Details

Id:  AVR:NULL+4*N e2d.0f3
Description:  Access violation while reading memory at 0x8 using a NULL ptr
Location:  microsoftedgecp.exe!edgehtml.dll!CBaseScriptable::PrivateQueryInterface
Security impact:  Denial of Service

Stack

Disassembly

00007ffe`de149548 4883c420 add rsp,20h
00007ffe`de14954c 5f pop rdi
00007ffe`de14954d c3 ret
00007ffe`de14954e 488b02 mov rax,qword ptr [rdx]
00007ffe`de149551 482b05e8927e00 sub rax,qword ptr [edgehtml!GUID_00000000_0000_0000_c000_000000000046 (00007ffe`de932840)]
00007ffe`de149558 750b jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x105 (00007ffe`de149565)
00007ffe`de14955a 488b4208 mov rax,qword ptr [rdx+8]
00007ffe`de14955e 482b05e3927e00 sub rax,qword ptr [edgehtml!GUID_00000000_0000_0000_c000_000000000046+0x8 (00007ffe`de932848)]
00007ffe`de149565 4885c0 test rax,rax
00007ffe`de149568 7503 jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x10d (00007ffe`de14956d)
00007ffe`de14956a 48890f mov qword ptr [rdi],rcx
00007ffe`de14956d 488b3f mov rdi,qword ptr [rdi]
00007ffe`de149570 4885ff test rdi,rdi
00007ffe`de149573 74c9 je edgehtml!CBaseScriptable::PrivateQueryInterface+0xde (00007ffe`de14953e)
00007ffe`de149575 488b07 mov rax,qword ptr [rdi]
edgehtml!CBaseScriptable::PrivateQueryInterface+0x118:
00007ffe`de149578 488b5808 mov rbx,qword ptr [rax+8] ⇐ instruction pointer
00007ffe`de14957c 488bcb mov rcx,rbx
00007ffe`de14957f ff1563e17900 call qword ptr [edgehtml!_guard_check_icall_fptr (00007ffe`de8e76e8)]
00007ffe`de149585 488bcf mov rcx,rdi
00007ffe`de149588 ffd3 call rbx
00007ffe`de14958a eb92 jmp edgehtml!CBaseScriptable::PrivateQueryInterface+0xbe (00007ffe`de14951e)
00007ffe`de14958c 488b02 mov rax,qword ptr [rdx]
00007ffe`de14958f 482b050226ac00 sub rax,qword ptr [edgehtml!IID_ICanvasPattern (00007ffe`dec0bb98)]
00007ffe`de149596 750b jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x143 (00007ffe`de1495a3)
00007ffe`de149598 488b4208 mov rax,qword ptr [rdx+8]
00007ffe`de14959c 482b05fd25ac00 sub rax,qword ptr [edgehtml!IID_ICanvasPattern+0x8 (00007ffe`dec0bba0)]
00007ffe`de1495a3 4885c0 test rax,rax
00007ffe`de1495a6 75c5 jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x10d (00007ffe`de14956d)
00007ffe`de1495a8 e84fb72a00 call edgehtml!Abandonment::DeprecatedAPI (00007ffe`de3f4cfc)
00007ffe`de1495ad cc int 3
00007ffe`de1495ae 3d18075130 cmp eax,30510718h
00007ffe`de1495b3 0f84d8000000 je edgehtml!CBaseScriptable::PrivateQueryInterface+0x231 (00007ffe`de149691)
00007ffe`de1495b9 3d1a075130 cmp eax,3051071Ah

Registers

rax=0000000000000000 rbx=00007ffede149460 rcx=00000206cecb8a80
rdx=00007ffef19c2400 rsi=0000020ed91b8cc0 rdi=000000a61284c070
rip=00007ffede149578 rsp=000000a61284bce0 rbp=00007ffef19c2400
r8=0000000030510716 r9=00007ffef19c2400 r10=000000a61284c4e0
r11=000000a61284bd98 r12=00000206cbe8fc00 r13=0000020ed91b8d20
r14=00000206cecb8a80 r15=000000a61284bf10
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
fpcw=027F fpsw=0000 fptw=0000
st0= 0.000008122063317480850e-4933 st1= 0.000004241386600370740e-3700
st2= 0.000000000000000000000e+0000 st3= 0.000207705784387050740e+4685
st4=-0.000287088481174333520e-2756 st5=-0.000194645719887826200e-4851
st6= 0.000033813029637256570e+4923 st7= 0.000142071419318404030e+3351
mm0=00000206c8490000 mm1=00000206cb1cc548
mm2=0000000000000000 mm3=00007ffef1fd25c7
mm4=00007ffef1f65c5f mm5=00007ffedcf28254
mm6=00007ffedcf28029 mm7=00007ffedcf26589
xmm0=4.59149e-041 -1.2684e+030 4.59149e-041 -1.34872e+030
xmm1=4.59149e-041 -1.34781e+030 4.59149e-041 -2.43984e+030
xmm2=0 0 0 0
xmm3=0 0 0 0
xmm4=0 0 0 0
xmm5=0 0 0 0
xmm6=0 0 0 0
xmm7=0 0 0 0
xmm8=0 0 0 0
xmm9=0 0 0 0
xmm10=0 0 0 0
xmm11=0 0 0 0
xmm12=0 0 0 0
xmm13=0 0 0 0
xmm14=0 0 0 0
xmm15=0 0 0 0
dr0=0000000000000000 dr1=0000000000000000 dr2=0000000000000000
dr3=0000000000000000 dr6=0000000000000000 dr7=0000000000000000
edgehtml!CBaseScriptable::PrivateQueryInterface+0x118:
00007ffe`de149578 488b5808 mov rbx,qword ptr [rax+8] ds:00000000`00000008=????????????????

Referenced memory

Memory around address 0x8:

ffffffff`ffffff88 ????????`????????
ffffffff`ffffff90 ????????`????????
ffffffff`ffffff98 ????????`????????
ffffffff`ffffffa0 ????????`????????
ffffffff`ffffffa8 ????????`????????
ffffffff`ffffffb0 ????????`????????
ffffffff`ffffffb8 ????????`????????
ffffffff`ffffffc0 ????????`????????
ffffffff`ffffffc8 ????????`????????
ffffffff`ffffffd0 ????????`????????
ffffffff`ffffffd8 ????????`????????
ffffffff`ffffffe0 ????????`????????
ffffffff`ffffffe8 ????????`????????
ffffffff`fffffff0 ????????`????????
ffffffff`fffffff8 ????????`????????
00000000`00000000 ????????`????????
00000000`00000008 ????????`???????? ⇐ referenced
00000000`00000010 ????????`????????
00000000`00000018 ????????`????????
00000000`00000020 ????????`????????
00000000`00000028 ????????`????????
00000000`00000030 ????????`????????
00000000`00000038 ????????`????????
00000000`00000040 ????????`????????
00000000`00000048 ????????`????????
00000000`00000050 ????????`????????
00000000`00000058 ????????`????????
00000000`00000060 ????????`????????
00000000`00000068 ????????`????????
00000000`00000070 ????????`????????
00000000`00000078 ????????`????????
00000000`00000080 ????????`????????

Binary information

edgehtml.dll

Loaded symbol image file: C:\Windows\SYSTEM32\edgehtml.dll
Image path: C:\Windows\SYSTEM32\edgehtml.dll
Image name: edgehtml.dll
Timestamp: Sat Apr 23 06:30:17 2016 (571AFA59)
CheckSum: 0155841B
ImageSize: 01576000
File version: 11.0.10586.306
Product version: 11.0.10586.306
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Internet Explorer
InternalName: EDGEHTML
OriginalFilename: EDGEHTML.DLL
ProductVersion: 11.00.10586.306
FileVersion: 11.00.10586.306 (th2_release_sec.160422-1850)
FileDescription: Microsoft (R) HTML Viewer
LegalCopyright: � Microsoft Corporation. All rights reserved.

microsoftedgecp.exe

Image path: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
Image name: microsoftedgecp.exe
Timestamp: Tue Nov 24 08:05:25 2015 (56540C35)
CheckSum: 0005C253
ImageSize: 00051000
File version: 11.0.10586.20
Product version: 11.0.10586.20
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft Edge
InternalName: MicrosoftEdgeCP
OriginalFilename: MicrosoftEdgeCP.exe
ProductVersion: 11.00.10586.20
FileVersion: 11.00.10586.20 (th2_release_sec.151123-1940)
FileDescription: Microsoft Edge Content Process
LegalCopyright: � Microsoft Corporation. All rights reserved.

Debugger IO


Microsoft (R) Windows Debugger Version 6.3.9600.16384 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

*** wait with pending attach

************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*C:\Symbols
Deferred cache*\\server\Symbols
Deferred srv*http://symbols.mozilla.org/firefox
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols;cache*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is:
ModLoad: 00007ff7`4e4d0000 00007ff7`4e4e7000 C:\Windows\System32\RuntimeBroker.exe
ModLoad: 00007ffe`f1f40000 00007ffe`f2101000 C:\Windows\SYSTEM32\ntdll.dll
ModLoad: 00007ffe`da490000 00007ffe`da4fd000 C:\Windows\system32\verifier.dll
ModLoad: 00007ffe`ef400000 00007ffe`ef4ad000 C:\Windows\system32\KERNEL32.DLL
ModLoad: 00007ffe`ee900000 00007ffe`eeae8000 C:\Windows\system32\KERNELBASE.dll
ModLoad: 00007ffe`ef5d0000 00007ffe`ef66d000 C:\Windows\system32\msvcrt.dll
ModLoad: 00007ffe`f1af0000 00007ffe`f1c0c000 C:\Windows\system32\RPCRT4.dll
ModLoad: 00007ffe`f1800000 00007ffe`f1a7d000 C:\Windows\system32\combase.dll
ModLoad: 00007ffe`ee6c0000 00007ffe`ee72a000 C:\Windows\system32\bcryptPrimitives.dll
ModLoad: 00007ffe`ee560000 00007ffe`ee5ab000 C:\Windows\system32\powrprof.dll
ModLoad: 00007ffe`ee5e0000 00007ffe`ee5ef000 C:\Windows\system32\kernel.appcore.dll
ModLoad: 00007ffe`f16b0000 00007ffe`f17f3000 C:\Windows\system32\ole32.dll
ModLoad: 00007ffe`ef9b0000 00007ffe`efa0b000 C:\Windows\system32\sechost.dll
ModLoad: 00007ffe`f1c70000 00007ffe`f1df6000 C:\Windows\system32\GDI32.dll
ModLoad: 00007ffe`ef670000 00007ffe`ef7c6000 C:\Windows\system32\USER32.dll
ModLoad: 00007ffe`f1c30000 00007ffe`f1c6b000 C:\Windows\system32\IMM32.DLL
ModLoad: 00007ffe`ef350000 00007ffe`ef3f7000 C:\Windows\system32\clbcatq.dll
ModLoad: 00007ffe`e7b20000 00007ffe`e7cdd000 C:\Windows\System32\Windows.UI.Immersive.dll
ModLoad: 00007ffe`eeaf0000 00007ffe`eeba5000 C:\Windows\system32\shcore.dll
ModLoad: 00007ffe`ebc70000 00007ffe`ec103000 C:\Windows\System32\ActXPrxy.dll
ModLoad: 00007ffe`e8070000 00007ffe`e81a6000 C:\Windows\System32\WinTypes.dll
ModLoad: 00007ffe`ed080000 00007ffe`ed180000 C:\Windows\System32\twinapi.appcore.dll
ModLoad: 00007ffe`ee490000 00007ffe`ee4b9000 C:\Windows\System32\bcrypt.dll
ModLoad: 00007ffe`da420000 00007ffe`da44b000 C:\Windows\System32\Windows.ApplicationModel.Core.dll
ModLoad: 00007ffe`ee5b0000 00007ffe`ee5c4000 C:\Windows\system32\profapi.dll
ModLoad: 00007ffe`eda50000 00007ffe`eda81000 C:\Windows\SYSTEM32\ntmarta.dll
ModLoad: 00007ffe`edcc0000 00007ffe`edcdf000 C:\Windows\System32\USERENV.dll
ModLoad: 00007ffe`e13c0000 00007ffe`e13d5000 C:\Windows\SYSTEM32\profext.dll
ModLoad: 00007ffe`ee1e0000 00007ffe`ee20d000 C:\Windows\system32\SspiCli.dll
ModLoad: 00007ffe`e13a0000 00007ffe`e13bb000 C:\Windows\SYSTEM32\capauthz.dll
ModLoad: 00007ffe`ece40000 00007ffe`eceb9000 C:\Windows\system32\apphelp.dll
(93c.f2c): Break instruction exception - code 80000003 (first chance)
ntdll!DbgBreakPoint:
00007ffe`f1fe8870 cc int 3

Create process 2364 breakpoint.
0:007> g
*** wait with pending attach

************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*C:\Symbols
Deferred cache*\\server\Symbols
Deferred srv*http://symbols.mozilla.org/firefox
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols;cache*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is:
ModLoad: 00007ff7`3a3b0000 00007ff7`3a3ba000 C:\Windows\system32\browser_broker.exe
ModLoad: 00007ffe`f1f40000 00007ffe`f2101000 C:\Windows\SYSTEM32\ntdll.dll
ModLoad: 00007ffe`da490000 00007ffe`da4fd000 C:\Windows\system32\verifier.dll
ModLoad: 00007ffe`ef400000 00007ffe`ef4ad000 C:\Windows\system32\KERNEL32.DLL
ModLoad: 00007ffe`ee900000 00007ffe`eeae8000 C:\Windows\system32\KERNELBASE.dll
ModLoad: 00007ffe`ef5d0000 00007ffe`ef66d000 C:\Windows\system32\msvcrt.dll
ModLoad: 00007ffe`f1800000 00007ffe`f1a7d000 C:\Windows\system32\combase.dll
ModLoad: 00007ffe`f1af0000 00007ffe`f1c0c000 C:\Windows\system32\RPCRT4.dll
ModLoad: 00007ffe`ee6c0000 00007ffe`ee72a000 C:\Windows\system32\bcryptPrimitives.dll
ModLoad: 00007ffe`ef9b0000 00007ffe`efa0b000 C:\Windows\system32\sechost.dll
ModLoad: 00007ffe`ef670000 00007ffe`ef7c6000 C:\Windows\system32\user32.dll
ModLoad: 00007ffe`f1c70000 00007ffe`f1df6000 C:\Windows\system32\GDI32.dll
ModLoad: 00007ffe`f1c30000 00007ffe`f1c6b000 C:\Windows\system32\IMM32.DLL
ModLoad: 00007ffe`ee5e0000 00007ffe`ee5ef000 C:\Windows\system32\kernel.appcore.dll
ModLoad: 00007ffe`ecee0000 00007ffe`ecf76000 C:\Windows\system32\uxtheme.dll
ModLoad: 00007ffe`e66d0000 00007ffe`e66ec000 C:\Windows\SYSTEM32\browserbroker.dll
ModLoad: 00007ffe`eeaf0000 00007ffe`eeba5000 C:\Windows\system32\shcore.dll
ModLoad: 00007ffe`f1e70000 00007ffe`f1f31000 C:\Windows\system32\OLEAUT32.dll
ModLoad: 00007ffe`ee730000 00007ffe`ee8f8000 C:\Windows\system32\CRYPT32.dll
ModLoad: 00007ffe`ee5d0000 00007ffe`ee5e0000 C:\Windows\system32\MSASN1.dll
ModLoad: 00007ffe`e7ce0000 00007ffe`e8063000 C:\Windows\SYSTEM32\iertutil.dll
ModLoad: 00007ffe`eebb0000 00007ffe`ef1f4000 C:\Windows\system32\windows.storage.dll
ModLoad: 00007ffe`ef200000 00007ffe`ef243000 C:\Windows\system32\cfgmgr32.dll
ModLoad: 00007ffe`ef520000 00007ffe`ef5c7000 C:\Windows\system32\advapi32.dll
ModLoad: 00007ffe`ef4c0000 00007ffe`ef512000 C:\Windows\system32\shlwapi.dll
ModLoad: 00007ffe`ee560000 00007ffe`ee5ab000 C:\Windows\system32\powrprof.dll
ModLoad: 00007ffe`ee5b0000 00007ffe`ee5c4000 C:\Windows\system32\profapi.dll
ModLoad: 00007ffe`e2d60000 00007ffe`e2f17000 C:\Windows\SYSTEM32\urlmon.dll
ModLoad: 00007ffe`eb600000 00007ffe`eb61b000 C:\Windows\SYSTEM32\MPR.dll
ModLoad: 00007ffe`e1430000 00007ffe`e16d9000 C:\Windows\SYSTEM32\WININET.dll
ModLoad: 00007ffe`eb230000 00007ffe`eb266000 C:\Windows\SYSTEM32\XmlLite.dll
ModLoad: 00007ffe`edbb0000 00007ffe`edbba000 C:\Windows\SYSTEM32\DPAPI.DLL
ModLoad: 00007ffe`ef350000 00007ffe`ef3f7000 C:\Windows\system32\clbcatq.dll
ModLoad: 00007ffe`db010000 00007ffe`db0bd000 C:\Windows\System32\ieproxy.dll
ModLoad: 00007ffe`f16b0000 00007ffe`f17f3000 C:\Windows\system32\ole32.dll
ModLoad: 00007ffe`ed080000 00007ffe`ed180000 C:\Windows\System32\twinapi.appcore.dll
ModLoad: 00007ffe`ee490000 00007ffe`ee4b9000 C:\Windows\System32\bcrypt.dll
ModLoad: 00007ffe`ee1e0000 00007ffe`ee20d000 C:\Windows\SYSTEM32\SspiCli.dll
ModLoad: 00007ffe`efbc0000 00007ffe`f111c000 C:\Windows\system32\SHELL32.dll
(13e4.ce0): Break instruction exception - code 80000003 (first chance)

Create process 5092 breakpoint.
1:007> g
*** wait with pending attach

************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*C:\Symbols
Deferred cache*\\server\Symbols
Deferred srv*http://symbols.mozilla.org/firefox
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols;cache*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is:
ModLoad: 00007ff7`64520000 00007ff7`64c27000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
ModLoad: 00007ffe`f1f40000 00007ffe`f2101000 C:\Windows\SYSTEM32\ntdll.dll
ModLoad: 00007ffe`da490000 00007ffe`da4fd000 C:\Windows\system32\verifier.dll
ModLoad: 00007ffe`ef400000 00007ffe`ef4ad000 C:\Windows\system32\KERNEL32.DLL
ModLoad: 00007ffe`ee900000 00007ffe`eeae8000 C:\Windows\system32\KERNELBASE.dll
ModLoad: 00007ffe`ece40000 00007ffe`eceb9000 C:\Windows\system32\apphelp.dll
ModLoad: 00007ffe`ef520000 00007ffe`ef5c7000 C:\Windows\system32\ADVAPI32.dll
ModLoad: 00007ffe`ef5d0000 00007ffe`ef66d000 C:\Windows\system32\msvcrt.dll
ModLoad: 00007ffe`ef9b0000 00007ffe`efa0b000 C:\Windows\system32\sechost.dll
ModLoad: 00007ffe`f1af0000 00007ffe`f1c0c000 C:\Windows\system32\RPCRT4.dll
ModLoad: 00007ffe`f16b0000 00007ffe`f17f3000 C:\Windows\system32\ole32.dll
ModLoad: 00007ffe`f1800000 00007ffe`f1a7d000 C:\Windows\system32\combase.dll
ModLoad: 00007ffe`ee6c0000 00007ffe`ee72a000 C:\Windows\system32\bcryptPrimitives.dll
ModLoad: 00007ffe`f1c70000 00007ffe`f1df6000 C:\Windows\system32\GDI32.dll
ModLoad: 00007ffe`ef670000 00007ffe`ef7c6000 C:\Windows\system32\USER32.dll
ModLoad: 00007ffe`e93b0000 00007ffe`e941a000 C:\Windows\SYSTEM32\wincorlib.DLL
ModLoad: 00007ffe`f1e70000 00007ffe`f1f31000 C:\Windows\system32\OLEAUT32.dll
ModLoad: 00007ffe`f1c30000 00007ffe`f1c6b000 C:\Windows\system32\IMM32.DLL
ModLoad: 00007ffe`ee5e0000 00007ffe`ee5ef000 C:\Windows\system32\kernel.appcore.dll
ModLoad: 00007ffe`e81b0000 00007ffe`e91e9000 C:\Windows\System32\Windows.UI.Xaml.dll
ModLoad: 00007ffe`e8070000 00007ffe`e81a6000 C:\Windows\SYSTEM32\wintypes.dll
ModLoad: 00007ffe`ec8e0000 00007ffe`ec99c000 C:\Windows\SYSTEM32\CoreMessaging.dll
ModLoad: 00007ffe`ec110000 00007ffe`ec177000 C:\Windows\SYSTEM32\Bcp47Langs.dll
ModLoad: 00007ffe`e7ce0000 00007ffe`e8063000 C:\Windows\SYSTEM32\iertutil.dll
ModLoad: 00007ffe`eeaf0000 00007ffe`eeba5000 C:\Windows\system32\shcore.dll
ModLoad: 00007ffe`eebb0000 00007ffe`ef1f4000 C:\Windows\system32\windows.storage.dll
ModLoad: 00007ffe`ef200000 00007ffe`ef243000 C:\Windows\system32\cfgmgr32.dll
ModLoad: 00007ffe`ef4c0000 00007ffe`ef512000 C:\Windows\system32\shlwapi.dll
ModLoad: 00007ffe`ee560000 00007ffe`ee5ab000 C:\Windows\system32\powrprof.dll
ModLoad: 00007ffe`ee5b0000 00007ffe`ee5c4000 C:\Windows\system32\profapi.dll
ModLoad: 00007ffe`ed080000 00007ffe`ed180000 C:\Windows\System32\twinapi.appcore.dll
ModLoad: 00007ffe`ee490000 00007ffe`ee4b9000 C:\Windows\SYSTEM32\bcrypt.dll
ModLoad: 00007ffe`e6f80000 00007ffe`e6f9a000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\EShims.dll
ModLoad: 00007ffe`edcc0000 00007ffe`edcdf000 C:\Windows\SYSTEM32\USERENV.dll
ModLoad: 00007ffe`eb600000 00007ffe`eb61b000 C:\Windows\SYSTEM32\MPR.dll
ModLoad: 00007ffe`d8170000 00007ffe`d8705000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\eModel.dll
ModLoad: 00007ffe`efbc0000 00007ffe`f111c000 C:\Windows\system32\SHELL32.dll
ModLoad: 00007ffe`ef250000 00007ffe`ef2d6000 C:\Windows\system32\firewallapi.dll
ModLoad: 00007ffe`ed3e0000 00007ffe`ed412000 C:\Windows\SYSTEM32\fwbase.dll
ModLoad: 00007ffe`ebc70000 00007ffe`ec103000 C:\Windows\System32\ActXPrxy.dll
ModLoad: 00007ffe`ecee0000 00007ffe`ecf76000 C:\Windows\system32\uxtheme.dll
ModLoad: 00007ffe`ec740000 00007ffe`ec762000 C:\Windows\SYSTEM32\dwmapi.dll
ModLoad: 00007ffe`ec3e0000 00007ffe`ec482000 C:\Windows\SYSTEM32\dxgi.dll
ModLoad: 00007ffe`dfce0000 00007ffe`dfd14000 C:\Windows\System32\Windows.ApplicationModel.dll
ModLoad: 00007ffe`d7ca0000 00007ffe`d8166000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\eView.dll
ModLoad: 00007ffe`e2d60000 00007ffe`e2f17000 C:\Windows\SYSTEM32\urlmon.dll
ModLoad: 00007ffe`e92a0000 00007ffe`e93ae000 C:\Windows\System32\MrmCoreR.dll
ModLoad: 00007ffe`e91f0000 00007ffe`e9298000 C:\Windows\System32\Windows.UI.dll
ModLoad: 00007ffe`ec490000 00007ffe`ec738000 C:\Windows\SYSTEM32\d3d11.dll
ModLoad: 00007ffe`eaea0000 00007ffe`eb10f000 C:\Windows\SYSTEM32\d3d10warp.dll
ModLoad: 00007ffe`ea950000 00007ffe`eae95000 C:\Windows\SYSTEM32\d2d1.dll
ModLoad: 00007ffe`ec9a0000 00007ffe`eca83000 C:\Windows\System32\dcomp.dll
ModLoad: 00007ffe`e63a0000 00007ffe`e662a000 C:\Windows\system32\CoreUIComponents.dll
ModLoad: 00007ffe`e13c0000 00007ffe`e13d5000 C:\Windows\SYSTEM32\profext.dll
ModLoad: 00007ffe`eda50000 00007ffe`eda81000 C:\Windows\SYSTEM32\ntmarta.dll
ModLoad: 00007ffe`f1120000 00007ffe`f127a000 C:\Windows\system32\MSCTF.dll
ModLoad: 00007ffe`e1430000 00007ffe`e16d9000 C:\Windows\SYSTEM32\WININET.dll
ModLoad: 00007ffe`ee1e0000 00007ffe`ee20d000 C:\Windows\SYSTEM32\SspiCli.dll
ModLoad: 00007ffe`dfb70000 00007ffe`dfb7e000 C:\Windows\SYSTEM32\tokenbinding.dll
ModLoad: 00007ffe`ef940000 00007ffe`ef9ab000 C:\Windows\system32\WS2_32.dll
ModLoad: 00007ffe`e4ea0000 00007ffe`e4eb5000 C:\Windows\SYSTEM32\ondemandconnroutehelper.dll
ModLoad: 00007ffe`eb640000 00007ffe`eb678000 C:\Windows\SYSTEM32\IPHLPAPI.DLL
ModLoad: 00007ffe`ea3e0000 00007ffe`ea4a8000 C:\Windows\SYSTEM32\winhttp.dll
ModLoad: 00007ffe`ede30000 00007ffe`ede8c000 C:\Windows\system32\mswsock.dll
ModLoad: 00007ffe`e6e60000 00007ffe`e6e6b000 C:\Windows\SYSTEM32\WINNSI.DLL
ModLoad: 00007ffe`ef4b0000 00007ffe`ef4b8000 C:\Windows\system32\NSI.dll
ModLoad: 00007ffe`e6270000 00007ffe`e6282000 C:\Windows\System32\Windows.Shell.ServiceHostBuilder.dll
ModLoad: 00007ffe`e59f0000 00007ffe`e5a05000 C:\Windows\system32\execmodelproxy.dll
ModLoad: 00007ffe`dced0000 00007ffe`dd082000 C:\Windows\SYSTEM32\ieapfltr.dll
ModLoad: 00007ffe`edee0000 00007ffe`edef7000 C:\Windows\SYSTEM32\CRYPTSP.dll
ModLoad: 00007ffe`e5980000 00007ffe`e59d5000 C:\Windows\SYSTEM32\policymanager.dll
ModLoad: 00007ffe`e60a0000 00007ffe`e6132000 C:\Windows\SYSTEM32\msvcp110_win.dll
ModLoad: 00007ffe`eb230000 00007ffe`eb266000 C:\Windows\SYSTEM32\XmlLite.dll
ModLoad: 00007ffe`e7550000 00007ffe`e76d5000 C:\Windows\System32\Windows.Globalization.dll
ModLoad: 00007ffe`e2b10000 00007ffe`e2b50000 C:\Windows\System32\netprofm.dll
ModLoad: 00007ffe`e2b70000 00007ffe`e2b7e000 C:\Windows\System32\npmproxy.dll
ModLoad: 00007ffe`eb620000 00007ffe`eb636000 C:\Windows\SYSTEM32\wkscli.dll
ModLoad: 00007ffe`ea090000 00007ffe`ea0be000 C:\Windows\SYSTEM32\netjoin.dll
ModLoad: 00007ffe`ee040000 00007ffe`ee061000 C:\Windows\SYSTEM32\JoinUtil.dll
ModLoad: 00007ffe`f1a80000 00007ffe`f1aef000 C:\Windows\system32\coml2.dll
ModLoad: 00007ffe`ed970000 00007ffe`ed97c000 C:\Windows\SYSTEM32\netutils.dll
ModLoad: 00007ffe`dbb70000 00007ffe`dbba0000 C:\Windows\SYSTEM32\MDMRegistration.DLL
ModLoad: 00007ffe`ee730000 00007ffe`ee8f8000 C:\Windows\system32\CRYPT32.dll
ModLoad: 00007ffe`ee5d0000 00007ffe`ee5e0000 C:\Windows\system32\MSASN1.dll
ModLoad: 00007ffe`da9f0000 00007ffe`daa08000 C:\Windows\SYSTEM32\DMCmnUtils.dll
ModLoad: 00007ffe`ecf80000 00007ffe`ecfa7000 C:\Windows\SYSTEM32\DEVOBJ.dll
ModLoad: 00007ffe`ee0d0000 00007ffe`ee0f7000 C:\Windows\SYSTEM32\ncrypt.dll
ModLoad: 00007ffe`ee090000 00007ffe`ee0ca000 C:\Windows\SYSTEM32\NTASN1.dll
ModLoad: 00007ffe`ecfd0000 00007ffe`ed07a000 C:\Windows\SYSTEM32\DNSAPI.dll
ModLoad: 00007ffe`ec7f0000 00007ffe`ec815000 C:\Windows\SYSTEM32\SLC.dll
ModLoad: 00007ffe`ec790000 00007ffe`ec7b5000 C:\Windows\SYSTEM32\sppc.dll
ModLoad: 00007ffe`e5f80000 00007ffe`e5fc4000 C:\Windows\System32\execmodelclient.dll
ModLoad: 00007ffe`e4670000 00007ffe`e46ba000 C:\Windows\system32\DataExchange.dll
ModLoad: 00007ffe`ee000000 00007ffe`ee00b000 C:\Windows\SYSTEM32\CRYPTBASE.dll
ModLoad: 00007ffe`ec1d0000 00007ffe`ec356000 C:\Windows\SYSTEM32\PROPSYS.dll
ModLoad: 00007ffe`e62f0000 00007ffe`e62fa000 C:\Windows\System32\rasadhlp.dll
ModLoad: 00007ffe`e6ca0000 00007ffe`e6d07000 C:\Windows\System32\fwpuclnt.dll
ModLoad: 00007ffe`da420000 00007ffe`da44b000 C:\Windows\System32\Windows.ApplicationModel.Core.dll
ModLoad: 00007ffe`ed2e0000 00007ffe`ed30a000 C:\Windows\System32\rmclient.dll
ModLoad: 00007ffe`e76e0000 00007ffe`e7940000 C:\Windows\SYSTEM32\dwrite.dll
ModLoad: 00007ffe`dd0c0000 00007ffe`dd11f000 C:\Windows\System32\Windows.Graphics.dll
ModLoad: 00007ffe`df4d0000 00007ffe`df809000 C:\Windows\SYSTEM32\msftedit.dll
ModLoad: 00007ffe`ebbd0000 00007ffe`ebc00000 C:\Windows\SYSTEM32\globinputhost.dll
ModLoad: 00007ffe`e2f70000 00007ffe`e2fcc000 C:\Windows\SYSTEM32\NInput.dll
ModLoad: 00007ffe`dd0a0000 00007ffe`dd0b8000 C:\Windows\System32\Windows.Globalization.Fontgroups.dll
ModLoad: 00007ffe`dd090000 00007ffe`dd09a000 C:\Windows\SYSTEM32\fontgroupsoverride.dll
ModLoad: 00007ffe`da300000 00007ffe`da32a000 C:\Windows\System32\Windows.System.Profile.RetailInfo.dll
ModLoad: 00007ffe`e4c10000 00007ffe`e4cc1000 C:\Windows\system32\twinapi.dll
ModLoad: 00007ffe`e7410000 00007ffe`e749b000 C:\Windows\system32\directmanipulation.dll
(ba0.7ac): Break instruction exception - code 80000003 (first chance)

Create process 2976 breakpoint.
2:007> g
*** wait with pending attach

************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*C:\Symbols
Deferred cache*\\server\Symbols
Deferred srv*http://symbols.mozilla.org/firefox
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols;cache*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is:
ModLoad: 00007ff6`5da80000 00007ff6`5dad1000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
ModLoad: 00007ffe`f1f40000 00007ffe`f2101000 C:\Windows\SYSTEM32\ntdll.dll
ModLoad: 00007ffe`da490000 00007ffe`da4fd000 C:\Windows\system32\verifier.dll
ModLoad: 00007ffe`ef400000 00007ffe`ef4ad000 C:\Windows\system32\KERNEL32.DLL
ModLoad: 00007ffe`ee900000 00007ffe`eeae8000 C:\Windows\system32\KERNELBASE.dll
ModLoad: 00007ffe`ece40000 00007ffe`eceb9000 C:\Windows\system32\apphelp.dll
ModLoad: 00007ffe`ef520000 00007ffe`ef5c7000 C:\Windows\system32\ADVAPI32.dll
ModLoad: 00007ffe`ef5d0000 00007ffe`ef66d000 C:\Windows\system32\msvcrt.dll
ModLoad: 00007ffe`ef9b0000 00007ffe`efa0b000 C:\Windows\system32\sechost.dll
ModLoad: 00007ffe`f1af0000 00007ffe`f1c0c000 C:\Windows\system32\RPCRT4.dll
ModLoad: 00007ffe`ef670000 00007ffe`ef7c6000 C:\Windows\system32\USER32.dll
ModLoad: 00007ffe`f1c70000 00007ffe`f1df6000 C:\Windows\system32\GDI32.dll
ModLoad: 00007ffe`eeaf0000 00007ffe`eeba5000 C:\Windows\system32\shcore.dll
ModLoad: 00007ffe`f1800000 00007ffe`f1a7d000 C:\Windows\system32\combase.dll
ModLoad: 00007ffe`ee6c0000 00007ffe`ee72a000 C:\Windows\system32\bcryptPrimitives.dll
ModLoad: 00007ffe`ef2e0000 00007ffe`ef335000 C:\Windows\system32\WINTRUST.dll
ModLoad: 00007ffe`ee5d0000 00007ffe`ee5e0000 C:\Windows\system32\MSASN1.dll
ModLoad: 00007ffe`ee730000 00007ffe`ee8f8000 C:\Windows\system32\CRYPT32.dll
ModLoad: 00007ffe`e7ce0000 00007ffe`e8063000 C:\Windows\SYSTEM32\iertutil.dll
ModLoad: 00007ffe`eebb0000 00007ffe`ef1f4000 C:\Windows\system32\windows.storage.dll
ModLoad: 00007ffe`ef200000 00007ffe`ef243000 C:\Windows\system32\cfgmgr32.dll
ModLoad: 00007ffe`ef4c0000 00007ffe`ef512000 C:\Windows\system32\shlwapi.dll
ModLoad: 00007ffe`ee5e0000 00007ffe`ee5ef000 C:\Windows\system32\kernel.appcore.dll
ModLoad: 00007ffe`ee560000 00007ffe`ee5ab000 C:\Windows\system32\powrprof.dll
ModLoad: 00007ffe`ee5b0000 00007ffe`ee5c4000 C:\Windows\system32\profapi.dll
ModLoad: 00007ffe`f1c30000 00007ffe`f1c6b000 C:\Windows\system32\IMM32.DLL
ModLoad: 00007ffe`d8170000 00007ffe`d8705000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\EMODEL.dll
ModLoad: 00007ffe`efbc0000 00007ffe`f111c000 C:\Windows\system32\SHELL32.dll
ModLoad: 00007ffe`f1e70000 00007ffe`f1f31000 C:\Windows\system32\OLEAUT32.dll
ModLoad: 00007ffe`ef250000 00007ffe`ef2d6000 C:\Windows\system32\firewallapi.dll
ModLoad: 00007ffe`edcc0000 00007ffe`edcdf000 C:\Windows\SYSTEM32\USERENV.dll
ModLoad: 00007ffe`ed3e0000 00007ffe`ed412000 C:\Windows\SYSTEM32\fwbase.dll
ModLoad: 00007ffe`e6f80000 00007ffe`e6f9a000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\EShims.dll
ModLoad: 00007ffe`eb600000 00007ffe`eb61b000 C:\Windows\SYSTEM32\MPR.dll
ModLoad: 00007ffe`f16b0000 00007ffe`f17f3000 C:\Windows\system32\ole32.dll
ModLoad: 00007ffe`ecee0000 00007ffe`ecf76000 C:\Windows\system32\uxtheme.dll
ModLoad: 00007ffe`e13c0000 00007ffe`e13d5000 C:\Windows\SYSTEM32\profext.dll
ModLoad: 00007ffe`eda50000 00007ffe`eda81000 C:\Windows\SYSTEM32\ntmarta.dll
ModLoad: 00007ffe`ed080000 00007ffe`ed180000 C:\Windows\SYSTEM32\twinapi.appcore.dll
ModLoad: 00007ffe`ee490000 00007ffe`ee4b9000 C:\Windows\SYSTEM32\bcrypt.dll
ModLoad: 00007ffe`dda40000 00007ffe`defb6000 C:\Windows\SYSTEM32\edgehtml.dll
ModLoad: 00007ffe`edee0000 00007ffe`edef7000 C:\Windows\SYSTEM32\cryptsp.dll
ModLoad: 00007ffe`dd2b0000 00007ffe`dda34000 C:\Windows\SYSTEM32\chakra.dll
ModLoad: 00007ffe`dd270000 00007ffe`dd2ae000 C:\Windows\SYSTEM32\MLANG.dll
ModLoad: 00007ffe`e8070000 00007ffe`e81a6000 C:\Windows\System32\WinTypes.dll
ModLoad: 00007ffe`e1430000 00007ffe`e16d9000 C:\Windows\SYSTEM32\WININET.dll
ModLoad: 00007ffe`ee1e0000 00007ffe`ee20d000 C:\Windows\SYSTEM32\SspiCli.dll
ModLoad: 00007ffe`dfb70000 00007ffe`dfb7e000 C:\Windows\SYSTEM32\tokenbinding.dll
ModLoad: 00007ffe`ef940000 00007ffe`ef9ab000 C:\Windows\system32\WS2_32.dll
ModLoad: 00007ffe`e4ea0000 00007ffe`e4eb5000 C:\Windows\SYSTEM32\ondemandconnroutehelper.dll
ModLoad: 00007ffe`eb640000 00007ffe`eb678000 C:\Windows\SYSTEM32\IPHLPAPI.DLL
ModLoad: 00007ffe`ea3e0000 00007ffe`ea4a8000 C:\Windows\SYSTEM32\winhttp.dll
ModLoad: 00007ffe`ede30000 00007ffe`ede8c000 C:\Windows\system32\mswsock.dll
ModLoad: 00007ffe`e6e60000 00007ffe`e6e6b000 C:\Windows\SYSTEM32\WINNSI.DLL
ModLoad: 00007ffe`ef4b0000 00007ffe`ef4b8000 C:\Windows\system32\NSI.dll
ModLoad: 00007ffe`e2d60000 00007ffe`e2f17000 C:\Windows\SYSTEM32\urlmon.dll
ModLoad: 00007ffe`ec740000 00007ffe`ec762000 C:\Windows\SYSTEM32\dwmapi.dll
ModLoad: 00007ffe`f1120000 00007ffe`f127a000 C:\Windows\system32\MSCTF.dll
ModLoad: 00007ffe`dced0000 00007ffe`dd082000 C:\Windows\SYSTEM32\ieapfltr.dll
ModLoad: 00007ffe`e5980000 00007ffe`e59d5000 C:\Windows\SYSTEM32\policymanager.dll
ModLoad: 00007ffe`e60a0000 00007ffe`e6132000 C:\Windows\SYSTEM32\msvcp110_win.dll
ModLoad: 00007ffe`ed2e0000 00007ffe`ed30a000 C:\Windows\System32\rmclient.dll
ModLoad: 00007ffe`e4670000 00007ffe`e46ba000 C:\Windows\system32\dataexchange.dll
ModLoad: 00007ffe`ec490000 00007ffe`ec738000 C:\Windows\SYSTEM32\d3d11.dll
ModLoad: 00007ffe`ec9a0000 00007ffe`eca83000 C:\Windows\SYSTEM32\dcomp.dll
ModLoad: 00007ffe`ec3e0000 00007ffe`ec482000 C:\Windows\SYSTEM32\dxgi.dll
(109c.1320): Break instruction exception - code 80000003 (first chance)

Create process 4252 breakpoint.
3:007> g
*** wait with pending attach

************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*C:\Symbols
Deferred cache*\\server\Symbols
Deferred srv*http://symbols.mozilla.org/firefox
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols;cache*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is:
ModLoad: 00007ff6`801e0000 00007ff6`801ee000 C:\Windows\system32\ApplicationFrameHost.exe
ModLoad: 00007ffe`f1f40000 00007ffe`f2101000 C:\Windows\SYSTEM32\ntdll.dll
ModLoad: 00007ffe`da490000 00007ffe`da4fd000 C:\Windows\system32\verifier.dll
ModLoad: 00007ffe`ef400000 00007ffe`ef4ad000 C:\Windows\system32\KERNEL32.DLL
ModLoad: 00007ffe`ee900000 00007ffe`eeae8000 C:\Windows\system32\KERNELBASE.dll
ModLoad: 00007ffe`ef5d0000 00007ffe`ef66d000 C:\Windows\system32\msvcrt.dll
ModLoad: 00007ffe`f1800000 00007ffe`f1a7d000 C:\Windows\system32\combase.dll
ModLoad: 00007ffe`f1af0000 00007ffe`f1c0c000 C:\Windows\system32\RPCRT4.dll
ModLoad: 00007ffe`ee6c0000 00007ffe`ee72a000 C:\Windows\system32\bcryptPrimitives.dll
ModLoad: 00007ffe`ee5e0000 00007ffe`ee5ef000 C:\Windows\system32\kernel.appcore.dll
ModLoad: 00007ffe`ef350000 00007ffe`ef3f7000 C:\Windows\system32\clbcatq.dll
ModLoad: 00007ffe`e3490000 00007ffe`e35b0000 C:\Windows\System32\ApplicationFrame.dll
ModLoad: 00007ffe`eeaf0000 00007ffe`eeba5000 C:\Windows\system32\SHCORE.dll
ModLoad: 00007ffe`ef4c0000 00007ffe`ef512000 C:\Windows\system32\SHLWAPI.dll
ModLoad: 00007ffe`f1c70000 00007ffe`f1df6000 C:\Windows\system32\GDI32.dll
ModLoad: 00007ffe`ef670000 00007ffe`ef7c6000 C:\Windows\system32\USER32.dll
ModLoad: 00007ffe`f1e70000 00007ffe`f1f31000 C:\Windows\system32\OLEAUT32.dll
ModLoad: 00007ffe`ec1d0000 00007ffe`ec356000 C:\Windows\System32\PROPSYS.dll
ModLoad: 00007ffe`ef9b0000 00007ffe`efa0b000 C:\Windows\system32\sechost.dll
ModLoad: 00007ffe`ed080000 00007ffe`ed180000 C:\Windows\System32\twinapi.appcore.dll
ModLoad: 00007ffe`ecee0000 00007ffe`ecf76000 C:\Windows\System32\UxTheme.dll
ModLoad: 00007ffe`ecf80000 00007ffe`ecfa7000 C:\Windows\System32\DEVOBJ.dll
ModLoad: 00007ffe`ef200000 00007ffe`ef243000 C:\Windows\system32\cfgmgr32.dll
ModLoad: 00007ffe`e4c10000 00007ffe`e4cc1000 C:\Windows\System32\TWINAPI.dll
ModLoad: 00007ffe`ea950000 00007ffe`eae95000 C:\Windows\System32\d2d1.dll
ModLoad: 00007ffe`ec490000 00007ffe`ec738000 C:\Windows\System32\d3d11.dll
ModLoad: 00007ffe`ec9a0000 00007ffe`eca83000 C:\Windows\System32\dcomp.dll
ModLoad: 00007ffe`ec740000 00007ffe`ec762000 C:\Windows\System32\dwmapi.dll
ModLoad: 00007ffe`ee490000 00007ffe`ee4b9000 C:\Windows\System32\bcrypt.dll
ModLoad: 00007ffe`ec3e0000 00007ffe`ec482000 C:\Windows\System32\dxgi.dll
ModLoad: 00007ffe`f1c30000 00007ffe`f1c6b000 C:\Windows\system32\IMM32.DLL
ModLoad: 00007ffe`ebc70000 00007ffe`ec103000 C:\Windows\System32\ActXPrxy.dll
ModLoad: 00007ffe`f1120000 00007ffe`f127a000 C:\Windows\system32\MSCTF.dll
ModLoad: 00007ffe`eaea0000 00007ffe`eb10f000 C:\Windows\system32\D3D10Warp.dll
ModLoad: 00007ffe`dbc10000 00007ffe`dbd6c000 C:\Windows\system32\UIAutomationCore.DLL
ModLoad: 00007ffe`edcc0000 00007ffe`edcdf000 C:\Windows\system32\USERENV.dll
ModLoad: 00007ffe`ee5b0000 00007ffe`ee5c4000 C:\Windows\system32\profapi.dll
ModLoad: 00007ffe`efbc0000 00007ffe`f111c000 C:\Windows\system32\SHELL32.dll
ModLoad: 00007ffe`eebb0000 00007ffe`ef1f4000 C:\Windows\system32\windows.storage.dll
ModLoad: 00007ffe`ef520000 00007ffe`ef5c7000 C:\Windows\system32\advapi32.dll
ModLoad: 00007ffe`ee560000 00007ffe`ee5ab000 C:\Windows\system32\powrprof.dll
ModLoad: 00007ffe`ec110000 00007ffe`ec177000 C:\Windows\system32\Bcp47Langs.dll
ModLoad: 00007ffe`eb8c0000 00007ffe`eba71000 C:\Windows\system32\windowscodecs.dll
ModLoad: 00007ffe`e92a0000 00007ffe`e93ae000 C:\Windows\SYSTEM32\mrmcorer.dll
ModLoad: 00007ffe`e7ce0000 00007ffe`e8063000 C:\Windows\SYSTEM32\iertutil.dll
ModLoad: 00007ffe`e91f0000 00007ffe`e9298000 C:\Windows\System32\Windows.UI.dll
(a2c.12ac): Break instruction exception - code 80000003 (first chance)

Create process 2604 breakpoint.
4:007> g
(ba0.13fc): Windows Runtime Originate Error - code 40080201 (first chance)
(ba0.13fc): Windows Runtime Originate Error - code 40080201 (first chance)
(ba0.13fc): Windows Runtime Originate Error - code 40080201 (first chance)
(ba0.13fc): Windows Runtime Originate Error - code 40080201 (first chance)
(ba0.13fc): Windows Runtime Originate Error - code 40080201 (first chance)
(ba0.13fc): Windows Runtime Originate Error - code 40080201 (first chance)
(ba0.13fc): Windows Runtime Originate Error - code 40080201 (first chance)
(93c.460): Break instruction exception - code 80000003 (first chance)

Exception 0x80000003 in process 2364.
0:091> g
(ba0.13fc): Windows Runtime Originate Error - code 40080201 (first chance)
(109c.d24): Unknown exception - code 00000005 (first chance)
inetcore\apfilter\src\util\unmanaged\core\src\useraccountstore.cpp(48)\ieapfltr.dll!00007FFEDCF26589: (caller: 00007FFEDCF26B7E) Exception(1) tid(d24) 80040154 Class not registered
(ba0.13fc): Windows Runtime Originate Error - code 40080201 (first chance)
(ba0.13fc): Windows Runtime Originate Error - code 40080201 (first chance)
(109c.d24): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.

3:087> .lastevent
Last event: 109c.d24: Access violation - code c0000005 (first chance)
debugger time: Fri May 13 22:47:29.430 2016 (UTC + 2:00)

3:087> |.
. 3 id: 109c attach name: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe

3:087> .exr -1
ExceptionAddress: 00007ffede149578 (edgehtml!CBaseScriptable::PrivateQueryInterface+0x0000000000000118)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000008
Attempt to read from address 0000000000000008

3:087> lm on
start end module name
00007ff6`5da80000 00007ff6`5dad1000 microsoftedgecp microsoftedgecp.exe
00007ffe`d8170000 00007ffe`d8705000 EMODEL EMODEL.dll
00007ffe`da490000 00007ffe`da4fd000 verifier verifier.dll
00007ffe`db010000 00007ffe`db0bd000 ieproxy ieproxy.dll
00007ffe`dced0000 00007ffe`dd082000 ieapfltr ieapfltr.dll
00007ffe`dd230000 00007ffe`dd240000 msimtf msimtf.dll
00007ffe`dd240000 00007ffe`dd261000 srpapi srpapi.dll
00007ffe`dd270000 00007ffe`dd2ae000 MLANG MLANG.dll
00007ffe`dd2b0000 00007ffe`dda34000 chakra chakra.dll
00007ffe`dda40000 00007ffe`defb6000 edgehtml edgehtml.dll
00007ffe`dfb70000 00007ffe`dfb7e000 tokenbinding tokenbinding.dll
00007ffe`e13c0000 00007ffe`e13d5000 profext profext.dll
00007ffe`e1430000 00007ffe`e16d9000 WININET WININET.dll
00007ffe`e2d60000 00007ffe`e2f17000 urlmon urlmon.dll
00007ffe`e2f70000 00007ffe`e2fcc000 ninput ninput.dll
00007ffe`e4670000 00007ffe`e46ba000 dataexchange dataexchange.dll
00007ffe`e4c10000 00007ffe`e4cc1000 twinapi twinapi.dll
00007ffe`e4ea0000 00007ffe`e4eb5000 ondemandconnroutehelper ondemandconnroutehelper.dll
00007ffe`e5980000 00007ffe`e59d5000 policymanager policymanager.dll
00007ffe`e60a0000 00007ffe`e6132000 msvcp110_win msvcp110_win.dll
00007ffe`e62f0000 00007ffe`e62fa000 rasadhlp rasadhlp.dll
00007ffe`e6ca0000 00007ffe`e6d07000 fwpuclnt fwpuclnt.dll
00007ffe`e6e60000 00007ffe`e6e6b000 WINNSI WINNSI.DLL
00007ffe`e6f30000 00007ffe`e6f58000 IDStore IDStore.dll
00007ffe`e6f80000 00007ffe`e6f9a000 EShims EShims.dll
00007ffe`e72b0000 00007ffe`e72bc000 dispex dispex.dll
00007ffe`e7410000 00007ffe`e749b000 directmanipulation directmanipulation.dll
00007ffe`e7550000 00007ffe`e76d5000 windows_globalization windows.globalization.dll
00007ffe`e76e0000 00007ffe`e7940000 DWrite DWrite.dll
00007ffe`e7ce0000 00007ffe`e8063000 iertutil iertutil.dll
00007ffe`e8070000 00007ffe`e81a6000 WinTypes WinTypes.dll
00007ffe`e91f0000 00007ffe`e9298000 Windows_UI Windows.UI.dll
00007ffe`e92a0000 00007ffe`e93ae000 MrmCoreR MrmCoreR.dll
00007ffe`ea3e0000 00007ffe`ea4a8000 winhttp winhttp.dll
00007ffe`ea950000 00007ffe`eae95000 d2d1 d2d1.dll
00007ffe`eaea0000 00007ffe`eb10f000 d3d10warp d3d10warp.dll
00007ffe`eb600000 00007ffe`eb61b000 MPR MPR.dll
00007ffe`eb640000 00007ffe`eb678000 IPHLPAPI IPHLPAPI.DLL
00007ffe`ebc70000 00007ffe`ec103000 ActXPrxy ActXPrxy.dll
00007ffe`ec110000 00007ffe`ec177000 Bcp47Langs Bcp47Langs.dll
00007ffe`ec1d0000 00007ffe`ec356000 PROPSYS PROPSYS.dll
00007ffe`ec360000 00007ffe`ec37c000 SAMLIB SAMLIB.dll
00007ffe`ec3e0000 00007ffe`ec482000 dxgi dxgi.dll
00007ffe`ec490000 00007ffe`ec738000 d3d11 d3d11.dll
00007ffe`ec740000 00007ffe`ec762000 dwmapi dwmapi.dll
00007ffe`ec9a0000 00007ffe`eca83000 dcomp dcomp.dll
00007ffe`ece40000 00007ffe`eceb9000 apphelp apphelp.dll
00007ffe`ecee0000 00007ffe`ecf76000 uxtheme uxtheme.dll
00007ffe`ecfd0000 00007ffe`ed07a000 DNSAPI DNSAPI.dll
00007ffe`ed080000 00007ffe`ed180000 twinapi_appcore twinapi.appcore.dll
00007ffe`ed2e0000 00007ffe`ed30a000 rmclient rmclient.dll
00007ffe`ed3e0000 00007ffe`ed412000 fwbase fwbase.dll
00007ffe`ed9b0000 00007ffe`ed9bd000 tbs tbs.dll
00007ffe`eda50000 00007ffe`eda81000 ntmarta ntmarta.dll
00007ffe`edb70000 00007ffe`edba4000 rsaenh rsaenh.dll
00007ffe`edcc0000 00007ffe`edcdf000 USERENV USERENV.dll
00007ffe`ede30000 00007ffe`ede8c000 mswsock mswsock.dll
00007ffe`edee0000 00007ffe`edef7000 cryptsp cryptsp.dll
00007ffe`ee000000 00007ffe`ee00b000 CRYPTBASE CRYPTBASE.dll
00007ffe`ee1e0000 00007ffe`ee20d000 SspiCli SspiCli.dll
00007ffe`ee3f0000 00007ffe`ee489000 sxs sxs.dll
00007ffe`ee490000 00007ffe`ee4b9000 bcrypt bcrypt.dll
00007ffe`ee560000 00007ffe`ee5ab000 powrprof powrprof.dll
00007ffe`ee5b0000 00007ffe`ee5c4000 profapi profapi.dll
00007ffe`ee5d0000 00007ffe`ee5e0000 MSASN1 MSASN1.dll
00007ffe`ee5e0000 00007ffe`ee5ef000 kernel_appcore kernel.appcore.dll
00007ffe`ee6c0000 00007ffe`ee72a000 bcryptPrimitives bcryptPrimitives.dll
00007ffe`ee730000 00007ffe`ee8f8000 CRYPT32 CRYPT32.dll
00007ffe`ee900000 00007ffe`eeae8000 KERNELBASE KERNELBASE.dll
00007ffe`eeaf0000 00007ffe`eeba5000 shcore shcore.dll
00007ffe`eebb0000 00007ffe`ef1f4000 windows_storage windows.storage.dll
00007ffe`ef200000 00007ffe`ef243000 cfgmgr32 cfgmgr32.dll
00007ffe`ef250000 00007ffe`ef2d6000 firewallapi firewallapi.dll
00007ffe`ef2e0000 00007ffe`ef335000 WINTRUST WINTRUST.dll
00007ffe`ef400000 00007ffe`ef4ad000 KERNEL32 KERNEL32.DLL
00007ffe`ef4b0000 00007ffe`ef4b8000 NSI NSI.dll
00007ffe`ef4c0000 00007ffe`ef512000 shlwapi shlwapi.dll
00007ffe`ef520000 00007ffe`ef5c7000 ADVAPI32 ADVAPI32.dll
00007ffe`ef5d0000 00007ffe`ef66d000 msvcrt msvcrt.dll
00007ffe`ef670000 00007ffe`ef7c6000 USER32 USER32.dll
00007ffe`ef940000 00007ffe`ef9ab000 WS2_32 WS2_32.dll
00007ffe`ef9b0000 00007ffe`efa0b000 sechost sechost.dll
00007ffe`efbc0000 00007ffe`f111c000 SHELL32 SHELL32.dll
00007ffe`f1120000 00007ffe`f127a000 MSCTF MSCTF.dll
00007ffe`f16b0000 00007ffe`f17f3000 ole32 ole32.dll
00007ffe`f1800000 00007ffe`f1a7d000 combase combase.dll
00007ffe`f1af0000 00007ffe`f1c0c000 RPCRT4 RPCRT4.dll
00007ffe`f1c30000 00007ffe`f1c6b000 IMM32 IMM32.DLL
00007ffe`f1c70000 00007ffe`f1df6000 GDI32 GDI32.dll
00007ffe`f1e70000 00007ffe`f1f31000 OLEAUT32 OLEAUT32.dll
00007ffe`f1f40000 00007ffe`f2101000 ntdll ntdll.dll

3:087> kn 0x64
# Child-SP RetAddr Call Site
00 000000a6`1284bce0 00007ffe`ddedf3c0 edgehtml!CBaseScriptable::PrivateQueryInterface+0x118
01 000000a6`1284bd10 00007ffe`dd4b74aa edgehtml!CBaseTypeOperations::QueryObjectInterface+0x110
02 000000a6`1284bd60 00007ffe`dd4bc0da chakra!Js::CustomExternalObject::QueryObjectInterface+0x6a
03 000000a6`1284bdb0 00007ffe`f185a30e chakra!JavascriptDispatch::QueryInterface+0x25a
04 000000a6`1284be10 00007ffe`f185f422 combase!ObtainStdIDFromUnk+0x3e [d:\th\com\combase\dcomrem\stdid.cxx @ 2133]
05 (Inline Function) --------`-------- combase!StdMarshalObject+0x4a [d:\th\com\combase\dcomrem\marshal.cxx @ 9570]
06 000000a6`1284bea0 00007ffe`f185d687 combase!CDestObjectWrapper::MarshalInterface+0x4f2 [d:\th\com\combase\dcomrem\coapi.cxx @ 718]
07 000000a6`1284bff0 00007ffe`f1807c77 combase!CoMarshalInterface+0x5e7 [d:\th\com\combase\dcomrem\coapi.cxx @ 1001]
08 000000a6`1284c0e0 00007ffe`f1e9bd20 combase!WdtpInterfacePointer_UserMarshal64+0xc7 [d:\th\com\combase\proxy\proxy\transmit.cxx @ 1926]
09 000000a6`1284c1f0 00007ffe`f1b61a5b OLEAUT32!ITypeInfo_LocalAddressOfMember_Thunk+0x8f40
0a 000000a6`1284c230 00007ffe`f1b61908 RPCRT4!Ndr64UserMarshallMarshallInternal+0x87
0b 000000a6`1284c2a0 00007ffe`f1b618a6 RPCRT4!Ndr64UserMarshallPointeeMarshall+0x44
0c 000000a6`1284c2e0 00007ffe`f1bc553b RPCRT4!Ndr64UserMarshalMarshall+0x6a
0d 000000a6`1284c310 00007ffe`f1bca362 RPCRT4!Ndr64pServerMarshal+0x1ab
0e 000000a6`1284c350 00007ffe`f1b66096 RPCRT4!Ndr64StubWorker+0x1012
0f 000000a6`1284ca20 00007ffe`f180392a RPCRT4!NdrStubCall3+0xf6
10 000000a6`1284ca90 00007ffe`f188eafc combase!CStdStubBuffer_Invoke+0x9a [d:\th\com\combase\ndr\ndrole\stub.cxx @ 1446]
11 (Inline Function) --------`-------- combase!InvokeStubWithExceptionPolicyAndTracing::__l7::<lambda_b8ffcec6d47a5635f374132234a8dd15>::operator()+0x2c [d:\th\com\combase\dcomrem\channelb.cxx @ 1805]
12 000000a6`1284cad0 00007ffe`f188e675 combase!ObjectMethodExceptionHandlingAction<<lambda_b8ffcec6d47a5635f374132234a8dd15> >+0x5c [d:\th\com\combase\dcomrem\excepn.hxx @ 91]
13 (Inline Function) --------`-------- combase!InvokeStubWithExceptionPolicyAndTracing+0x9e [d:\th\com\combase\dcomrem\channelb.cxx @ 1808]
14 000000a6`1284cb40 00007ffe`f1882374 combase!DefaultStubInvoke+0x275 [d:\th\com\combase\dcomrem\channelb.cxx @ 1880]
15 (Inline Function) --------`-------- combase!SyncStubCall::Invoke+0x1b [d:\th\com\combase\dcomrem\channelb.cxx @ 1934]
16 (Inline Function) --------`-------- combase!SyncServerCall::StubInvoke+0x1b [d:\th\com\combase\dcomrem\servercall.hpp @ 736]
17 (Inline Function) --------`-------- combase!StubInvoke+0x297 [d:\th\com\combase\dcomrem\channelb.cxx @ 2154]
18 000000a6`1284cd60 00007ffe`f188072f combase!ServerCall::ContextInvoke+0x464 [d:\th\com\combase\dcomrem\ctxchnl.cxx @ 1568]
19 (Inline Function) --------`-------- combase!CServerChannel::ContextInvoke+0x85 [d:\th\com\combase\dcomrem\ctxchnl.cxx @ 1458]
1a (Inline Function) --------`-------- combase!DefaultInvokeInApartment+0xa2 [d:\th\com\combase\dcomrem\callctrl.cxx @ 3438]
1b (Inline Function) --------`-------- combase!ClassicSTAInvokeInApartment+0x3b7 [d:\th\com\combase\dcomrem\callctrl.cxx @ 3202]
1c 000000a6`1284d030 00007ffe`f187fa2d combase!AppInvoke+0x72f [d:\th\com\combase\dcomrem\channelb.cxx @ 1606]
1d 000000a6`1284d160 00007ffe`f187e083 combase!ComInvokeWithLockAndIPID+0xb2d [d:\th\com\combase\dcomrem\channelb.cxx @ 2686]
1e (Inline Function) --------`-------- combase!ComInvoke+0x2bf [d:\th\com\combase\dcomrem\channelb.cxx @ 2223]
1f (Inline Function) --------`-------- combase!ThreadDispatch+0x352 [d:\th\com\combase\dcomrem\chancont.cxx @ 414]
20 000000a6`1284d3f0 00007ffe`ef681169 combase!ThreadWndProc+0x603 [d:\th\com\combase\dcomrem\chancont.cxx @ 722]
21 000000a6`1284d520 00007ffe`ef680c97 USER32!UserCallWinProcCheckWow+0x1f9
22 000000a6`1284d610 00007ffe`d820d278 USER32!DispatchMessageWorker+0x1a7
23 000000a6`1284d690 00007ffe`d820fd53 EMODEL!CTabWindow::_TabWindowThreadProc+0x4d8
24 000000a6`1284f8e0 00007ffe`e7d2726f EMODEL!LCIETab_ThreadProc+0x2b3
25 000000a6`1284fa10 00007ffe`ef418102 iertutil!_IsoThreadProc_WrapperToReleaseScope+0x1f
26 000000a6`1284fa40 00007ffe`f1f9c5b4 KERNEL32!BaseThreadInitThunk+0x22
27 000000a6`1284fa70 00000000`00000000 ntdll!RtlUserThreadStart+0x34

3:087> .exr -1
ExceptionAddress: 00007ffede149578 (edgehtml!CBaseScriptable::PrivateQueryInterface+0x0000000000000118)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000008
Attempt to read from address 0000000000000008

3:087> .if ($vvalid(@$scopeip - 138, 138)) { u @$scopeip - 138 @$scopeip - 1; };
edgehtml!TSmartPointer<IPropertyStore,CStrongReferenceTraits>::~TSmartPointer<IPropertyStore,CStrongReferenceTraits>+0x20:
00007ffe`de149440 cc int 3
00007ffe`de149441 cc int 3
00007ffe`de149442 cc int 3
00007ffe`de149443 cc int 3
edgehtml!Layout::SLayoutSpace::IsFragmentHeightDefined:
00007ffe`de149444 48894c2408 mov qword ptr [rsp+8],rcx
00007ffe`de149449 488b4c2408 mov rcx,qword ptr [rsp+8]
00007ffe`de14944e 817908ffffff3f cmp dword ptr [rcx+8],3FFFFFFFh
00007ffe`de149455 0f95c0 setne al
00007ffe`de149458 c3 ret
00007ffe`de149459 cc int 3
00007ffe`de14945a cc int 3
00007ffe`de14945b cc int 3
00007ffe`de14945c cc int 3
00007ffe`de14945d cc int 3
00007ffe`de14945e cc int 3
00007ffe`de14945f cc int 3
edgehtml!CBaseScriptable::PrivateQueryInterface:
00007ffe`de149460 48895c2408 mov qword ptr [rsp+8],rbx
00007ffe`de149465 57 push rdi
00007ffe`de149466 4883ec20 sub rsp,20h
00007ffe`de14946a 8b02 mov eax,dword ptr [rdx]
00007ffe`de14946c 498bf8 mov rdi,r8
00007ffe`de14946f 41b816075130 mov r8d,30510716h
00007ffe`de149475 413bc0 cmp eax,r8d
00007ffe`de149478 0f8730010000 ja edgehtml!CBaseScriptable::PrivateQueryInterface+0x14e (00007ffe`de1495ae)
00007ffe`de14947e 0f8408010000 je edgehtml!CBaseScriptable::PrivateQueryInterface+0x12c (00007ffe`de14958c)
00007ffe`de149484 85c0 test eax,eax
00007ffe`de149486 0f84c2000000 je edgehtml!CBaseScriptable::PrivateQueryInterface+0xee (00007ffe`de14954e)
00007ffe`de14948c 83e808 sub eax,8
00007ffe`de14948f 0f848d000000 je edgehtml!CBaseScriptable::PrivateQueryInterface+0xc2 (00007ffe`de149522)
00007ffe`de149495 2df8030200 sub eax,203F8h
00007ffe`de14949a 0f847b010000 je edgehtml!CBaseScriptable::PrivateQueryInterface+0x1bb (00007ffe`de14961b)
00007ffe`de1494a0 2d9af04e30 sub eax,304EF09Ah
00007ffe`de1494a5 7458 je edgehtml!CBaseScriptable::PrivateQueryInterface+0x9f (00007ffe`de1494ff)
00007ffe`de1494a7 2d65120000 sub eax,1265h
00007ffe`de1494ac 742f je edgehtml!CBaseScriptable::PrivateQueryInterface+0x7d (00007ffe`de1494dd)
00007ffe`de1494ae 83f815 cmp eax,15h
00007ffe`de1494b1 0f85b6000000 jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x10d (00007ffe`de14956d)
00007ffe`de1494b7 488b02 mov rax,qword ptr [rdx]
00007ffe`de1494ba 482b05b726ac00 sub rax,qword ptr [edgehtml!IID_ICanvasGradient (00007ffe`dec0bb78)]
00007ffe`de1494c1 750b jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x6e (00007ffe`de1494ce)
00007ffe`de1494c3 488b4208 mov rax,qword ptr [rdx+8]
00007ffe`de1494c7 482b05b226ac00 sub rax,qword ptr [edgehtml!IID_ICanvasGradient+0x8 (00007ffe`dec0bb80)]
00007ffe`de1494ce 4885c0 test rax,rax
00007ffe`de1494d1 0f8596000000 jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x10d (00007ffe`de14956d)
00007ffe`de1494d7 e820b82a00 call edgehtml!Abandonment::DeprecatedAPI (00007ffe`de3f4cfc)
00007ffe`de1494dc cc int 3
00007ffe`de1494dd 488b02 mov rax,qword ptr [rdx]
00007ffe`de1494e0 482b05a126ac00 sub rax,qword ptr [edgehtml!IID_ICanvasRenderingContext2D (00007ffe`dec0bb88)]
00007ffe`de1494e7 750b jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x94 (00007ffe`de1494f4)
00007ffe`de1494e9 488b4208 mov rax,qword ptr [rdx+8]
00007ffe`de1494ed 482b059c26ac00 sub rax,qword ptr [edgehtml!IID_ICanvasRenderingContext2D+0x8 (00007ffe`dec0bb90)]
00007ffe`de1494f4 4885c0 test rax,rax
00007ffe`de1494f7 7574 jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x10d (00007ffe`de14956d)
00007ffe`de1494f9 e8feb72a00 call edgehtml!Abandonment::DeprecatedAPI (00007ffe`de3f4cfc)
00007ffe`de1494fe cc int 3
00007ffe`de1494ff 488b02 mov rax,qword ptr [rdx]
00007ffe`de149502 482b0517937e00 sub rax,qword ptr [edgehtml!CLSID_CBase (00007ffe`de932820)]
00007ffe`de149509 750b jne edgehtml!CBaseScriptable::PrivateQueryInterface+0xb6 (00007ffe`de149516)
00007ffe`de14950b 488b4208 mov rax,qword ptr [rdx+8]
00007ffe`de14950f 482b0512937e00 sub rax,qword ptr [edgehtml!CLSID_CBase+0x8 (00007ffe`de932828)]
00007ffe`de149516 4885c0 test rax,rax
00007ffe`de149519 7552 jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x10d (00007ffe`de14956d)
00007ffe`de14951b 48890f mov qword ptr [rdi],rcx
00007ffe`de14951e 33c0 xor eax,eax
00007ffe`de149520 eb21 jmp edgehtml!CBaseScriptable::PrivateQueryInterface+0xe3 (00007ffe`de149543)
00007ffe`de149522 488b02 mov rax,qword ptr [rdx]
00007ffe`de149525 482b05a4927e00 sub rax,qword ptr [edgehtml!IID_IProxyManager (00007ffe`de9327d0)]
00007ffe`de14952c 750b jne edgehtml!CBaseScriptable::PrivateQueryInterface+0xd9 (00007ffe`de149539)
00007ffe`de14952e 488b4208 mov rax,qword ptr [rdx+8]
00007ffe`de149532 482b059f927e00 sub rax,qword ptr [edgehtml!IID_IProxyManager+0x8 (00007ffe`de9327d8)]
00007ffe`de149539 4885c0 test rax,rax
00007ffe`de14953c 752f jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x10d (00007ffe`de14956d)
00007ffe`de14953e b802400080 mov eax,80004002h
00007ffe`de149543 488b5c2430 mov rbx,qword ptr [rsp+30h]
00007ffe`de149548 4883c420 add rsp,20h
00007ffe`de14954c 5f pop rdi
00007ffe`de14954d c3 ret
00007ffe`de14954e 488b02 mov rax,qword ptr [rdx]
00007ffe`de149551 482b05e8927e00 sub rax,qword ptr [edgehtml!GUID_00000000_0000_0000_c000_000000000046 (00007ffe`de932840)]
00007ffe`de149558 750b jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x105 (00007ffe`de149565)
00007ffe`de14955a 488b4208 mov rax,qword ptr [rdx+8]
00007ffe`de14955e 482b05e3927e00 sub rax,qword ptr [edgehtml!GUID_00000000_0000_0000_c000_000000000046+0x8 (00007ffe`de932848)]
00007ffe`de149565 4885c0 test rax,rax
00007ffe`de149568 7503 jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x10d (00007ffe`de14956d)
00007ffe`de14956a 48890f mov qword ptr [rdi],rcx
00007ffe`de14956d 488b3f mov rdi,qword ptr [rdi]
00007ffe`de149570 4885ff test rdi,rdi
00007ffe`de149573 74c9 je edgehtml!CBaseScriptable::PrivateQueryInterface+0xde (00007ffe`de14953e)
00007ffe`de149575 488b07 mov rax,qword ptr [rdi]

3:087> .if ($vvalid(@$scopeip, 138)) { u @$scopeip @$scopeip + 137; };
edgehtml!CBaseScriptable::PrivateQueryInterface+0x118:
00007ffe`de149578 488b5808 mov rbx,qword ptr [rax+8]
00007ffe`de14957c 488bcb mov rcx,rbx
00007ffe`de14957f ff1563e17900 call qword ptr [edgehtml!_guard_check_icall_fptr (00007ffe`de8e76e8)]
00007ffe`de149585 488bcf mov rcx,rdi
00007ffe`de149588 ffd3 call rbx
00007ffe`de14958a eb92 jmp edgehtml!CBaseScriptable::PrivateQueryInterface+0xbe (00007ffe`de14951e)
00007ffe`de14958c 488b02 mov rax,qword ptr [rdx]
00007ffe`de14958f 482b050226ac00 sub rax,qword ptr [edgehtml!IID_ICanvasPattern (00007ffe`dec0bb98)]
00007ffe`de149596 750b jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x143 (00007ffe`de1495a3)
00007ffe`de149598 488b4208 mov rax,qword ptr [rdx+8]
00007ffe`de14959c 482b05fd25ac00 sub rax,qword ptr [edgehtml!IID_ICanvasPattern+0x8 (00007ffe`dec0bba0)]
00007ffe`de1495a3 4885c0 test rax,rax
00007ffe`de1495a6 75c5 jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x10d (00007ffe`de14956d)
00007ffe`de1495a8 e84fb72a00 call edgehtml!Abandonment::DeprecatedAPI (00007ffe`de3f4cfc)
00007ffe`de1495ad cc int 3
00007ffe`de1495ae 3d18075130 cmp eax,30510718h
00007ffe`de1495b3 0f84d8000000 je edgehtml!CBaseScriptable::PrivateQueryInterface+0x231 (00007ffe`de149691)
00007ffe`de1495b9 3d1a075130 cmp eax,3051071Ah
00007ffe`de1495be 0f84a7000000 je edgehtml!CBaseScriptable::PrivateQueryInterface+0x20b (00007ffe`de14966b)
00007ffe`de1495c4 3d1600cb9b cmp eax,9BCB0016h
00007ffe`de1495c9 740e je edgehtml!CBaseScriptable::PrivateQueryInterface+0x179 (00007ffe`de1495d9)
00007ffe`de1495cb 3d6098efa6 cmp eax,0A6EF9860h
00007ffe`de1495d0 7449 je edgehtml!CBaseScriptable::PrivateQueryInterface+0x1bb (00007ffe`de14961b)
00007ffe`de1495d2 3d0e9831a7 cmp eax,0A731980Eh
00007ffe`de1495d7 7594 jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x10d (00007ffe`de14956d)
00007ffe`de1495d9 488b02 mov rax,qword ptr [rdx]
00007ffe`de1495dc 482b05a5417d00 sub rax,qword ptr [edgehtml!IID_ITracker (00007ffe`de91d788)]
00007ffe`de1495e3 750b jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x190 (00007ffe`de1495f0)
00007ffe`de1495e5 488b4208 mov rax,qword ptr [rdx+8]
00007ffe`de1495e9 482b05a0417d00 sub rax,qword ptr [edgehtml!IID_ITracker+0x8 (00007ffe`de91d790)]
00007ffe`de1495f0 4885c0 test rax,rax
00007ffe`de1495f3 7420 je edgehtml!CBaseScriptable::PrivateQueryInterface+0x1b5 (00007ffe`de149615)
00007ffe`de1495f5 488b02 mov rax,qword ptr [rdx]
00007ffe`de1495f8 482b0579417d00 sub rax,qword ptr [edgehtml!IID_ITrackerJS9 (00007ffe`de91d778)]
00007ffe`de1495ff 750b jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x1ac (00007ffe`de14960c)
00007ffe`de149601 488b4208 mov rax,qword ptr [rdx+8]
00007ffe`de149605 482b0574417d00 sub rax,qword ptr [edgehtml!IID_ITrackerJS9+0x8 (00007ffe`de91d780)]
00007ffe`de14960c 4885c0 test rax,rax
00007ffe`de14960f 0f8558ffffff jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x10d (00007ffe`de14956d)
00007ffe`de149615 e8e2b62a00 call edgehtml!Abandonment::DeprecatedAPI (00007ffe`de3f4cfc)
00007ffe`de14961a cc int 3
00007ffe`de14961b 488b02 mov rax,qword ptr [rdx]
00007ffe`de14961e 482b0533967c00 sub rax,qword ptr [edgehtml!GUID_00020400_0000_0000_c000_000000000046 (00007ffe`de912c58)]
00007ffe`de149625 750b jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x1d2 (00007ffe`de149632)
00007ffe`de149627 488b4208 mov rax,qword ptr [rdx+8]
00007ffe`de14962b 482b052e967c00 sub rax,qword ptr [edgehtml!GUID_00020400_0000_0000_c000_000000000046+0x8 (00007ffe`de912c60)]
00007ffe`de149632 4885c0 test rax,rax
00007ffe`de149635 7420 je edgehtml!CBaseScriptable::PrivateQueryInterface+0x1f7 (00007ffe`de149657)
00007ffe`de149637 488b02 mov rax,qword ptr [rdx]
00007ffe`de14963a 482b05a7467d00 sub rax,qword ptr [edgehtml!GUID_a6ef9860_c720_11d0_9337_00a0c90dcaa9 (00007ffe`de91dce8)]
00007ffe`de149641 750b jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x1ee (00007ffe`de14964e)
00007ffe`de149643 488b4208 mov rax,qword ptr [rdx+8]
00007ffe`de149647 482b05a2467d00 sub rax,qword ptr [edgehtml!GUID_a6ef9860_c720_11d0_9337_00a0c90dcaa9+0x8 (00007ffe`de91dcf0)]
00007ffe`de14964e 4885c0 test rax,rax
00007ffe`de149651 0f8516ffffff jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x10d (00007ffe`de14956d)
00007ffe`de149657 488bd7 mov rdx,rdi
00007ffe`de14965a e8a14bd5ff call edgehtml!JsGetVarDispatch (00007ffe`dde9e200)
00007ffe`de14965f 8bc8 mov ecx,eax
00007ffe`de149661 e84e64dbff call edgehtml!Abandonment::RequiredQI (00007ffe`ddeffab4)
00007ffe`de149666 e902ffffff jmp edgehtml!CBaseScriptable::PrivateQueryInterface+0x10d (00007ffe`de14956d)
00007ffe`de14966b 488b02 mov rax,qword ptr [rdx]
00007ffe`de14966e 482b054325ac00 sub rax,qword ptr [edgehtml!IID_ICanvasImageData (00007ffe`dec0bbb8)]
00007ffe`de149675 750b jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x222 (00007ffe`de149682)
00007ffe`de149677 488b4208 mov rax,qword ptr [rdx+8]
00007ffe`de14967b 482b053e25ac00 sub rax,qword ptr [edgehtml!IID_ICanvasImageData+0x8 (00007ffe`dec0bbc0)]
00007ffe`de149682 4885c0 test rax,rax
00007ffe`de149685 0f85e2feffff jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x10d (00007ffe`de14956d)
00007ffe`de14968b e86cb62a00 call edgehtml!Abandonment::DeprecatedAPI (00007ffe`de3f4cfc)
00007ffe`de149690 cc int 3
00007ffe`de149691 488b02 mov rax,qword ptr [rdx]
00007ffe`de149694 482b050d25ac00 sub rax,qword ptr [edgehtml!IID_ICanvasTextMetrics (00007ffe`dec0bba8)]
00007ffe`de14969b 750b jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x248 (00007ffe`de1496a8)
00007ffe`de14969d 488b4208 mov rax,qword ptr [rdx+8]
00007ffe`de1496a1 482b050825ac00 sub rax,qword ptr [edgehtml!IID_ICanvasTextMetrics+0x8 (00007ffe`dec0bbb0)]
00007ffe`de1496a8 4885c0 test rax,rax
00007ffe`de1496ab 0f85bcfeffff jne edgehtml!CBaseScriptable::PrivateQueryInterface+0x10d (00007ffe`de14956d)

3:087> rM 0x7D
rax=0000000000000000 rbx=00007ffede149460 rcx=00000206cecb8a80
rdx=00007ffef19c2400 rsi=0000020ed91b8cc0 rdi=000000a61284c070
rip=00007ffede149578 rsp=000000a61284bce0 rbp=00007ffef19c2400
r8=0000000030510716 r9=00007ffef19c2400 r10=000000a61284c4e0
r11=000000a61284bd98 r12=00000206cbe8fc00 r13=0000020ed91b8d20
r14=00000206cecb8a80 r15=000000a61284bf10
iopl=0 nv up ei pl nz na pe nc
cs=0033 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010202
fpcw=027F fpsw=0000 fptw=0000
st0= 0.000008122063317480850e-4933 st1= 0.000004241386600370740e-3700
st2= 0.000000000000000000000e+0000 st3= 0.000207705784387050740e+4685
st4=-0.000287088481174333520e-2756 st5=-0.000194645719887826200e-4851
st6= 0.000033813029637256570e+4923 st7= 0.000142071419318404030e+3351
mm0=00000206c8490000 mm1=00000206cb1cc548
mm2=0000000000000000 mm3=00007ffef1fd25c7
mm4=00007ffef1f65c5f mm5=00007ffedcf28254
mm6=00007ffedcf28029 mm7=00007ffedcf26589
xmm0=4.59149e-041 -1.2684e+030 4.59149e-041 -1.34872e+030
xmm1=4.59149e-041 -1.34781e+030 4.59149e-041 -2.43984e+030
xmm2=0 0 0 0
xmm3=0 0 0 0
xmm4=0 0 0 0
xmm5=0 0 0 0
xmm6=0 0 0 0
xmm7=0 0 0 0
xmm8=0 0 0 0
xmm9=0 0 0 0
xmm10=0 0 0 0
xmm11=0 0 0 0
xmm12=0 0 0 0
xmm13=0 0 0 0
xmm14=0 0 0 0
xmm15=0 0 0 0
dr0=0000000000000000 dr1=0000000000000000 dr2=0000000000000000
dr3=0000000000000000 dr6=0000000000000000 dr7=0000000000000000
edgehtml!CBaseScriptable::PrivateQueryInterface+0x118:
00007ffe`de149578 488b5808 mov rbx,qword ptr [rax+8] ds:00000000`00000008=????????????????

3:087> dpp @$ea - 10*$ptrsize L10;
ffffffff`ffffff88 ????????`????????
ffffffff`ffffff90 ????????`????????
ffffffff`ffffff98 ????????`????????
ffffffff`ffffffa0 ????????`????????
ffffffff`ffffffa8 ????????`????????
ffffffff`ffffffb0 ????????`????????
ffffffff`ffffffb8 ????????`????????
ffffffff`ffffffc0 ????????`????????
ffffffff`ffffffc8 ????????`????????
ffffffff`ffffffd0 ????????`????????
ffffffff`ffffffd8 ????????`????????
ffffffff`ffffffe0 ????????`????????
ffffffff`ffffffe8 ????????`????????
ffffffff`fffffff0 ????????`????????
ffffffff`fffffff8 ????????`????????
00000000`00000000 ????????`????????

3:087> dpp @$ea L10;
00000000`00000008 ????????`????????
00000000`00000010 ????????`????????
00000000`00000018 ????????`????????
00000000`00000020 ????????`????????
00000000`00000028 ????????`????????
00000000`00000030 ????????`????????
00000000`00000038 ????????`????????
00000000`00000040 ????????`????????
00000000`00000048 ????????`????????
00000000`00000050 ????????`????????
00000000`00000058 ????????`????????
00000000`00000060 ????????`????????
00000000`00000068 ????????`????????
00000000`00000070 ????????`????????
00000000`00000078 ????????`????????
00000000`00000080 ????????`????????

3:087> dpp @$ea2 - 10*$ptrsize L10;
Bad register error at '@$ea2 - 10*$ptrsize '

3:087> lm M *microsoftedgecp.exe
start end module name
00007ff6`5da80000 00007ff6`5dad1000 microsoftedgecp (deferred)

3:087> lmv m *edgehtml
start end module name
00007ffe`dda40000 00007ffe`defb6000 edgehtml (pdb symbols) c:\symbols\edgehtml.pdb\8A07FD3741EF425DBBB3B2EC1B646FFD1\edgehtml.pdb
Loaded symbol image file: C:\Windows\SYSTEM32\edgehtml.dll
Image path: C:\Windows\SYSTEM32\edgehtml.dll
Image name: edgehtml.dll
Timestamp: Sat Apr 23 06:30:17 2016 (571AFA59)
CheckSum: 0155841B
ImageSize: 01576000
File version: 11.0.10586.306
Product version: 11.0.10586.306
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Internet Explorer
InternalName: EDGEHTML
OriginalFilename: EDGEHTML.DLL
ProductVersion: 11.00.10586.306
FileVersion: 11.00.10586.306 (th2_release_sec.160422-1850)
FileDescription: Microsoft (R) HTML Viewer
LegalCopyright: � Microsoft Corporation. All rights reserved.

3:087> lmv m *microsoftedgecp
start end module name
00007ff6`5da80000 00007ff6`5dad1000 microsoftedgecp (deferred)
Image path: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
Image name: microsoftedgecp.exe
Timestamp: Tue Nov 24 08:05:25 2015 (56540C35)
CheckSum: 0005C253
ImageSize: 00051000
File version: 11.0.10586.20
Product version: 11.0.10586.20
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft Edge
InternalName: MicrosoftEdgeCP
OriginalFilename: MicrosoftEdgeCP.exe
ProductVersion: 11.00.10586.20
FileVersion: 11.00.10586.20 (th2_release_sec.151123-1940)
FileDescription: Microsoft Edge Content Process
LegalCopyright: � Microsoft Corporation. All rights reserved.

3:087>