Baground.
OS Windows 2012 R2
We are using printing software from Nicelabel.com and also Nicelabel print drives to different printers.
We use Printui.exe to backup settings from printers
printui.exe /Ss /n <printername> /a <printerfile>
Restore with these parameters
printui.exe /Sr /n <printername> /a <printerfile> d u g p
Restore is went well but when open printer properties and close
explorer.exe crash.
Faulting application name: mmc.exe, version: 6.3.9600.18910, time stamp: 0x5a57a503
Faulting module name: ntdll.dll, version: 6.3.9600.19101, time stamp: 0x5b5017ac
Exception code: 0xc0000374
Fault offset: 0x00000000000f1cd0
Faulting process id: 0x2b0
Faulting application start time: 0x01d5475e5829af34
Faulting application path: C:\Windows\system32\mmc.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: 6a8f91a9-b36b-11e9-80cb-0050568a032c
Faulting package full name:
Faulting package-relative application ID:
Memory dumpfile analyzed by WINdbg
Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\pemla\explorer.exe.1392.dmp]
User Mini Dump File with Full Memory: Only application data is available
Symbol search path is: srv*
Executable search path is:
Windows 8.1 Version 9600 MP (2 procs) Free x64
Product: Server, suite: TerminalServer SingleUserTS
6.3.9600.18217 (winblue_ltsb.160124-0053)
Machine Name:
Debug session time: Mon Aug 5 07:19:20.000 2019 (UTC + 2:00)
System Uptime: 5 days 20:00:02.866
Process Uptime: 0 days 0:17:53.000
................................................................
................................................................
................................................................
................................
Loading unloaded module list
........................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(570.a1c): Unknown exception - code c0000374 (first/second chance not available)
For analysis of this file, run !analyze -v
ntdll!NtWaitForMultipleObjects+0xa:
00007fff`63cc0d0a c3 ret
0:078> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
KEY_VALUES_STRING: 1
Key : Timeline.OS.Boot.DeltaSec
Value: 504002
Key : Timeline.Process.Start.DeltaSec
Value: 1073
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
Timeline: !analyze.Start
Name: <blank>
Time: 2019-08-05T05:44:32.693Z
Diff: 1512693 mSec
Timeline: Dump.Current
Name: <blank>
Time: 2019-08-05T05:19:20.0Z
Diff: 0 mSec
Timeline: Process.Start
Name: <blank>
Time: 2019-08-05T05:01:27.0Z
Diff: 1073000 mSec
Timeline: OS.Boot
Name: <blank>
Time: 2019-07-30T09:19:18.0Z
Diff: 504002000 mSec
DUMP_CLASS: 2
DUMP_QUALIFIER: 400
CONTEXT: (.ecxr)
rax=00000000189ef218 rbx=00000000c0000374 rcx=00007fff63a8a000
rdx=000000001c435010 rsi=0000000000000000 rdi=00007fff63d5ed40
rip=00007fff63d21cd0 rsp=00000000189ef6b0 rbp=0000000000000000
r8=0000000000000003 r9=00007fff63d5eda8 r10=00007fff63c83e57
r11=0000000000000000 r12=0000000019d60990 r13=0000000000000000
r14=0000000000000003 r15=000000000000001f
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
ntdll!RtlReportCriticalFailure+0x8c:
00007fff`63d21cd0 eb00 jmp ntdll!RtlReportCriticalFailure+0x8e (00007fff`63d21cd2)
Resetting default scope
FAULTING_IP:
ntdll!RtlReportCriticalFailure+8c
00007fff`63d21cd0 eb00 jmp ntdll!RtlReportCriticalFailure+0x8e (00007fff`63d21cd2)
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007fff63d21cd0 (ntdll!RtlReportCriticalFailure+0x000000000000008c)
ExceptionCode: c0000374
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 00007fff63d5ed40
PROCESS_NAME: explorer.exe
ERROR_CODE: (NTSTATUS) 0xc0000374 - A heap has been corrupted.
EXCEPTION_CODE: (NTSTATUS) 0xc0000374 - A heap has been corrupted.
EXCEPTION_CODE_STR: c0000374
EXCEPTION_PARAMETER1: 00007fff63d5ed40
WATSON_BKT_PROCSTAMP: 56b8c9f1
WATSON_BKT_PROCVER: 6.3.9600.18231
PROCESS_VER_PRODUCT: Microsoft® Windows® Operating System
WATSON_BKT_MODULE: ntdll.dll
WATSON_BKT_MODSTAMP: 5b5017ac
WATSON_BKT_MODOFFSET: f1cd0
WATSON_BKT_MODVER: 6.3.9600.19101
MODULE_VER_PRODUCT: Microsoft® Windows® Operating System
BUILD_VERSION_STRING: 6.3.9600.18217 (winblue_ltsb.160124-0053)
MODLIST_WITH_TSCHKSUM_HASH: 4984c4e27a8f7795080c46d24ac6cb6cfa99fa96
MODLIST_SHA1_HASH: 089177646c755e8266becbbb2841501cc8597dc2
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
PRODUCT_TYPE: 3
SUITE_MASK: 272
DUMP_FLAGS: 8000c07
DUMP_TYPE: 3
ANALYSIS_SESSION_HOST: PEMLA-WIN10
ANALYSIS_SESSION_TIME: 08-05-2019 07:44:32.0693
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
THREAD_ATTRIBUTES:
FAULTING_THREAD: ffffffff
THREAD_SHA1_HASH_MOD_FUNC: c02a0cc02eed1dab8c267d9027a0d4082c651c58
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 6194c1e0507e0199775f81978ba2edefe5d57e61
OS_LOCALE: DAN
ADDITIONAL_DEBUG_TEXT: Followup set based on attribute [Is_ChosenCrashFollowupThread] from Frame:[0] on thread:[PSEUDO_THREAD] ; Followup set based on attribute [StartingRasmanService] from Frame:[4] on thread:[a1c]
BUGCHECK_STR: HEAP_CORRUPTION_SUSPICIOUSBLOCK
DEFAULT_BUCKET_ID: HEAP_CORRUPTION_SUSPICIOUSBLOCK
PRIMARY_PROBLEM_CLASS: HEAP_CORRUPTION
PROBLEM_CLASSES:
ID: [0n262]
Type: [HEAP_CORRUPTION]
Class: Primary
Scope: DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
BUCKET_ID
Name: Add
Data: Omit
PID: [Unspecified]
TID: [0xa1c]
Frame: [0] : ntdll!RtlReportCriticalFailure
ID: [0n259]
Type: [SUSPICIOUSBLOCK]
Class: Addendum
Scope: DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
BUCKET_ID
Name: Add
Data: Omit
PID: [0x570]
TID: [0xa1c]
Frame: [4] : ntdll!RtlFreeHeap
LAST_CONTROL_TRANSFER: from 00007fff63d24f12 to 00007fff63d21cd0
STACK_TEXT:
00000000`00000000 00000000`00000000 heap_corruption!explorer.exe+0x0
THREAD_SHA1_HASH_MOD: ca4e26064d24ef7512d2e94de5a93c38dbe82fe9
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: heap_corruption!explorer.exe
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: heap_corruption
IMAGE_NAME: heap_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: !heap ; .ecxr ; ~~[0xa1c]s ; .frame 4 ; ** Pseudo Context ** ManagedPseudo ** Value: 27a8d2d0d20 ** ; kb
BUCKET_ID: HEAP_CORRUPTION_SUSPICIOUSBLOCK_heap_corruption!explorer.exe
FAILURE_EXCEPTION_CODE: c0000374
FAILURE_IMAGE_NAME: heap_corruption
BUCKET_ID_IMAGE_STR: heap_corruption
FAILURE_MODULE_NAME: heap_corruption
BUCKET_ID_MODULE_STR: heap_corruption
FAILURE_FUNCTION_NAME: explorer.exe
BUCKET_ID_FUNCTION_STR: explorer.exe
BUCKET_ID_OFFSET: 0
BUCKET_ID_MODTIMEDATESTAMP: 0
BUCKET_ID_MODCHECKSUM: 0
BUCKET_ID_MODVER_STR: 0.0.0.0
BUCKET_ID_PREFIX_STR:
FAILURE_PROBLEM_CLASS: HEAP_CORRUPTION
FAILURE_SYMBOL_NAME: heap_corruption!explorer.exe
FAILURE_BUCKET_ID: HEAP_CORRUPTION_SUSPICIOUSBLOCK_c0000374_heap_corruption!explorer.exe
WATSON_STAGEONE_URL: http://watson.microsoft.com/StageOne/explorer.exe/6.3.9600.18231/56b8c9f1/ntdll.dll/6.3.9600.19101/5b5017ac/c0000374/000f1cd0.htm?Retriage=1
TARGET_TIME: 2019-08-05T05:19:20.000Z
OSBUILD: 9600
OSSERVICEPACK: 17415
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
OSPLATFORM_TYPE: x64
OSNAME: Windows 8.1
OSEDITION: Windows 8.1 Server TerminalServer SingleUserTS
USER_LCID: 0
OSBUILD_TIMESTAMP: 2014-10-29 03:45:30
BUILDDATESTAMP_STR: 160124-0053
BUILDLAB_STR: winblue_ltsb
BUILDOSVER_STR: 6.3.9600.18217
ANALYSIS_SESSION_ELAPSED_TIME: d3bb
ANALYSIS_SOURCE: UM
FAILURE_ID_HASH_STRING: um:heap_corruption_suspiciousblock_c0000374_heap_corruption!explorer.exe
FAILURE_ID_HASH: {ba28e66c-c4e6-a737-7647-c6bcb63c62e7}
Followup: MachineOwner
---------