my latest dump file as this
oading Dump File [C:\IT\Dumps\BlueIris.exe_220125_181520.dmp]
User Mini Dump File with Full Memory: Only application data is available
Comment: '
*** "C:\IT\SysinternalsSuite\procdump.exe" -accepteula -ma -j "c:\it\dumps" 10052 508 0000000000B40000
*** Just-In-Time debugger. PID: 10052 Event Handle: 508 JIT Context: .jdinfo 0xb40000'
* Path validation summary **
Response Time (ms) Location
Deferred srv*c:\it\Symbols*Symbol information
Symbol search path is: srv*c:\it\Symbols*Symbol information
Executable search path is:
Windows 10 Version 19042 MP (24 procs) Free x64
Product: WinNt, suite: SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Debug session time: Tue Jan 25 18:15:21.000 2022 (UTC - 5:00)
System Uptime: 0 days 0:13:27.186
Process Uptime: 0 days 0:12:57.000
................................................................
...............................................................
Loading unloaded module list
................................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(2744.2070): Unknown exception - code c0000002 (first/second chance not available)
For analysis of this file, run !analyze -v
ntdll!NtWaitForMultipleObjects+0x14:
00007ff9`1e40d8c4 c3 ret
0:399> !analyze -v
***
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 12046
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 27328
Key : Analysis.Init.CPU.mSec
Value: 2593
Key : Analysis.Init.Elapsed.mSec
Value: 121020
Key : Analysis.Memory.CommitPeak.Mb
Value: 178
Key : Timeline.OS.Boot.DeltaSec
Value: 807
Key : Timeline.Process.Start.DeltaSec
Value: 777
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
Key : WER.Process.Version
Value: 5.5.4.5
COMMENT:
*** "C:\IT\SysinternalsSuite\procdump.exe" -accepteula -ma -j "c:\it\dumps" 10052 508 0000000000B40000
*** Just-In-Time debugger. PID: 10052 Event Handle: 508 JIT Context: .jdinfo 0xb40000
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
CONTEXT: (.ecxr)
rax=015e6d905c44ddab rbx=00000001b9708810 rcx=d76e9a6c3e0eb6a6
rdx=f51c861498e2ca43 rsi=0000000000977fd0 rdi=00000001a7a2efb0
rip=00007ff91c084f69 rsp=00000001a7a2ee00 rbp=00000001a7a2f0b0
r8=62690339846acf40 r9=45a52723671ead07 r10=e503c0367a31179b
r11=5e388734c7d26c6f r12=000000019df48d40 r13=0000000000000000
r14=0000000000000000 r15=00000000007fba60
iopl=0 nv up ei pl nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206
KERNELBASE!RaiseException+0x69:
00007ff9`1c084f69 0f1f440000 nop dword ptr [rax+rax]
Resetting default scope
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ff91c084f69 (KERNELBASE!RaiseException+0x0000000000000069)
ExceptionCode: c0000002
ExceptionFlags: 00000001
NumberParameters: 0
PROCESS_NAME: BlueIris.exe
ERROR_CODE: (NTSTATUS) 0xc0000002 - {Not Implemented} The requested operation is not implemented.
EXCEPTION_CODE_STR: c0000002
STACK_TEXT:
00000001`a7a2ee00 00007ff9`06646e6a : 00000000`00000002 00000000`00000000 00000000`00780076 00000001`5c4d3b58 : KERNELBASE!RaiseException+0x69
00000001`a7a2eee0 00000001`40fc454f : 00000000`00000000 00000000`00000000 00000001`b9712e20 00000558`0d4dbb1a : GdiPlus!GdipGetImageWidth+0x10a
00000001`a7a2ef80 00000000`00000000 : 00000000`00000000 00000001`b9712e20 00000558`0d4dbb1a 00000000`c1ee8e48 : BlueIris+0xfc454f
SYMBOL_NAME: KERNELBASE!RaiseException+69
MODULE_NAME: KERNELBASE
IMAGE_NAME: KERNELBASE.dll
STACK_COMMAND: ~399s ; .ecxr ; kb
FAILURE_BUCKET_ID: NOT_IMPLEMENTED_c0000002_KERNELBASE.dll!RaiseException
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
IMAGE_VERSION: 6.2.19041.1466
FAILURE_ID_HASH: {c4edabf8-4e96-bc4d-16ed-263430d040ae}
Followup: MachineOwner
---------
oading Dump File [C:\IT\Dumps\BlueIris.exe_220125_181520.dmp]
User Mini Dump File with Full Memory: Only application data is available
Comment: '
*** "C:\IT\SysinternalsSuite\procdump.exe" -accepteula -ma -j "c:\it\dumps" 10052 508 0000000000B40000
*** Just-In-Time debugger. PID: 10052 Event Handle: 508 JIT Context: .jdinfo 0xb40000'
* Path validation summary **
Response Time (ms) Location
Deferred srv*c:\it\Symbols*Symbol information
Symbol search path is: srv*c:\it\Symbols*Symbol information
Executable search path is:
Windows 10 Version 19042 MP (24 procs) Free x64
Product: WinNt, suite: SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Debug session time: Tue Jan 25 18:15:21.000 2022 (UTC - 5:00)
System Uptime: 0 days 0:13:27.186
Process Uptime: 0 days 0:12:57.000
................................................................
...............................................................
Loading unloaded module list
................................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(2744.2070): Unknown exception - code c0000002 (first/second chance not available)
For analysis of this file, run !analyze -v
ntdll!NtWaitForMultipleObjects+0x14:
00007ff9`1e40d8c4 c3 ret
0:399> !analyze -v
***
- *
- Exception Analysis *
- *
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 12046
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 27328
Key : Analysis.Init.CPU.mSec
Value: 2593
Key : Analysis.Init.Elapsed.mSec
Value: 121020
Key : Analysis.Memory.CommitPeak.Mb
Value: 178
Key : Timeline.OS.Boot.DeltaSec
Value: 807
Key : Timeline.Process.Start.DeltaSec
Value: 777
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
Key : WER.Process.Version
Value: 5.5.4.5
COMMENT:
*** "C:\IT\SysinternalsSuite\procdump.exe" -accepteula -ma -j "c:\it\dumps" 10052 508 0000000000B40000
*** Just-In-Time debugger. PID: 10052 Event Handle: 508 JIT Context: .jdinfo 0xb40000
NTGLOBALFLAG: 0
APPLICATION_VERIFIER_FLAGS: 0
CONTEXT: (.ecxr)
rax=015e6d905c44ddab rbx=00000001b9708810 rcx=d76e9a6c3e0eb6a6
rdx=f51c861498e2ca43 rsi=0000000000977fd0 rdi=00000001a7a2efb0
rip=00007ff91c084f69 rsp=00000001a7a2ee00 rbp=00000001a7a2f0b0
r8=62690339846acf40 r9=45a52723671ead07 r10=e503c0367a31179b
r11=5e388734c7d26c6f r12=000000019df48d40 r13=0000000000000000
r14=0000000000000000 r15=00000000007fba60
iopl=0 nv up ei pl nz na po nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000206
KERNELBASE!RaiseException+0x69:
00007ff9`1c084f69 0f1f440000 nop dword ptr [rax+rax]
Resetting default scope
EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 00007ff91c084f69 (KERNELBASE!RaiseException+0x0000000000000069)
ExceptionCode: c0000002
ExceptionFlags: 00000001
NumberParameters: 0
PROCESS_NAME: BlueIris.exe
ERROR_CODE: (NTSTATUS) 0xc0000002 - {Not Implemented} The requested operation is not implemented.
EXCEPTION_CODE_STR: c0000002
STACK_TEXT:
00000001`a7a2ee00 00007ff9`06646e6a : 00000000`00000002 00000000`00000000 00000000`00780076 00000001`5c4d3b58 : KERNELBASE!RaiseException+0x69
00000001`a7a2eee0 00000001`40fc454f : 00000000`00000000 00000000`00000000 00000001`b9712e20 00000558`0d4dbb1a : GdiPlus!GdipGetImageWidth+0x10a
00000001`a7a2ef80 00000000`00000000 : 00000000`00000000 00000001`b9712e20 00000558`0d4dbb1a 00000000`c1ee8e48 : BlueIris+0xfc454f
SYMBOL_NAME: KERNELBASE!RaiseException+69
MODULE_NAME: KERNELBASE
IMAGE_NAME: KERNELBASE.dll
STACK_COMMAND: ~399s ; .ecxr ; kb
FAILURE_BUCKET_ID: NOT_IMPLEMENTED_c0000002_KERNELBASE.dll!RaiseException
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
IMAGE_VERSION: 6.2.19041.1466
FAILURE_ID_HASH: {c4edabf8-4e96-bc4d-16ed-263430d040ae}
Followup: MachineOwner
---------