Solved Repeated CRITICAL_PROCESS_DIED (0xEF) only during Idle / AC unplug - ASUS ROG G614JV - CoreWorker_eIS

Hello everyone,

I'm experiencing a very unusual BSOD and would really appreciate your help identifying the root cause.

System

• ASUS ROG Strix G16 (G614JV)
• BIOS: G614JV.331
• Windows 11 Insider Preview Build 26200.8655

The issue started suddenly a couple of days ago. Before that, the laptop was completely stable.

The laptop never crashes under heavy load (gaming, programming, stress testing, etc.).

The BSOD only occurs when:

• The laptop is left idle for several minutes.
• The display turns off due to inactivity.
• In some cases, immediately after unplugging the AC adapter.

Every crash results in the same bugcheck:

CRITICAL_PROCESS_DIED (0xEF)

WinDbg always reports CoreWorker_eIS as the critical process, but I haven't been able to determine what is causing it to terminate.

I have already tried:

• SFC
• DISM
• CHKDSK
• Updating all ASUS and Intel drivers
• Updating BIOS
• Disabling the VirtualBox network bridge

Unfortunately, the problem still persists.

I've collected all available logs, dump files, and diagnostic information.

Google Drive (logs, dumps, V2 Log Collector, WinDbg output):


If any additional logs or debugging information are needed, I'll be happy to provide them.

Thank you for your time and assistance.

Please perform the following steps:




1) Increase the free space on C: so that there is > 50 GB free space during the troubleshooting




2) Move the paging file from D: to C:





3) Reboot




4) Add WMIC:


DISM /Online /Add-Capability /CapabilityName:WMIC~~~~




5) Run Tuneup plus >post a share link







6) The BIOS Version/Date American Megatrends International, LLC. G614JV.331, 11/11/2024

Upgrade the BIOS: 331 > 334





7) Run Memtest86+ for 8 or more passes > take pictures > post images or share links

Memtest86+ | The Open-Source Memory Testing Tool

Just 1 error is a test fail and testing can be aborted.

The more the passes the better the testing conditions.

It sometimes takes passes into the 20's to detect malfunctioning RAM.

The RAM can be tested all at one time or one at a time in the same DIMM.

Memtest86+ | The Open-Source Memory Testing Tool

MemTest86+ - Test RAM




8) Run Sea Tools Long generic test (all drives) > post images or share links





9) Run HD Sentinel (all drives) > post images or share links

Hard Disk Sentinel - HDD health and temperature monitoring
a) Overview
b) Temperature
c) SMART

@zbook

Thank you very much for your response and for taking the time to review my case.

I completed all of the tests and recommendations you suggested.

The only exception was MemTest86+. Due to the amount of time required, I was only able to complete 2 passes instead of the recommended 8 passes.

I have uploaded all of the test results, logs, and the latest diagnostic files at the following link:


After completing all of these steps, I tested the laptop again to see whether the issue had been resolved.

From my observations, the problem consistently occurs during power state transitions.

We already knew that the black screen/crash could occur when:

• The laptop enters sleep automatically after the configured idle timeout.
• The laptop is put into sleep mode manually.
• The AC adapter is unplugged while the laptop is running.

The crash appears to happen immediately and consistently after these power state changes.

Because of this behavior, I currently do not think the issue is hardware-related. The test results included in the uploaded files also seem to support that conclusion.

To further investigate, I booted Ubuntu Desktop 26.04 LTS in Live USB mode (without installing it) and repeated the same tests. None of these problems occurred under Ubuntu. I also included a video of this test in the uploaded files.

Based on these observations, my current suspicion is that the issue is more likely software, driver, or power-management related rather than a hardware failure.

One additional observation:

Before performing the steps you recommended, the laptop would immediately crash and automatically restart.

After completing those steps, the behavior has changed slightly. Instead of automatically restarting, the screen now goes black and the system freezes completely. I have to hold the power button to shut the laptop down manually.

I would greatly appreciate any further guidance on what I should investigate next.

Thank you again for your time and assistance.

1) Turn off Windows fast startup:





2) Run admin PS > post share links





3) Clean install the Nvidia GPU driver nvlddmkm.sys using DDU




Reinstall: G614JV - Support

NVIDIA Graphic Driver
Version V32.0.15.6607
925.72 MB
2024/11/22
SHA-256 ：DA48576333677F741B9AAFB25AA174B712149D19623E8CC78B7869DE358A4FD1
Severity :
Recommended

Description :
This package includes NVIDIA Graphics Driver, to provide your system the powerful graphic computing experiences

Important Information :
2024 October Security Update for CVE-2024-0117, CVE-2024-0118, CVE-2024-0119, CVE-2024-0120, CVE-2024-0121, CVE-2024-0126, CVE-2024-0127, CVE-2024-0128

Minimum OS Version :
Windows 11 64-bit 24H2

Device List :
N18E-G0(G-sync)




4) Search for > post a share link

LastWriteTime Size (MB) FullName
------------- --------- --------
7/7/2026 12:46:26 PM 2433.31 C:\WINDOWS\MEMORY.DMP

@zbook

Thank you for taking the time to investigate my issue and for your detailed suggestions.

I wanted to provide an update: I had already continued debugging and resolved the issue before seeing your latest reply.

During my investigation, I found a scheduled task and executable related to CoreWorker_eISNxgiOXwxybMx.exe that appeared to be associated with the crashes. After removing the related scheduled tasks and the associated folder, I have not been able to reproduce the CRITICAL_PROCESS_DIED BSOD so far.

After reading your reply, I noticed that your investigation was also pointing toward the same area. Your suggestions to check the executable path, locate the file, and verify its signature were very relevant to the component I had been investigating.

I will create a detailed follow-up post with the WinDbg analysis, task XML, PowerShell outputs, and the steps I took, so the information can be useful for others who may encounter a similar issue.

Thank you again for your help.

What was that related to?

CoreWorker_eISNxgiOXwxybMx.exe

My bit of searching is hinting that this might be some form of malware due to the file name being something that a Microsoft process would not use for a file name.

@zbook

I could not identify the original vendor or purpose of this executable, but these are the findings I collected:

The executable was located at:

C:\Users\Asus\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe

It was launched by a scheduled task named:

CoreWorker_eISNxgiOXwxybMx-xxxx

The task was running from the user profile and the executable had no Authenticode signature:

Get-AuthenticodeSignature → Status: NotSigned

The folder name (MpDefenderCoreFolder) looked like it was attempting to resemble a Microsoft Defender-related component, although I cannot confirm its intention.

WinDbg showed:


After removing the scheduled tasks and the associated folder, I have not been able to reproduce the crashes.

I cannot confirm whether this was malware or a broken/unknown third-party component, but it appears to have been the trigger for the BSOD on my system.

AryanGh said:

@zbook

I could not identify the original vendor or purpose of this executable, but these are the findings I collected:

The executable was located at:

C:\Users\Asus\AppData\Local\MpDefenderCoreFolder\CoreWorker_eISNxgiOXwxybMx.exe

It was launched by a scheduled task named:

CoreWorker_eISNxgiOXwxybMx-xxxx

The task was running from the user profile and the executable had no Authenticode signature:

Get-AuthenticodeSignature → Status: NotSigned

The folder name (MpDefenderCoreFolder) looked like it was attempting to resemble a Microsoft Defender-related component, although I cannot confirm its intention.

WinDbg showed:

Code:

CRITICAL_PROCESS: CoreWorker_eIS
BUGCHECK_CODE: 0xEF (CRITICAL_PROCESS_DIED)

After removing the scheduled tasks and the associated folder, I have not been able to reproduce the crashes.

I cannot confirm whether this was malware or a broken/unknown third-party component, but it appears to have been the trigger for the BSOD on my system.

Click to expand...

I'm not sure what to make of this. I don't have the folder MpDefenderCoreFolder anywhere in any of the Users folder

Your choice:



a) Monitor the computer for 72 hours (play some demanding games)




b) Stress test drivers

zbook said:

Your choice:



a) Monitor the computer for 72 hours (play some demanding games)

View Reliability History in Windows 11

This tutorial will show you how to view reliability history for your Windows 11 device. The Reliability Monitor provides a system stability overview and details about events that impact reliability. It calculates the Stability Index shown in the System Stability Chart. Reliability Monitor...

www.elevenforum.com

b) Stress test drivers

Click to expand...

thanks for the guidance
Before moving forward with monitoring or stress testing, I managed to find the exact laboratory analysis report for this specific malware family on Joe Sandbox. Here is the link if you'd like to investigate it further:


The report completely confirms it is a PureLogs Infostealer/Backdoor. Interestingly, it highlights that the malware protects its process using the BreakOnTermination flag. This perfectly explains the battery-power BSOD: when the AC charger was unplugged, Windows Task Scheduler triggered its battery saving policy to stop the task, but since the flag was active, the kernel interpreted it as a critical failure and threw the CRITICAL_PROCESS_DIED bugcheck.

Also, I checked the Startup folder and found that the Windows Repair.lnk file mentioned in the sandbox persistence logs is already gone (File Explorer gave an Item Not Found error, meaning it was successfully deleted/quarantined during the cleanup).

Run a third party AV: ESET or Malwarebytes or both then uninstall as needed

Quick update:
I have successfully purged the malicious files and folders using Malwarebytes, and verified that the persistence shortcuts are fully gone.

However, after reviewing the sandbox analysis, I am deeply concerned. Since the payload is explicitly flagged as a PureLogs Infostealer that targets Chrome/Edge Login Data and active session Cookies (even abusing the Windows Restart Manager to unlock them), there is a very high probability that my credentials were leaked before the cleanup.

Are there any specific registry keys, token caches, or hidden system locations that should be double-checked after dealing with this type of payload? I'm quite anxious about the potential depth of the exfiltration and want to make sure no remnant backdoors are hiding anywhere.