BSOD - 3 minidumps attached

Afternoon. Being searching around the site to try find an answer to the following crashdumps. This is a HP laptop, we used to get many crashes a few months back, at the time I changed sound drivers and video drivers, and i finally decided it was faulty RAM, which we then replaced. A few months on and the laptop keeps crashing again. Appears to be system files that are causing the problem so im having trouble diagnosing the issue, my gut instinct is to move the RAM module into another slot and see what happens, but i'd also like to hear some suggestions and thoughts from you guys. I will post the first mini dump here, and the following two in seperate replies too try keep it tidy, thanks for reading

Use !analyze -v to get detailed debugging information.

BugCheck 1000000A, {0, 2, 1, 8051e106}

Probably caused by : memory_corruption ( nt!MiRemovePageByColor+68 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000001, value 0 = read operation, 1 = write operation
Arg4: 8051e106, address which referenced memory

Debugging Details:
------------------


WRITE_ADDRESS: 00000000

CURRENT_IRQL: 2

FAULTING_IP:
nt!MiRemovePageByColor+68
8051e106 ff08 dec dword ptr [eax]

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0xA

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 805119d7 to 8051e106

STACK_TEXT:
f8143acc 805119d7 ff6742d8 000004c0 00000400 nt!MiRemovePageByColor+0x68
f8143af8 80512512 00010000 ffba4bb8 ffba4bf0 nt!MiResolveMappedFileFault+0x3dd
f8143b3c 805126cc 00000000 c6ac0000 c0635600 nt!MiResolveProtoPteFault+0x18c
f8143bc0 8051bdd4 e2c5c400 c6ac0000 c0635600 nt!MiDispatchFault+0xe8
f8143c24 80516f74 00000000 c6ac0000 00000000 nt!MmAccessFault+0x7b4
f8143c80 804e0f77 c6ac0000 00000000 8054f318 nt!MmCheckCachedPageState+0x56c
f8143d2c 804e618b 823c7290 8055a1c0 81f928b8 nt!CcPerformReadAhead+0x1f1
f8143d74 80533dd0 823c7290 00000000 81f928b8 nt!CcWorkerThread+0x147
f8143dac 805c4a06 823c7290 00000000 00000000 nt!ExpWorkerThread+0x100
f8143ddc 80540fa2 80533cd0 80000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!MiRemovePageByColor+68
8051e106 ff08 dec dword ptr [eax]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

DEBUG_FLR_IMAGE_TIMESTAMP: 42250a1d

SYMBOL_NAME: nt!MiRemovePageByColor+68

IMAGE_NAME: memory_corruption

FAILURE_BUCKET_ID: 0xA_W_nt!MiRemovePageByColor+68

BUCKET_ID: 0xA_W_nt!MiRemovePageByColor+68

Followup: MachineOwner

 

Crashdump number 2

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, bf802fb1, a9294ca4, 0}

Probably caused by : win32k.sys ( win32k!xxxSleepThread+1bb )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

KERNEL_MODE_EXCEPTION_NOT_HANDLED_M (1000008e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: bf802fb1, The address that the exception occurred at
Arg3: a9294ca4, Trap Frame
Arg4: 00000000

Debugging Details:
------------------


EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx ". The memory could not be "%s ".

FAULTING_IP:
win32k!xxxSleepThread+1bb
bf802fb1 0fb74004 movzx eax,word ptr [eax+4]

TRAP_FRAME: a9294ca4 -- (.trap ffffffffa9294ca4)
ErrCode = 00000000
eax=000001f1 ebx=00000000 ecx=ffffffff edx=80010031 esi=e2894cd0 edi=000024ff
eip=bf802fb1 esp=a9294d18 ebp=a9294d38 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
win32k!xxxSleepThread+0x1bb:
bf802fb1 0fb74004 movzx eax,word ptr [eax+4] ds:0023:000001f5=????
Resetting default scope

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT

BUGCHECK_STR: 0x8E

PROCESS_NAME: IEXPLORE.EXE

LAST_CONTROL_TRANSFER: from bf8037a6 to bf802fb1

STACK_TEXT:
a9294d38 bf8037a6 000024ff 00000000 00000001 win32k!xxxSleepThread+0x1bb
a9294d4c bf8037c3 000024ff 00000000 0013eb84 win32k!xxxRealWaitMessageEx+0x12
a9294d5c 8053c808 0013edd8 7c90eb94 badb0d00 win32k!NtUserWaitMessage+0x14
a9294d5c 7c90eb94 0013edd8 7c90eb94 badb0d00 nt!KiFastCallEntry+0xf8
WARNING: Frame IP not in any known module. Following frames may be wrong.
0013edd8 00000000 00000000 00000000 00000000 0x7c90eb94


STACK_COMMAND: kb

FOLLOWUP_IP:
win32k!xxxSleepThread+1bb
bf802fb1 0fb74004 movzx eax,word ptr [eax+4]

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: win32k

IMAGE_NAME: win32k.sys

DEBUG_FLR_IMAGE_TIMESTAMP: 43446a58

SYMBOL_NAME: win32k!xxxSleepThread+1bb

FAILURE_BUCKET_ID: 0x8E_win32k!xxxSleepThread+1bb

BUCKET_ID: 0x8E_win32k!xxxSleepThread+1bb

Followup: MachineOwner
---------

 

and finally, crash dump 3

Use !analyze -v to get detailed debugging information.

BugCheck 19, {20, e1314818, e13148a0, c110202}

Probably caused by : ntkrnlpa.exe ( nt!ExFreePoolWithTag+2a0 )

Followup: MachineOwner
---------

kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_HEADER (19)
The pool is already corrupt at the time of the current request.
This may or may not be due to the caller.
The internal pool links must be walked to figure out a possible cause of
the problem, and then special pool applied to the suspect tags or the driver
verifier to a suspect driver.
Arguments:
Arg1: 00000020, a pool block header size is corrupt.
Arg2: e1314818, The pool entry we were looking for within the page.
Arg3: e13148a0, The next pool entry.
Arg4: 0c110202, (reserved)

Debugging Details:
------------------


BUGCHECK_STR: 0x19_20

POOL_ADDRESS: e1314818

CUSTOMER_CRASH_COUNT: 2

DEFAULT_BUCKET_ID: DRIVER_FAULT

PROCESS_NAME: System

LAST_CONTROL_TRANSFER: from 80543c86 to 804f8925

STACK_TEXT:
f8143c00 80543c86 00000019 00000020 e1314818 nt!KeBugCheckEx+0x1b
f8143c50 f81f229b e1314820 00000000 f8143d44 nt!ExFreePoolWithTag+0x2a0
f8143c6c f81f16bd e37b9c58 f8143d44 00000000 Ntfs!NtfsDeleteCcb+0x44
f8143ce0 f81f9e13 81f40dd8 e37b9d20 e37b9c58 Ntfs!NtfsCommonClose+0x36c
f8143d74 80533dd0 00000000 00000000 81f598b8 Ntfs!NtfsFspClose+0xe3
f8143dac 805c4a06 00000000 00000000 00000000 nt!ExpWorkerThread+0x100
f8143ddc 80540fa2 80533cd0 80000000 00000000 nt!PspSystemThreadStartup+0x34
00000000 00000000 00000000 00000000 00000000 nt!KiThreadStartup+0x16


STACK_COMMAND: kb

FOLLOWUP_IP:
nt!ExFreePoolWithTag+2a0
80543c86 8b45f8 mov eax,dword ptr [ebp-8]

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: ntkrnlpa.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 42250a1d

SYMBOL_NAME: nt!ExFreePoolWithTag+2a0

FAILURE_BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+2a0

BUCKET_ID: 0x19_20_nt!ExFreePoolWithTag+2a0

Followup: MachineOwner