Application Crash after inactivity Application Event ID: 1026, 1000, 1005, 1001. Security Event ID:

Topic

New Reply

Hi,

For several months now i have problem with my 3rd party application. After some inactivity on application, application crash.
What I checked.

1. Network.
2. Updates (without servers, on PC and server i install latest updates).

Locally application works ok (the same environment as the server application).

The problem must be on the server-side (in the logs nothing).
I have no idea what is wrong.
Work environment:
Domain WS2003
Forest WS2003
SQL2012
IIS7 (application pool .net 4.0)
Users environment:

.net 4.5.2
eset 5
no FW. All updates.
Windows 7 all works fine
Windows 8.1 randomly crash
Windows 10 randomly crash
Security event

Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 8/22/2015 2:01:52 PM
Event ID: 5061
Task Category: System Integrity
Level: Information
Keywords: Audit Failure
User: N/A
Computer: IT.DOMAIN.com
Description:
Cryptographic operation.

Subject:
Security ID: SYSTEM
Account Name: IT$
Account Domain: DOMAIN
Logon ID: 0x3E7

Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: RSA
Key Name: 51a92691-66f1-280f-d0db-59fad4f73491
Key Type: User key.

Cryptographic Operation:
Operation: Open Key.
Return Code: 0x80090016
Event Xml:

5061
0
0
12290
0
0x8010000000000000

5765

Security
IT.DOMAIN.com

S-1-5-18
IT$
DOMAIN
0x3e7
Microsoft Software Key Storage Provider
RSA
51a92691-66f1-280f-d0db-59fad4f73491
%%2500
%%2480
0x80090016

—————-

Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 8/22/2015 2:01:52 PM
Event ID: 5058
Task Category: Other System Events
Level: Information
Keywords: Audit Success
User: N/A
Computer: IT.DOMAIN.com
Description:
Key file operation.

Subject:
Security ID: SYSTEM
Account Name: IT$
Account Domain: DOMAIN
Logon ID: 0x3E7

Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: UNKNOWN
Key Name: 51a92691-66f1-280f-d0db-59fad4f73491
Key Type: User key.

Key File Operation Information:
File Path: C:ProgramDataMicrosoftCryptoSystemKeys6d00fa390c15cc4634c8ca8153b76f29_911499c7-ef29-47ed-a64c-6b1751f20848
Operation: Read persisted key from file.
Return Code: 0x0
Event Xml:

5058
0
0
12292
0
0x8020000000000000

5766

Security
IT.DOMAIN.com

S-1-5-18
IT$
DOMAIN
0x3e7
Microsoft Software Key Storage Provider
UNKNOWN
51a92691-66f1-280f-d0db-59fad4f73491
%%2500
C:ProgramDataMicrosoftCryptoSystemKeys6d00fa390c15cc4634c8ca8153b76f29_911499c7-ef29-47ed-a64c-6b1751f20848
%%2458
0x0

———————

Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 8/22/2015 2:01:52 PM
Event ID: 5061
Task Category: System Integrity
Level: Information
Keywords: Audit Failure
User: N/A
Computer: IT.DOMAIN.com
Description:
Cryptographic operation.

Subject:
Security ID: SYSTEM
Account Name: IT$
Account Domain: DOMAIN
Logon ID: 0x3E7

Cryptographic Parameters:
Provider Name: Microsoft Software Key Storage Provider
Algorithm Name: RSA
Key Name: 51a92691-66f1-280f-d0db-59fad4f73491
Key Type: User key.

Cryptographic Operation:
Operation: Open Key.
Return Code: 0x80090016
Event Xml:

5061
0
0
12290
0
0x8010000000000000

5767

Security
IT.DOMAIN.com

S-1-5-18
IT$
DOMAIN
0x3e7
Microsoft Software Key Storage Provider
RSA
51a92691-66f1-280f-d0db-59fad4f73491
%%2500
%%2480
0x80090016

Application event

Log Name: Application
Source: .NET Runtime
Date: 8/22/2015 2:01:48 PM
Event ID: 1026
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: IT.DOMAIN.com
Description:
Application: QAPP.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Runtime.InteropServices.SEHException
Stack:

Event Xml:

1026
2
0
0x80000000000000

1752
Application
IT.DOMAIN.com

Application: QAPP.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Runtime.InteropServices.SEHException
Stack:

—————————-

Log Name: Application
Source: Application Error
Date: 8/22/2015 2:01:50 PM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: IT.DOMAIN.com
Description:
Faulting application name: QAPP.exe, version: 2.7.0.0, time stamp: 0x55d38ea8
Faulting module name: MSVCR120_CLR0400.dll, version: 12.0.52512.0, time stamp: 0x5525ef9d
Exception code: 0xc0000006
Fault offset: 0x0006c91c
Faulting process id: 0x15c0
Faulting application start time: 0x01d0dcc4d8990a40
Faulting application path: Y:QAPP.exe
Faulting module path: C:WINDOWSSYSTEM32MSVCR120_CLR0400.dll
Report Id: a1e7085b-5596-4180-ad49-e8c753412422
Faulting package full name:
Faulting package-relative application ID:
Event Xml:

1000
2
100
0x80000000000000

1753
Application
IT.DOMAIN.com

QAPP.exe
2.7.0.0
55d38ea8
MSVCR120_CLR0400.dll
12.0.52512.0
5525ef9d
c0000006
0006c91c
15c0
01d0dcc4d8990a40
Y:QAPP.exe
C:WINDOWSSYSTEM32MSVCR120_CLR0400.dll
a1e7085b-5596-4180-ad49-e8c753412422

—————-

Log Name: Application
Source: Application Error
Date: 8/22/2015 2:01:50 PM
Event ID: 1005
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: IT.DOMAIN.com
Description:
Windows cannot access the file for one of the following reasons: there is a problem with the network connection, the disk that the file is stored on, or the storage drivers installed on this computer; or the disk is missing. Windows closed the program QAPP 2 because of this error.

Program: QAPP 2
File:

The error value is listed in the Additional Data section.
User Action
1. Open the file again. This situation might be a temporary problem that corrects itself when the program runs again.
2. If the file still cannot be accessed and
– It is on the network, your network administrator should verify that there is not a problem with the network and that the server can be contacted.
– It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.
3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.
4. If the problem persists, restore the file from a backup copy.
5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for further assistance.

Additional Data
Error value: C00000C4
Disk type: 0
Event Xml:

1005
2
100
0x80000000000000

1754
Application
IT.DOMAIN.com

QAPP 2
C00000C4
0

———————

Log Name: Application
Source: Windows Error Reporting
Date: 8/22/2015 2:02:01 PM
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: IT.DOMAIN.com
Description:
Fault bucket 107544006236, type 1
Event Name: APPCRASH
Response: Not available
Cab Id: 107391889015

Problem signature:
P1: QAPP.exe
P2: 2.7.0.0
P3: 55d38ea8
P4: MSVCR120_CLR0400.dll
P5: 12.0.52512.0
P6: 5525ef9d
P7: c0000006
P8: 0006c91c
P9:
P10:

Attached files:
C:UsersROOTAppDataLocalTempWER67E.tmp.WERInternalMetadata.xml
C:UsersROOTAppDataLocalTempWER11F9.tmp.appcompat.txt
C:ProgramDataMicrosoftWindowsWERTempWER12C5.tmp.dmp
C:UsersROOTAppDataLocalTempWER212E.tmp.WERDataCollectionFailure.txt

These files may be available here:
C:ProgramDataMicrosoftWindowsWERReportArchiveAppCrash_QAPP.exe_71de09a9e46ad1dd81f8c48d7a5f5da8a7ba4a5_6fca7ca7_cab_10562bd9

Analysis symbol:
Rechecking for solution: 0
Report Id: a1e7085b-5596-4180-ad49-e8c753412422
Report Status: 9
Hashed bucket: a393badea96984e78b0be346905441d0
Event Xml:

1001
4
0
0x80000000000000

1755
Application
IT.DOMAIN.com

107544006236
1
APPCRASH
Not available
107391889015
QAPP.exe
2.7.0.0
55d38ea8
MSVCR120_CLR0400.dll
12.0.52512.0
5525ef9d
c0000006
0006c91c

C:UsersROOTAppDataLocalTempWER67E.tmp.WERInternalMetadata.xml
C:UsersROOTAppDataLocalTempWER11F9.tmp.appcompat.txt
C:ProgramDataMicrosoftWindowsWERTempWER12C5.tmp.dmp
C:UsersROOTAppDataLocalTempWER212E.tmp.WERDataCollectionFailure.txt
C:ProgramDataMicrosoftWindowsWERReportArchiveAppCrash_QAPP.exe_71de09a9e46ad1dd81f8c48d7a5f5da8a7ba4a5_6fca7ca7_cab_10562bd9

0
a1e7085b-5596-4180-ad49-e8c753412422
9
a393badea96984e78b0be346905441d0

——————

Log Name: Application
Source: Microsoft-Windows-LoadPerf
Date: 8/22/2015 2:04:48 PM
Event ID: 1001
Task Category: None
Level: Information
Keywords:
User: SYSTEM
Computer: IT.DOMAIN.com
Description:
Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data contains the new values of the system Last Counter and Last Help registry entries.
Event Xml:

1001
0
4
0
0
0x8000000000000000

1756

Application
IT.DOMAIN.com

WmiApRpl
WmiApRpl
12
B02B0000B12B0000D6050000

Reply | Quote