Microsoft (R) Windows Debugger Version 6.3.9600.17029 X86
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [E:\dumps\Mini120914-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available


************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*E:\Symbols*http://msdl.microsoft.com/download/symbols

************* Symbol Path validation summary **************
Response                         Time (ms)     Location
Deferred                                       srv*E:\Symbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: srv*E:\Symbols*http://msdl.microsoft.com/download/symbols
Executable search path is: srv*E:\Symbols*http://msdl.microsoft.com/download/symbols
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 2600.xpsp_sp3_qfe.080814-1300
Machine Name:
Kernel base = 0x804d7000 PsLoadedModuleList = 0x805634c0
Debug session time: Mon Dec  8 19:07:30.093 2014 (UTC + 2:00)
System Uptime: 0 days 1:50:13.677
Loading Kernel Symbols
.

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

..............................................................
............................................................
Loading User Symbols
Loading unloaded module list
............................
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 10000050, {aed28b68, 0, 804f3daa, 0}


Could not read faulting driver name
Probably caused by : ntkrnlmp.exe ( nt!PsImpersonateClient+10e )

Followup: MachineOwner
---------

0: kd> kd: Reading initial command '.locale .1251; !analyze -v; q'
Locale: Russian_Russia.1251
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced.  This cannot be protected by try-except,
it must be protected by a Probe.  Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: aed28b68, memory referenced.
Arg2: 00000000, value 0 = read operation, 1 = write operation.
Arg3: 804f3daa, If non-zero, the instruction address which referenced the bad memory
	address.
Arg4: 00000000, (reserved)

Debugging Details:
------------------


Could not read faulting driver name

READ_ADDRESS: GetPointerFromAddress: unable to read from 805630e8
GetPointerFromAddress: unable to read from 805630e0
GetUlongFromAddress: unable to read from 80567ce8
 aed28b68 

FAULTING_IP: 
nt!SeTokenCanImpersonate+4e
804f3daa ff7730          push    dword ptr [edi+30h]

MM_INTERNAL_CODE:  0

CUSTOMER_CRASH_COUNT:  1

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0x50

PROCESS_NAME:  avp.exe

ANALYSIS_VERSION: 6.3.9600.17029 (debuggers(dbg).140219-1702) x86fre

LAST_CONTROL_TRANSFER:  from 805799b4 to 804f3daa

STACK_TEXT:  
b99acc48 805799b4 aed28b38 e44405a0 00000002 nt!SeTokenCanImpersonate+0x4e
b99acc74 805dfae6 85b34ba8 e44405a0 00000000 nt!PsImpersonateClient+0x10e
b99acc94 80585161 85b34ba8 b99accdc b99acd64 nt!PsRestoreImpersonation+0x22
b99acd30 80573ddb fffffffe 00000004 00000001 nt!NtOpenThreadTokenEx+0x1b4
b99acd4c 804dd99f fffffffe 00000004 00000001 nt!NtOpenThreadToken+0x18
b99acd4c 7c90e4f4 fffffffe 00000004 00000001 nt!KiFastCallEntry+0xfc
WARNING: Frame IP not in any known module. Following frames may be wrong.
0e5bdf1c 00000000 00000000 00000000 00000000 0x7c90e4f4


STACK_COMMAND:  kb

FOLLOWUP_IP: 
nt!PsImpersonateClient+10e
805799b4 8b4df4          mov     ecx,dword ptr [ebp-0Ch]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  nt!PsImpersonateClient+10e

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: nt

IMAGE_NAME:  ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP:  48a40b55

IMAGE_VERSION:  5.1.2600.5657

FAILURE_BUCKET_ID:  0x50_nt!PsImpersonateClient+10e

BUCKET_ID:  0x50_nt!PsImpersonateClient+10e

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x50_nt!psimpersonateclient+10e

FAILURE_ID_HASH:  {d027bbc0-f568-6d8c-8aca-819a3846c89e}

Followup: MachineOwner
---------

quit: