Hi, please upload the actual minidumps from the C:\Windows\minidump folder as I can get more information from them such as the full driver list.
Microsoft (R) Windows Debugger Version 10.0.19528.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Windows\MEMORY.DMP]
Kernel Bitmap Dump File: Kernel address space is available, User address space may not be available.
* Path validation summary
**
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 17763 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
17763.1.amd64fre.rs5_release.180914-1434
Machine Name:
Kernel base = 0xfffff800
3acb1000 PsLoadedModuleList = 0xfffff8003b0cb6f0
Debug session time: Tue Jun 2 13:42:05.520 2020 (UTC + 1:00)
System Uptime: 0 days 0:22:28.198
Loading Kernel Symbols
....................................Page 20081cbd6 too large to be in the dump file.
Page 20081cbd5 too large to be in the dump file.
...........................
................................................................
.................................................
Loading User Symbols
PEB is paged out (Peb.Ldr = 00000000
011c7018). Type ".hh dbgerr001" for details
Loading unloaded module list
.............
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff8003ae68ab0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff308
9a30f270=0000000000000050
1: kd> !analyze -v
*******************************************************************************
[LIST]
[*]*
[*]Bugcheck Analysis *
[*]*
[/LIST]
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: fffff63cc45ae770, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff697dae386ef, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Page 20081a87a too large to be in the dump file.
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 2
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-U38I538
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.Sec
Value: 10
Key : Analysis.Memory.CommitPeak.Mb
Value: 65
Key : Analysis.System
Value: CreateObject
ADDITIONAL_XML: 1
BUGCHECK_CODE: 50
BUGCHECK_P1: fffff63cc45ae770
BUGCHECK_P2: 0
BUGCHECK_P3: fffff697dae386ef
BUGCHECK_P4: 2
READ_ADDRESS: fffff63cc45ae770
MM_INTERNAL_CODE: 2
IMAGE_NAME: win32kfull.sys
MODULE_NAME: win32kfull
FAULTING_MODULE: fffff697dae00000 win32kfull
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXPNP: 1 (!blackboxpnp)
PROCESS_NAME: iCUE.exe
TRAP_FRAME: fffff3089a30f550 -- (.trap 0xfffff3089a30f550)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff6b6c62518a0 rbx=0000000000000000 rcx=fffff63cc45ae730
rdx=0000000000000003 rsi=0000000000000000 rdi=0000000000000000
rip=fffff697dae386ef rsp=fffff3089a30f6e0 rbp=fffff3089a30fa80
r8=0000000000000003 r9=0000000000000001 r10=0000000000000003
r11=fffff3089a30f920 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
win32kfull!PhkFirstValid+0x17:
fffff697dae386ef 8b4140 mov eax,dword ptr [rcx+40h] ds:fffff63c
c45ae770=????????
Resetting default scope
STACK_TEXT:
fffff3089a30f268 fffff800
3ae94b73 : 0000000000000050 fffff63c
c45ae770 0000000000000000 fffff308
9a30f550 : nt!KeBugCheckEx
fffff3089a30f270 fffff800
3ad61c68 : 0000000000000000 ffff8000
00000000 0000000000003dff fffff63c
c45ae770 : nt!MiSystemFault+0x1b9673
fffff3089a30f3b0 fffff800
3ae765c9 : 0000000000000000 00000000
00000000 0000000000000000 00000000
00000000 : nt!MmAccessFault+0x1d8
fffff3089a30f550 fffff697
dae386ef : ffffdf83abed7710 fffff800
3ad6f0de ffffc9f1559e898b fffff697
db1a334b : nt!KiPageFault+0x349
fffff3089a30f6e0 fffff697
daf4eeff : fffff3089a30f920 00000000
00000400 0000000000000000 00000000
00000001 : win32kfull!PhkFirstValid+0x17
fffff3089a30f710 fffff697
dae6ba2f : fffff6b6c62518a0 fffff308
9a30fa80 0000000000003dff 00000000
00060001 : win32kfull!xxxCallHook+0x57
fffff3089a30f750 fffff697
dae6a9b7 : fffff3089a30f920 fffff308
9a303dbf 0000000000000000 00000000
00000f33 : win32kfull!xxxRealInternalGetMessage+0xfff
fffff3089a30f8e0 fffff800
3ae7a23e : 0000000000f1e0c0 ffffdf83
b09a2080 fffff3089a30f9a8 00000000
011c9000 : win32kfull!NtUserPeekMessage+0x157
fffff3089a30f990 00007ffc
0304f4e4 : 0000000000000000 00000000
00000000 0000000000000000 00000000
00000000 : nt!KiSystemServiceExitPico+0x2b9
0000000000f1e088 00000000
00000000 : 0000000000000000 00000000
00000000 0000000000000000 00000000
00000000 : 0x00007ffc0304f4e4
SYMBOL_NAME: win32kfull!PhkFirstValid+17
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 17
FAILURE_BUCKET_ID: AV_R_INVALID_win32kfull!PhkFirstValid
OS_VERSION: 10.0.17763.1
BUILDLAB_STR: rs5_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {8745698e-47c5-9b39-b84d-d9bbc955dbf1}
Followup: MachineOwner
---------
that is all we got, since it has changed in that more detailed folder, because since last night it has occured again. Thank you for your time and help <3
Facebook
Twitter
Instagram