFImpl64

 

BUCKET_ID_MODULE_STR:  AcroPDFImpl64

 

FAILURE_FUNCTION_NAME:  Unloaded

 

BUCKET_ID_FUNCTION_STR:  Unloaded

 

BUCKET_ID_OFFSET:  47268

 

BUCKET_ID_MODTIMEDATESTAMP:  5507d127

 

BUCKET_ID_MODCHECKSUM:  104b7f

 

BUCKET_ID_MODVER_STR:  0.0.0.0

 

BUCKET_ID_PREFIX_STR:  BAD_INSTRUCTION_PTR_NOSOS_

 

FAILURE_PROBLEM_CLASS:  BAD_INSTRUCTION_PTR

 

FAILURE_SYMBOL_NAME:  AcroPDFImpl64.dll!Unloaded

 

TARGET_TIME:  2020-01-16T21:50:41.000Z

 

OSBUILD:  9600

 

OSSERVICEPACK:  19358

 

SERVICEPACK_NUMBER: 0

 

OS_REVISION: 0

 

SUITE_MASK:  144

 

PRODUCT_TYPE:  3

 

OSPLATFORM_TYPE:  x64

 

OSNAME:  Windows 8.1

 

OSEDITION:  Windows 8.1 Server TerminalServer DataCenter

 

USER_LCID:  0

 

OSBUILD_TIMESTAMP:  2019-05-05 21:41:50

 

BUILDDATESTAMP_STR:  160124-0053

 

BUILDLAB_STR:  winblue_ltsb

 

BUILDOSVER_STR:  6.3.9600.18217

 

ANALYSIS_SESSION_ELAPSED_TIME:  52f3

 

ANALYSIS_SOURCE:  UM

 

FAILURE_ID_HASH_STRING:  um:bad_instruction_ptr_nosos_c000041d_acropdfimpl64.dll!unloaded

 

FAILURE_ID_HASH:  {1c4b2a78-db07-ece0-9026-36165c10dd55}

 

Followup:     MachineOwner

---------

 

 

This topic has been closed for replies.
Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices