Explorer sometimes crashes
Posted: Thu Oct 18, 2018 7:22 am
Explorer sometimes crashes when you view files or display thumbnails and when copying files .
How can I check which process or application causes this problem and solve this problem?
Note: Advanced diagnosing methods found on Microsoft page, with the entire list, have failed, so I am asking here.
When the Windows Explorer crashes, Windows Error Reporting Service [1] creates a dmp file under C:\Localdumps
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\Explorer.exe]
"DumpFolder"=hex(2):43,00,3a,00,5c,00,4c,00,6f,00,63,00,61,00,6c,00,44,00,75,\
00,6d,00,70,00,73,00,00,00
"DumpType"=dword:00000002
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe]
"GlobalFlag"=dword:02000100
"PageHeapFlags"=dword:00000003
Microsoft (R) Windows Debugger Version 10.0.16299.15 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\MOJA\AppData\Local\CrashDumps\explorer.exe.9668.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available
Symbol search path is: srv*
Executable search path is:
Windows 7 Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: SingleUserTS
Machine Name:
Debug session time: Thu Oct 18 09:05:45.000 2018 (UTC + 2:00)
System Uptime: not available
Process Uptime: 0 days 5:50:19.000
................................................................
...............................................................
Loading unloaded module list
................................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(25c4.2ea0): Access violation - code c0000005 (first/second chance not available)
ntdll!NtWaitForMultipleObjects+0xa:
00000000`76f99e3a c3 ret
0:005> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
GetUrlPageData2 (WinHttp) failed: 12002.
DUMP_CLASS: 2
DUMP_QUALIFIER: 400
CONTEXT: (.ecxr)
rax=0000000015e9f390 rbx=0000000000000000 rcx=00000000000c0eee
rdx=0000000000000219 rsi=0000000000000001 rdi=0000000000000000
rip=0000000016510fd8 rsp=0000000015e9f328 rbp=0000000000000000
r8=0000000000000007 r9=0000000000000000 r10=00000000000c0eee
r11=000000000039a148 r12=0000000000000000 r13=0000000000000219
r14=000000000039a148 r15=00000000000c0eee
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
00000000`16510fd8 ?? ???
Resetting default scope
FAULTING_IP:
+0
00000000`16510fd8 ?? ???
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 0000000016510fd8
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000008
Parameter[1]: 0000000016510fd8
Attempt to execute non-executable address 0000000016510fd8
DEFAULT_BUCKET_ID: SOFTWARE_NX_FAULT
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000008
EXCEPTION_PARAMETER2: 0000000016510fd8
FOLLOWUP_IP:
duser!CoreSC::xwProcessNL+173
000007fe`f56210f4 33d2 xor edx,edx
EXECUTE_ADDRESS: 16510fd8
FAILED_INSTRUCTION_ADDRESS:
+0
00000000`16510fd8 ?? ???
WATSON_BKT_PROCSTAMP: 57c44efe
WATSON_BKT_PROCVER: 6.1.7601.23537
PROCESS_VER_PRODUCT: Microsoft® Windows® Operating System
WATSON_BKT_MODULE: unknown
WATSON_BKT_MODVER: 0.0.0.0
WATSON_BKT_MODOFFSET: 16510fd8
WATSON_BKT_MODSTAMP: bbbbbbb4
BUILD_VERSION_STRING: 6.1.7601.24260 (win7sp1_ldr.180908-0600)
MODLIST_WITH_TSCHKSUM_HASH: 525b1599354cd64041d168d53c525daf496e4e3e
MODLIST_SHA1_HASH: 90f4f716c7206b4cf01be4ff6c79ff051e786898
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
DUMP_FLAGS: 94
DUMP_TYPE: 1
ANALYSIS_SESSION_HOST: KOMPUTER
ANALYSIS_SESSION_TIME: 10-18-2018 09:12:48.0235
ANALYSIS_VERSION: 10.0.16299.15 amd64fre
THREAD_ATTRIBUTES:
OS_LOCALE: PLK
PROBLEM_CLASSES:
ID: [0n301]
Type: [@ACCESS_VIOLATION]
Class: Addendum
Scope: BUCKET_ID
Name: Omit
Data: Omit
PID: [Unspecified]
TID: [0x2ea0]
Frame: [0] : unknown!unknown
ID: [0n275]
Type: [INVALID_POINTER_EXECUTE]
Class: Primary
Scope: BUCKET_ID
Name: Add
Data: Omit
PID: [Unspecified]
TID: [0x2ea0]
Frame: [0] : unknown!unknown
ID: [0n283]
Type: [SOFTWARE_NX_FAULT]
Class: Primary
Scope: DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
BUCKET_ID
Name: Add
Data: Omit
PID: [0x25c4]
TID: [0x2ea0]
Frame: [0] : unknown!unknown
BUGCHECK_STR: APPLICATION_FAULT_SOFTWARE_NX_FAULT_INVALID_POINTER_EXECUTE
PRIMARY_PROBLEM_CLASS: APPLICATION_FAULT
IP_ON_HEAP: 0000000016510fd8
The fault address in not in any loaded module, please check your build's rebase
log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may
contain the address if it were loaded.
LAST_CONTROL_TRANSFER: from 0000000076d29bbd to 0000000016510fd8
STACK_TEXT:
00000000`15e9f328 00000000`76d29bbd : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`155638c0 : 0x16510fd8
00000000`15e9f330 00000000`76d2729b : 00000000`15e9f568 00000000`16510fd8 00000000`00000000 00000000`00000000 : user32!UserCallWinProcCheckWow+0x1ad
00000000`15e9f3f0 00000000`76d15a62 : 00000000`003c1d60 000007fe`fcb31430 00000000`15f51bb8 00000000`003c1d60 : user32!DispatchClientMessage+0xc3
00000000`15e9f450 00000000`76f9b5cf : 00000000`003bd720 00000000`00000000 00000000`00000000 000007fe`fceb35a6 : user32!_fnINDEVICECHANGE+0x39c
00000000`15e9f510 00000000`76d2913a : 000007fe`f56210f4 00000000`15e9f6c0 00000000`76d28f99 00000000`15e9f620 : ntdll!KiUserCallbackDispatcherContinue
00000000`15e9f5d8 000007fe`f56210f4 : 00000000`15e9f6c0 00000000`76d28f99 00000000`15e9f620 00000000`ffffffff : user32!NtUserRealInternalGetMessage+0xa
00000000`15e9f5e0 000007fe`f56211fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : duser!CoreSC::xwProcessNL+0x173
00000000`15e9f650 00000000`76d29181 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`76d29bdb : duser!MphProcessMessage+0xbd
00000000`15e9f6b0 00000000`76f9b5cf : 00000000`00000000 00000000`76d29368 00000000`00000000 00000000`76d29b2f : user32!_ClientGetMessageMPH+0x3d
00000000`15e9f740 00000000`76d2908a : 00000000`76d29059 00000000`15e9f7f8 0000004f`00000008 00000000`76d2932a : ntdll!KiUserCallbackDispatcherContinue
00000000`15e9f7b8 00000000`76d29059 : 00000000`15e9f7f8 0000004f`00000008 00000000`76d2932a 00000000`76d29702 : user32!ZwUserPeekMessage+0xa
00000000`15e9f7c0 000007fe`e511085e : 00000000`15fc4c04 00000000`15fc4cc0 00000000`00000000 00000000`00000000 : user32!PeekMessageW+0x105
00000000`15e9f810 000007fe`e5114d89 : 00000000`15fc4cc0 00000000`00000013 00000000`00000000 00000000`00000000 : EXPLORERFRAME!CExplorerFrame::FrameMessagePump+0x5a
00000000`15e9f890 000007fe`e51154fb : 00000000`15fc4cc0 00000000`1512bff0 00000000`00000000 00000000`00000000 : EXPLORERFRAME!BrowserThreadProc+0x180
00000000`15e9f910 000007fe`e5115492 : 17f32b32`00000001 00000000`15fe9c30 00000000`15e9fa08 000007fe`fcb3b5a0 : EXPLORERFRAME!BrowserNewThreadProc+0x53
00000000`15e9f940 000007fe`e510be90 : 00000000`1557af00 00000000`003c28d0 00000000`00000000 00000000`000001b8 : EXPLORERFRAME!CExplorerTask::InternalResumeRT+0x12
00000000`15e9f970 000007fe`fd79efb7 : 80000000`01000000 00000000`15e9fa00 ffffffff`fffffffe 00000000`0000000b : EXPLORERFRAME!CRunnableTask::Run+0xda
00000000`15e9f9a0 000007fe`fd79eef7 : 00000000`1557af80 00000000`1611fd30 ffffffff`fffffffe 000007fe`fd2407e4 : shell32!CShellTask::TT_Run+0x124
00000000`15e9f9d0 000007fe`fd7a2bb2 : 00000000`1557af80 00000000`1557af80 00000000`00000000 00000000`00000010 : shell32!CShellTaskThread::ThreadProc+0xd0
00000000`15e9fa70 000007fe`ff0ac71e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : shell32!CShellTaskThread::s_ThreadProc+0x26
00000000`15e9faa0 00000000`76e259cd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : shlwapi!WrapperThreadProc+0x19b
00000000`15e9fba0 00000000`76f8385d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0xd
00000000`15e9fbd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d
THREAD_SHA1_HASH_MOD_FUNC: da5bffcc33f2bafbba02948bfdd78e36009d2a2d
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 38fcc11961b4bc87e57d274027de761e30cf4598
THREAD_SHA1_HASH_MOD: 6d61e634c2a91644881791475c3b5265fa3ac4c0
FAULT_INSTR_CODE: d88bd233
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: duser!CoreSC::xwProcessNL+173
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: duser
IMAGE_NAME: duser.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bdf26
STACK_COMMAND: ~5s ; .ecxr ; kb
FAILURE_BUCKET_ID: SOFTWARE_NX_FAULT_c0000005_duser.dll!CoreSC::xwProcessNL
BUCKET_ID: X64_APPLICATION_FAULT_SOFTWARE_NX_FAULT_INVALID_POINTER_EXECUTE_BAD_IP_duser!CoreSC::xwProcessNL+173
FAILURE_EXCEPTION_CODE: c0000005
FAILURE_IMAGE_NAME: duser.dll
BUCKET_ID_IMAGE_STR: duser.dll
FAILURE_MODULE_NAME: duser
BUCKET_ID_MODULE_STR: duser
FAILURE_FUNCTION_NAME: CoreSC::xwProcessNL
BUCKET_ID_FUNCTION_STR: CoreSC::xwProcessNL
BUCKET_ID_OFFSET: 173
BUCKET_ID_MODTIMEDATESTAMP: 4a5bdf26
BUCKET_ID_MODCHECKSUM: 489a3
BUCKET_ID_MODVER_STR: 6.1.7600.16385
BUCKET_ID_PREFIX_STR: X64_APPLICATION_FAULT_SOFTWARE_NX_FAULT_INVALID_POINTER_EXECUTE_BAD_IP_
FAILURE_PROBLEM_CLASS: APPLICATION_FAULT
FAILURE_SYMBOL_NAME: duser.dll!CoreSC::xwProcessNL
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/ex ... Retriage=1
TARGET_TIME: 2018-10-18T07:05:45.000Z
OSBUILD: 7601
OSSERVICEPACK: 24260
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 256
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 7
OSEDITION: Windows 7 WinNt (Service Pack 1) SingleUserTS
USER_LCID: 0
OSBUILD_TIMESTAMP: 2018-09-09 03:01:39
BUILDDATESTAMP_STR: 180908-0600
BUILDLAB_STR: win7sp1_ldr
BUILDOSVER_STR: 6.1.7601.24260
ANALYSIS_SESSION_ELAPSED_TIME: ce8a
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:software_nx_fault_c0000005_duser.dll!coresc::xwprocessnl
FAILURE_ID_HASH: {d1cce4a6-6e7b-bdc3-af00-bcf298405279}
Followup: MachineOwner
---------
How can I check which process or application causes this problem and solve this problem?
Note: Advanced diagnosing methods found on Microsoft page, with the entire list, have failed, so I am asking here.
When the Windows Explorer crashes, Windows Error Reporting Service [1] creates a dmp file under C:\Localdumps
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\Explorer.exe]
"DumpFolder"=hex(2):43,00,3a,00,5c,00,4c,00,6f,00,63,00,61,00,6c,00,44,00,75,\
00,6d,00,70,00,73,00,00,00
"DumpType"=dword:00000002
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe]
"GlobalFlag"=dword:02000100
"PageHeapFlags"=dword:00000003
Microsoft (R) Windows Debugger Version 10.0.16299.15 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\MOJA\AppData\Local\CrashDumps\explorer.exe.9668.dmp]
User Mini Dump File: Only registers, stack and portions of memory are available
Symbol search path is: srv*
Executable search path is:
Windows 7 Version 7601 (Service Pack 1) MP (4 procs) Free x64
Product: WinNt, suite: SingleUserTS
Machine Name:
Debug session time: Thu Oct 18 09:05:45.000 2018 (UTC + 2:00)
System Uptime: not available
Process Uptime: 0 days 5:50:19.000
................................................................
...............................................................
Loading unloaded module list
................................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(25c4.2ea0): Access violation - code c0000005 (first/second chance not available)
ntdll!NtWaitForMultipleObjects+0xa:
00000000`76f99e3a c3 ret
0:005> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
GetUrlPageData2 (WinHttp) failed: 12002.
DUMP_CLASS: 2
DUMP_QUALIFIER: 400
CONTEXT: (.ecxr)
rax=0000000015e9f390 rbx=0000000000000000 rcx=00000000000c0eee
rdx=0000000000000219 rsi=0000000000000001 rdi=0000000000000000
rip=0000000016510fd8 rsp=0000000015e9f328 rbp=0000000000000000
r8=0000000000000007 r9=0000000000000000 r10=00000000000c0eee
r11=000000000039a148 r12=0000000000000000 r13=0000000000000219
r14=000000000039a148 r15=00000000000c0eee
iopl=0 nv up ei pl zr na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
00000000`16510fd8 ?? ???
Resetting default scope
FAULTING_IP:
+0
00000000`16510fd8 ?? ???
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 0000000016510fd8
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000008
Parameter[1]: 0000000016510fd8
Attempt to execute non-executable address 0000000016510fd8
DEFAULT_BUCKET_ID: SOFTWARE_NX_FAULT
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000008
EXCEPTION_PARAMETER2: 0000000016510fd8
FOLLOWUP_IP:
duser!CoreSC::xwProcessNL+173
000007fe`f56210f4 33d2 xor edx,edx
EXECUTE_ADDRESS: 16510fd8
FAILED_INSTRUCTION_ADDRESS:
+0
00000000`16510fd8 ?? ???
WATSON_BKT_PROCSTAMP: 57c44efe
WATSON_BKT_PROCVER: 6.1.7601.23537
PROCESS_VER_PRODUCT: Microsoft® Windows® Operating System
WATSON_BKT_MODULE: unknown
WATSON_BKT_MODVER: 0.0.0.0
WATSON_BKT_MODOFFSET: 16510fd8
WATSON_BKT_MODSTAMP: bbbbbbb4
BUILD_VERSION_STRING: 6.1.7601.24260 (win7sp1_ldr.180908-0600)
MODLIST_WITH_TSCHKSUM_HASH: 525b1599354cd64041d168d53c525daf496e4e3e
MODLIST_SHA1_HASH: 90f4f716c7206b4cf01be4ff6c79ff051e786898
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
DUMP_FLAGS: 94
DUMP_TYPE: 1
ANALYSIS_SESSION_HOST: KOMPUTER
ANALYSIS_SESSION_TIME: 10-18-2018 09:12:48.0235
ANALYSIS_VERSION: 10.0.16299.15 amd64fre
THREAD_ATTRIBUTES:
OS_LOCALE: PLK
PROBLEM_CLASSES:
ID: [0n301]
Type: [@ACCESS_VIOLATION]
Class: Addendum
Scope: BUCKET_ID
Name: Omit
Data: Omit
PID: [Unspecified]
TID: [0x2ea0]
Frame: [0] : unknown!unknown
ID: [0n275]
Type: [INVALID_POINTER_EXECUTE]
Class: Primary
Scope: BUCKET_ID
Name: Add
Data: Omit
PID: [Unspecified]
TID: [0x2ea0]
Frame: [0] : unknown!unknown
ID: [0n283]
Type: [SOFTWARE_NX_FAULT]
Class: Primary
Scope: DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
BUCKET_ID
Name: Add
Data: Omit
PID: [0x25c4]
TID: [0x2ea0]
Frame: [0] : unknown!unknown
BUGCHECK_STR: APPLICATION_FAULT_SOFTWARE_NX_FAULT_INVALID_POINTER_EXECUTE
PRIMARY_PROBLEM_CLASS: APPLICATION_FAULT
IP_ON_HEAP: 0000000016510fd8
The fault address in not in any loaded module, please check your build's rebase
log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may
contain the address if it were loaded.
LAST_CONTROL_TRANSFER: from 0000000076d29bbd to 0000000016510fd8
STACK_TEXT:
00000000`15e9f328 00000000`76d29bbd : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`155638c0 : 0x16510fd8
00000000`15e9f330 00000000`76d2729b : 00000000`15e9f568 00000000`16510fd8 00000000`00000000 00000000`00000000 : user32!UserCallWinProcCheckWow+0x1ad
00000000`15e9f3f0 00000000`76d15a62 : 00000000`003c1d60 000007fe`fcb31430 00000000`15f51bb8 00000000`003c1d60 : user32!DispatchClientMessage+0xc3
00000000`15e9f450 00000000`76f9b5cf : 00000000`003bd720 00000000`00000000 00000000`00000000 000007fe`fceb35a6 : user32!_fnINDEVICECHANGE+0x39c
00000000`15e9f510 00000000`76d2913a : 000007fe`f56210f4 00000000`15e9f6c0 00000000`76d28f99 00000000`15e9f620 : ntdll!KiUserCallbackDispatcherContinue
00000000`15e9f5d8 000007fe`f56210f4 : 00000000`15e9f6c0 00000000`76d28f99 00000000`15e9f620 00000000`ffffffff : user32!NtUserRealInternalGetMessage+0xa
00000000`15e9f5e0 000007fe`f56211fa : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : duser!CoreSC::xwProcessNL+0x173
00000000`15e9f650 00000000`76d29181 : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`76d29bdb : duser!MphProcessMessage+0xbd
00000000`15e9f6b0 00000000`76f9b5cf : 00000000`00000000 00000000`76d29368 00000000`00000000 00000000`76d29b2f : user32!_ClientGetMessageMPH+0x3d
00000000`15e9f740 00000000`76d2908a : 00000000`76d29059 00000000`15e9f7f8 0000004f`00000008 00000000`76d2932a : ntdll!KiUserCallbackDispatcherContinue
00000000`15e9f7b8 00000000`76d29059 : 00000000`15e9f7f8 0000004f`00000008 00000000`76d2932a 00000000`76d29702 : user32!ZwUserPeekMessage+0xa
00000000`15e9f7c0 000007fe`e511085e : 00000000`15fc4c04 00000000`15fc4cc0 00000000`00000000 00000000`00000000 : user32!PeekMessageW+0x105
00000000`15e9f810 000007fe`e5114d89 : 00000000`15fc4cc0 00000000`00000013 00000000`00000000 00000000`00000000 : EXPLORERFRAME!CExplorerFrame::FrameMessagePump+0x5a
00000000`15e9f890 000007fe`e51154fb : 00000000`15fc4cc0 00000000`1512bff0 00000000`00000000 00000000`00000000 : EXPLORERFRAME!BrowserThreadProc+0x180
00000000`15e9f910 000007fe`e5115492 : 17f32b32`00000001 00000000`15fe9c30 00000000`15e9fa08 000007fe`fcb3b5a0 : EXPLORERFRAME!BrowserNewThreadProc+0x53
00000000`15e9f940 000007fe`e510be90 : 00000000`1557af00 00000000`003c28d0 00000000`00000000 00000000`000001b8 : EXPLORERFRAME!CExplorerTask::InternalResumeRT+0x12
00000000`15e9f970 000007fe`fd79efb7 : 80000000`01000000 00000000`15e9fa00 ffffffff`fffffffe 00000000`0000000b : EXPLORERFRAME!CRunnableTask::Run+0xda
00000000`15e9f9a0 000007fe`fd79eef7 : 00000000`1557af80 00000000`1611fd30 ffffffff`fffffffe 000007fe`fd2407e4 : shell32!CShellTask::TT_Run+0x124
00000000`15e9f9d0 000007fe`fd7a2bb2 : 00000000`1557af80 00000000`1557af80 00000000`00000000 00000000`00000010 : shell32!CShellTaskThread::ThreadProc+0xd0
00000000`15e9fa70 000007fe`ff0ac71e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : shell32!CShellTaskThread::s_ThreadProc+0x26
00000000`15e9faa0 00000000`76e259cd : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : shlwapi!WrapperThreadProc+0x19b
00000000`15e9fba0 00000000`76f8385d : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadInitThunk+0xd
00000000`15e9fbd0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x1d
THREAD_SHA1_HASH_MOD_FUNC: da5bffcc33f2bafbba02948bfdd78e36009d2a2d
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 38fcc11961b4bc87e57d274027de761e30cf4598
THREAD_SHA1_HASH_MOD: 6d61e634c2a91644881791475c3b5265fa3ac4c0
FAULT_INSTR_CODE: d88bd233
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: duser!CoreSC::xwProcessNL+173
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: duser
IMAGE_NAME: duser.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 4a5bdf26
STACK_COMMAND: ~5s ; .ecxr ; kb
FAILURE_BUCKET_ID: SOFTWARE_NX_FAULT_c0000005_duser.dll!CoreSC::xwProcessNL
BUCKET_ID: X64_APPLICATION_FAULT_SOFTWARE_NX_FAULT_INVALID_POINTER_EXECUTE_BAD_IP_duser!CoreSC::xwProcessNL+173
FAILURE_EXCEPTION_CODE: c0000005
FAILURE_IMAGE_NAME: duser.dll
BUCKET_ID_IMAGE_STR: duser.dll
FAILURE_MODULE_NAME: duser
BUCKET_ID_MODULE_STR: duser
FAILURE_FUNCTION_NAME: CoreSC::xwProcessNL
BUCKET_ID_FUNCTION_STR: CoreSC::xwProcessNL
BUCKET_ID_OFFSET: 173
BUCKET_ID_MODTIMEDATESTAMP: 4a5bdf26
BUCKET_ID_MODCHECKSUM: 489a3
BUCKET_ID_MODVER_STR: 6.1.7600.16385
BUCKET_ID_PREFIX_STR: X64_APPLICATION_FAULT_SOFTWARE_NX_FAULT_INVALID_POINTER_EXECUTE_BAD_IP_
FAILURE_PROBLEM_CLASS: APPLICATION_FAULT
FAILURE_SYMBOL_NAME: duser.dll!CoreSC::xwProcessNL
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/ex ... Retriage=1
TARGET_TIME: 2018-10-18T07:05:45.000Z
OSBUILD: 7601
OSSERVICEPACK: 24260
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 256
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 7
OSEDITION: Windows 7 WinNt (Service Pack 1) SingleUserTS
USER_LCID: 0
OSBUILD_TIMESTAMP: 2018-09-09 03:01:39
BUILDDATESTAMP_STR: 180908-0600
BUILDLAB_STR: win7sp1_ldr
BUILDOSVER_STR: 6.1.7601.24260
ANALYSIS_SESSION_ELAPSED_TIME: ce8a
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:software_nx_fault_c0000005_duser.dll!coresc::xwprocessnl
FAILURE_ID_HASH: {d1cce4a6-6e7b-bdc3-af00-bcf298405279}
Followup: MachineOwner
---------