0:000> !analyze -v ******************************************************************************* * * * Exception Analysis * * * ******************************************************************************* CONTEXT: (.ecxr) rax=0000000000000000 rbx=00000001d343bbe0 rcx=00000001054a0000 rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000 rip=00000001054b18f7 rsp=0000000000129880 rbp=0000000000129e90 r8=0000000000000000 r9=00000000002312f0 r10=0000000000000000 r11=0000000000000246 r12=00000001054b1ab0 r13=0000000000000000 r14=0000000000000001 r15=0000000000000000 iopl=0 nv up ei pl nz na pe nc cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010200 ActualMultipleMonitorsShellExtension64+0x118f7: 00000001`054b18f7 c6042510954e0501 mov byte ptr [<module name hidden>!_unep?_UninitializeDefaultDomainLanguageSupport<CrtImplementationDetails>$$FCAJPEAXZ+0x103ad8 (00000000`054e9510)],1 ds:00000000`054e9510=38 Resetting default scope FAULTING_IP: ActualMultipleMonitorsShellExtension64+118f7 00000001`054b18f7 c6042510954e0501 mov byte ptr [<module name hidden>!_unep?_UninitializeDefaultDomainLanguageSupport<CrtImplementationDetails>$$FCAJPEAXZ+0x103ad8 (00000000`054e9510)],1 EXCEPTION_RECORD: (.exr -1) ExceptionAddress: 00000001054b18f7 (ActualMultipleMonitorsShellExtension64+0x00000000000118f7) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000001 Parameter[1]: 00000000054e9510 Attempt to write to address 00000000054e9510 DEFAULT_BUCKET_ID: INVALID_POINTER_WRITE PROCESS_NAME: <process name hidden>.exe ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%08lx referenced memory at 0x%08lx. The memory could not be %s. EXCEPTION_PARAMETER1: 0000000000000001 EXCEPTION_PARAMETER2: 00000000054e9510 WRITE_ADDRESS: 00000000054e9510 FOLLOWUP_IP: ActualMultipleMonitorsShellExtension64+118f7 00000001`054b18f7 c6042510954e0501 mov byte ptr [<module name hidden>!_unep?_UninitializeDefaultDomainLanguageSupport<CrtImplementationDetails>$$FCAJPEAXZ+0x103ad8 (00000000`054e9510)],1 BUGCHECK_STR: INVALID_POINTER_WRITE NTGLOBALFLAG: 400 APPLICATION_VERIFIER_FLAGS: 0 APP: <process name hidden>.exe MISSING_CLR_SYMBOL: 0 ANALYSIS_VERSION: 10.0.10240.9 amd64fre MANAGED_CODE: 1 MANAGED_ENGINE_MODULE: clr MANAGED_ANALYSIS_PROVIDER: SOS IP_ON_HEAP: fffffffffffffffe The fault address in not in any loaded module, please check your build's rebase log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may contain the address if it were loaded. FRAME_ONE_INVALID: 1 LAST_CONTROL_TRANSFER: from fffffffffffffffe to 00000001054b18f7 STACK_TEXT: 00000000`00129880 ffffffff`fffffffe : 000007fe`fcf34cb0 000007fe`fcf45058 00000000`00000005 00005512`a8bc0018 : ActualMultipleMonitorsShellExtension64+0x118f7 00000000`00129888 000007fe`fcf34cb0 : 000007fe`fcf45058 00000000`00000005 00005512`a8bc0018 00000001`d346580a : 0xffffffff`fffffffe 00000000`00129890 000007fe`fcf45058 : 00000000`00000005 00005512`a8bc0018 00000001`d346580a 00000000`00000030 : MfApHook64!CtxHookApisEx2+0x32f30 00000000`00129898 00000000`00000005 : 00005512`a8bc0018 00000001`d346580a 00000000`00000030 00000000`00000004 : MfApHook64!CtxHookApisEx2+0x432d8 00000000`001298a0 00005512`a8bc0018 : 00000001`d346580a 00000000`00000030 00000000`00000004 00000000`001298a0 : 0x5 00000000`001298a8 00000001`d346580a : 00000000`00000030 00000000`00000004 00000000`001298a0 00000000`00000240 : 0x00005512`a8bc0018 00000000`001298b0 00000000`00000030 : 00000000`00000004 00000000`001298a0 00000000`00000240 00000000`00000000 : 0x00000001`d346580a 00000000`001298b8 00000000`00000004 : 00000000`001298a0 00000000`00000240 00000000`00000000 00000000`00000000 : 0x30 00000000`001298c0 00000000`001298a0 : 00000000`00000240 00000000`00000000 00000000`00000000 00000001`d343bc38 : 0x4 00000000`001298c8 00000000`00000240 : 00000000`00000000 00000000`00000000 00000001`d343bc38 00000000`7760055f : 0x1298a0 00000000`001298d0 00000000`00000000 : 00000000`00000000 00000001`d343bc38 00000000`7760055f 00000000`00129ba8 : 0x240 SYMBOL_STACK_INDEX: 0 SYMBOL_NAME: actualmultiplemonitorsshellextension64+118f7 FOLLOWUP_NAME: MachineOwner MODULE_NAME: ActualMultipleMonitorsShellExtension64 IMAGE_NAME: ActualMultipleMonitorsShellExtension64.dll DEBUG_FLR_IMAGE_TIMESTAMP: 0 STACK_COMMAND: .ecxr ; kb BUCKET_ID: X64_INVALID_POINTER_WRITE_actualmultiplemonitorsshellextension64+118f7 PRIMARY_PROBLEM_CLASS: X64_INVALID_POINTER_WRITE_actualmultiplemonitorsshellextension64+118f7 FAILURE_PROBLEM_CLASS: INVALID_POINTER_WRITE FAILURE_EXCEPTION_CODE: c0000005 FAILURE_IMAGE_NAME: ActualMultipleMonitorsShellExtension64.dll FAILURE_FUNCTION_NAME: Unknown FAILURE_SYMBOL_NAME: ActualMultipleMonitorsShellExtension64.dll!Unknown FAILURE_BUCKET_ID: INVALID_POINTER_WRITE_c0000005_ActualMultipleMonitorsShellExtension64.dll!Unknown ANALYSIS_SOURCE: UM FAILURE_ID_HASH_STRING: um:invalid_pointer_write_c0000005_actualmultiplemonitorsshellextension64.dll!unknown FAILURE_ID_HASH: {96cbaffd-0b53-5873-75d6-364901498ca0} Followup: MachineOwner