Application Crash after inactivity Application Event ID: 1026, 1000, 1005, 1001. Security Event ID: 5061.

Hi,

For several months now i have problem with my 3rd party application. After some inactivity on application, application crash.

What I checked.

1. Network.
2. Updates (without servers, on PC and server i install latest updates).

Locally application works ok (the same environment as the server application).

The problem must be on the server-side (in the logs nothing).
I have no idea what is wrong.

Work environment:

Domain WS2003
Forest WS2003
SQL2012
IIS7 (application pool .net 4.0)

Users environment:

.net 4.5.2
eset 5
no FW.

All updates.

Windows 7 all works fine
Windows 8.1 randomly crash
Windows 10 randomly crash

Security event

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          8/22/2015 2:01:52 PM
Event ID:      5061
Task Category: System Integrity
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      IT.DOMAIN.com
Description:
Cryptographic operation.

Subject:
	Security ID:		SYSTEM
	Account Name:		IT$
	Account Domain:		DOMAIN
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	RSA
	Key Name:	51a92691-66f1-280f-d0db-59fad4f73491
	Key Type:	User key.

Cryptographic Operation:
	Operation:	Open Key.
	Return Code:	0x80090016
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>5061</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12290</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2015-08-22T12:01:52.261719800Z" />
    <EventRecordID>5765</EventRecordID>
    <Correlation ActivityID="{FBE3EEFF-DCC3-0003-00EF-E3FBC3DCD001}" />
    <Execution ProcessID="840" ThreadID="836" />
    <Channel>Security</Channel>
    <Computer>IT.DOMAIN.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">IT$</Data>
    <Data Name="SubjectDomainName">DOMAIN</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
    <Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
    <Data Name="AlgorithmName">RSA</Data>
    <Data Name="KeyName">51a92691-66f1-280f-d0db-59fad4f73491</Data>
    <Data Name="KeyType">%%2500</Data>
    <Data Name="Operation">%%2480</Data>
    <Data Name="ReturnCode">0x80090016</Data>
  </EventData>
</Event>


----------------

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          8/22/2015 2:01:52 PM
Event ID:      5058
Task Category: Other System Events
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      IT.DOMAIN.com
Description:
Key file operation.

Subject:
	Security ID:		SYSTEM
	Account Name:		IT$
	Account Domain:		DOMAIN
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	UNKNOWN
	Key Name:	51a92691-66f1-280f-d0db-59fad4f73491
	Key Type:	User key.

Key File Operation Information:
	File Path:	C:\ProgramData\Microsoft\Crypto\SystemKeys\6d00fa390c15cc4634c8ca8153b76f29_911499c7-ef29-47ed-a64c-6b1751f20848
	Operation:	Read persisted key from file.
	Return Code:	0x0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>5058</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12292</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2015-08-22T12:01:52.627921200Z" />
    <EventRecordID>5766</EventRecordID>
    <Correlation ActivityID="{FBE3EEFF-DCC3-0003-00EF-E3FBC3DCD001}" />
    <Execution ProcessID="840" ThreadID="836" />
    <Channel>Security</Channel>
    <Computer>IT.DOMAIN.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">IT$</Data>
    <Data Name="SubjectDomainName">DOMAIN</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
    <Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
    <Data Name="AlgorithmName">UNKNOWN</Data>
    <Data Name="KeyName">51a92691-66f1-280f-d0db-59fad4f73491</Data>
    <Data Name="KeyType">%%2500</Data>
    <Data Name="KeyFilePath">C:\ProgramData\Microsoft\Crypto\SystemKeys\6d00fa390c15cc4634c8ca8153b76f29_911499c7-ef29-47ed-a64c-6b1751f20848</Data>
    <Data Name="Operation">%%2458</Data>
    <Data Name="ReturnCode">0x0</Data>
  </EventData>
</Event>



---------------------

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          8/22/2015 2:01:52 PM
Event ID:      5061
Task Category: System Integrity
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      IT.DOMAIN.com
Description:
Cryptographic operation.

Subject:
	Security ID:		SYSTEM
	Account Name:		IT$
	Account Domain:		DOMAIN
	Logon ID:		0x3E7

Cryptographic Parameters:
	Provider Name:	Microsoft Software Key Storage Provider
	Algorithm Name:	RSA
	Key Name:	51a92691-66f1-280f-d0db-59fad4f73491
	Key Type:	User key.

Cryptographic Operation:
	Operation:	Open Key.
	Return Code:	0x80090016
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>5061</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>12290</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2015-08-22T12:01:52.629536500Z" />
    <EventRecordID>5767</EventRecordID>
    <Correlation ActivityID="{FBE3EEFF-DCC3-0003-00EF-E3FBC3DCD001}" />
    <Execution ProcessID="840" ThreadID="836" />
    <Channel>Security</Channel>
    <Computer>IT.DOMAIN.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">IT$</Data>
    <Data Name="SubjectDomainName">DOMAIN</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
    <Data Name="ProviderName">Microsoft Software Key Storage Provider</Data>
    <Data Name="AlgorithmName">RSA</Data>
    <Data Name="KeyName">51a92691-66f1-280f-d0db-59fad4f73491</Data>
    <Data Name="KeyType">%%2500</Data>
    <Data Name="Operation">%%2480</Data>
    <Data Name="ReturnCode">0x80090016</Data>
  </EventData>
</Event>

Application event

Log Name:      Application
Source:        .NET Runtime
Date:          8/22/2015 2:01:48 PM
Event ID:      1026
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      IT.DOMAIN.com
Description:
Application: QAPP.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Runtime.InteropServices.SEHException
Stack:

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name=".NET Runtime" />
    <EventID Qualifiers="0">1026</EventID>
    <Level>2</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-08-22T12:01:48.000000000Z" />
    <EventRecordID>1752</EventRecordID>
    <Channel>Application</Channel>
    <Computer>IT.DOMAIN.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data>Application: QAPP.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Runtime.InteropServices.SEHException
Stack:
</Data>
  </EventData>
</Event>


----------------------------

Log Name:      Application
Source:        Application Error
Date:          8/22/2015 2:01:50 PM
Event ID:      1000
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      IT.DOMAIN.com
Description:
Faulting application name: QAPP.exe, version: 2.7.0.0, time stamp: 0x55d38ea8
Faulting module name: MSVCR120_CLR0400.dll, version: 12.0.52512.0, time stamp: 0x5525ef9d
Exception code: 0xc0000006
Fault offset: 0x0006c91c
Faulting process id: 0x15c0
Faulting application start time: 0x01d0dcc4d8990a40
Faulting application path: Y:\QAPP.exe
Faulting module path: C:\WINDOWS\SYSTEM32\MSVCR120_CLR0400.dll
Report Id: a1e7085b-5596-4180-ad49-e8c753412422
Faulting package full name: 
Faulting package-relative application ID: 
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="0">1000</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-08-22T12:01:50.000000000Z" />
    <EventRecordID>1753</EventRecordID>
    <Channel>Application</Channel>
    <Computer>IT.DOMAIN.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data>QAPP.exe</Data>
    <Data>2.7.0.0</Data>
    <Data>55d38ea8</Data>
    <Data>MSVCR120_CLR0400.dll</Data>
    <Data>12.0.52512.0</Data>
    <Data>5525ef9d</Data>
    <Data>c0000006</Data>
    <Data>0006c91c</Data>
    <Data>15c0</Data>
    <Data>01d0dcc4d8990a40</Data>
    <Data>Y:\QAPP.exe</Data>
    <Data>C:\WINDOWS\SYSTEM32\MSVCR120_CLR0400.dll</Data>
    <Data>a1e7085b-5596-4180-ad49-e8c753412422</Data>
    <Data>
    </Data>
    <Data>
    </Data>
  </EventData>
</Event>

----------------

Log Name:      Application
Source:        Application Error
Date:          8/22/2015 2:01:50 PM
Event ID:      1005
Task Category: (100)
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      IT.DOMAIN.com
Description:
Windows cannot access the file  for one of the following reasons: there is a problem with the network connection, the disk that the file is stored on, or the storage drivers installed on this computer; or the disk is missing. Windows closed the program QAPP 2 because of this error.

Program: QAPP 2
File: 

The error value is listed in the Additional Data section.
User Action
1. Open the file again. This situation might be a temporary problem that corrects itself when the program runs again.
2. If the file still cannot be accessed and
	- It is on the network, your network administrator should verify that there is not a problem with the network and that the server can be contacted.
	- It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.
3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.
4. If the problem persists, restore the file from a backup copy.
5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for further assistance.

Additional Data
Error value: C00000C4
Disk type: 0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Application Error" />
    <EventID Qualifiers="49152">1005</EventID>
    <Level>2</Level>
    <Task>100</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-08-22T12:01:50.000000000Z" />
    <EventRecordID>1754</EventRecordID>
    <Channel>Application</Channel>
    <Computer>IT.DOMAIN.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data>
    </Data>
    <Data>QAPP 2</Data>
    <Data>C00000C4</Data>
    <Data>0</Data>
  </EventData>
</Event>

---------------------

Log Name:      Application
Source:        Windows Error Reporting
Date:          8/22/2015 2:02:01 PM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      IT.DOMAIN.com
Description:
Fault bucket 107544006236, type 1
Event Name: APPCRASH
Response: Not available
Cab Id: 107391889015

Problem signature:
P1: QAPP.exe
P2: 2.7.0.0
P3: 55d38ea8
P4: MSVCR120_CLR0400.dll
P5: 12.0.52512.0
P6: 5525ef9d
P7: c0000006
P8: 0006c91c
P9: 
P10: 

Attached files:
C:\Users\ROOT\AppData\Local\Temp\WER67E.tmp.WERInternalMetadata.xml
C:\Users\ROOT\AppData\Local\Temp\WER11F9.tmp.appcompat.txt
C:\ProgramData\Microsoft\Windows\WER\Temp\WER12C5.tmp.dmp
C:\Users\ROOT\AppData\Local\Temp\WER212E.tmp.WERDataCollectionFailure.txt

These files may be available here:
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_QAPP.exe_71de09a9e46ad1dd81f8c48d7a5f5da8a7ba4a5_6fca7ca7_cab_10562bd9

Analysis symbol: 
Rechecking for solution: 0
Report Id: a1e7085b-5596-4180-ad49-e8c753412422
Report Status: 9
Hashed bucket: a393badea96984e78b0be346905441d0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Windows Error Reporting" />
    <EventID Qualifiers="0">1001</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2015-08-22T12:02:01.000000000Z" />
    <EventRecordID>1755</EventRecordID>
    <Channel>Application</Channel>
    <Computer>IT.DOMAIN.com</Computer>
    <Security />
  </System>
  <EventData>
    <Data>107544006236</Data>
    <Data>1</Data>
    <Data>APPCRASH</Data>
    <Data>Not available</Data>
    <Data>107391889015</Data>
    <Data>QAPP.exe</Data>
    <Data>2.7.0.0</Data>
    <Data>55d38ea8</Data>
    <Data>MSVCR120_CLR0400.dll</Data>
    <Data>12.0.52512.0</Data>
    <Data>5525ef9d</Data>
    <Data>c0000006</Data>
    <Data>0006c91c</Data>
    <Data>
    </Data>
    <Data>
    </Data>
    <Data>
C:\Users\ROOT\AppData\Local\Temp\WER67E.tmp.WERInternalMetadata.xml
C:\Users\ROOT\AppData\Local\Temp\WER11F9.tmp.appcompat.txt
C:\ProgramData\Microsoft\Windows\WER\Temp\WER12C5.tmp.dmp
C:\Users\ROOT\AppData\Local\Temp\WER212E.tmp.WERDataCollectionFailure.txt</Data>
    <Data>C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_QAPP.exe_71de09a9e46ad1dd81f8c48d7a5f5da8a7ba4a5_6fca7ca7_cab_10562bd9</Data>
    <Data>
    </Data>
    <Data>0</Data>
    <Data>a1e7085b-5596-4180-ad49-e8c753412422</Data>
    <Data>9</Data>
    <Data>a393badea96984e78b0be346905441d0</Data>
  </EventData>
</Event>

------------------

Log Name:      Application
Source:        Microsoft-Windows-LoadPerf
Date:          8/22/2015 2:04:48 PM
Event ID:      1001
Task Category: None
Level:         Information
Keywords:      
User:          SYSTEM
Computer:      IT.DOMAIN.com
Description:
Performance counters for the WmiApRpl (WmiApRpl) service were removed successfully. The Record Data contains the new values of the system Last Counter and Last Help registry entries.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-LoadPerf" Guid="{122EE297-BB47-41AE-B265-1CA8D1886D40}" />
    <EventID>1001</EventID>
    <Version>0</Version>
    <Level>4</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2015-08-22T12:04:48.067453300Z" />
    <EventRecordID>1756</EventRecordID>
    <Correlation />
    <Execution ProcessID="6020" ThreadID="3296" />
    <Channel>Application</Channel>
    <Computer>IT.DOMAIN.com</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <UserData>
    <EventXML xmlns="LoadPerf">
      <param1>WmiApRpl</param1>
      <param2>WmiApRpl</param2>
      <binaryDataSize>12</binaryDataSize>
      <binaryData>B02B0000B12B0000D6050000</binaryData>
    </EventXML>
  </UserData>
</Event>




August 22nd, 2015 2:09pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics