PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffe903ff73d9ac, memory referenced.
Arg2: 0000000000000002, value 0 = read operation, 1 = write operation.
Arg3: fffff8042ecea4a0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: ffffe903ff73d9ac
BUGCHECK_P2: 2
BUGCHECK_P3: fffff8042ecea4a0
BUGCHECK_P4: 2
READ_ADDRESS: fffff8042d1733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
ffffe903ff73d9ac
FAULTING_IP:
Ntfs!NtfsWriteLog+220
fffff804`2ecea4a0 83f91e cmp ecx,1Eh
MM_INTERNAL_CODE: 2
CPU_COUNT: 8
CPU_MHZ: e10
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: d
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: CODE_CORRUPTION
BUGCHECK_STR: AV
PROCESS_NAME: System
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-ME9UFOB
ANALYSIS_SESSION_TIME: 04-08-2020 22:56:25.0944
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
TRAP_FRAME: ffffe903ff33d780 -- (.trap 0xffffe903ff33d780)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000000017c rbx=0000000000000000 rcx=0000000000000001
rdx=0000000000000018 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8042ecea4a0 rsp=ffffe903ff33d910 rbp=ffffe903ff33e8b0
r8=0000000000000000 r9=0000000000000001 r10=ffff81898bad79e0
r11=ffffe903ff33dc88 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
Ntfs!NtfsWriteLog+0x220:
fffff804`2ecea4a0 83f91e cmp ecx,1Eh
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8042ce2dd34 to fffff8042cdc2360
STACK_TEXT:
ffffe903`ff33d910 fffff804`2ece8561 : ffffca8a`22043a10 ffffe903`ff33dc10 ffffca8a`00000400 00000000`00000001 : Ntfs!NtfsWriteLog+0x220
ffffe903`ff33db80 fffff804`2ecc2fc0 : 00000000`00000200 ffffca8a`22043aa0 ffffca8a`22043a10 00000000`00000000 : Ntfs!NtfsWriteFileSizes+0x3b1
ffffe903`ff33dd10 fffff804`2eccc056 : 00000000`0000099c ffffca8a`2a199960 ffffca8a`2a199960 ffff8189`94b2d6e8 : Ntfs!NtOfsSetLength+0x27c
ffffe903`ff33de40 fffff804`2ecf9090 : ffff8189`94b2d6e8 ffffca8a`294047e0 00000000`00187590 00000000`0018758c : Ntfs!GetSecurityIdFromSecurityDescriptorUnsafe+0x13e
ffffe903`ff33def0 fffff804`2ecf8f81 : ffff8189`94b2d6e8 00000000`00000000 ffff8189`94b2d6e8 00000000`00000001 : Ntfs!NtfsCacheSharedSecurityByDescriptor+0xc4
ffffe903`ff33df40 fffff804`2ed0c8bb : ffffca8a`294047e0 ffff8189`94488010 ffffe903`ff33e610 00000000`00000000 : Ntfs!NtfsCacheSharedSecurityForCreate+0x145
ffffe903`ff33dfc0 fffff804`2ed152f3 : ffffca8a`22356840 ffffe903`ff33e8b0 ffff8189`94b2d6e8 00000000`00000000 : Ntfs!NtfsCreateNewFile+0x3cb
ffffe903`ff33e350 fffff804`2ed17ebe : ffff8189`94b2d6e8 ffffe903`ff33e610 ffff8189`94b2d6e8 ffff8189`93cbf010 : Ntfs!NtfsCommonCreate+0xc83
ffffe903`ff33e540 fffff804`2cd0a929 : ffff8189`8bab9030 ffff8189`93cbf010 ffff8189`8b7bf700 ffff8189`8baa0010 : Ntfs!NtfsFsdCreate+0x1fe
ffffe903`ff33e770 fffff804`2e1155de : ffff8189`93cbf010 ffff8189`93cbf400 ffff8189`93cbf010 ffff8189`95515ca0 : nt!IofCallDriver+0x59
ffffe903`ff33e7b0 fffff804`2e14cd27 : ffffe903`ff33e870 00000000`00000090 00000000`00000001 00000000`00000000 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x15e
ffffe903`ff33e830 fffff804`2cd0a929 : 00000000`00000000 fffff804`2d2af204 00000000`00000000 00000000`00000000 : FLTMGR!FltpCreate+0x307
ffffe903`ff33e8e0 fffff804`2cd099e4 : 00000000`00000003 00000000`00000000 00000000`00000000 fffff804`2cd0a1a3 : nt!IofCallDriver+0x59
ffffe903`ff33e920 fffff804`2d2af86b : ffffe903`ff33ebe0 fffff804`2d2af204 ffffe903`ff33eb50 ffff8189`94ad7010 : nt!IoCallDriverWithTracing+0x34
ffffe903`ff33e970 fffff804`2d2b681f : ffff8189`8b8ecbc0 ffff8189`8b8ecb04 ffff8189`94488010 00000000`00000000 : nt!IopParseDevice+0x62b
ffffe903`ff33eae0 fffff804`2d2b4c81 : ffff8189`94488000 ffffe903`ff33ed28 fffff804`00000240 ffff8189`8a6f9820 : nt!ObpLookupObjectName+0x78f
ffffe903`ff33eca0 fffff804`2d264f50 : 00000000`00000001 ffffe903`ff33efa8 00000000`00000000 fffff804`28174180 : nt!ObOpenObjectByNameEx+0x201
ffffe903`ff33ede0 fffff804`2d26338a : ffffe903`ff33ef90 00000000`10000000 ffffe903`ff33efa8 ffffe903`ff33ef98 : nt!IopCreateFile+0x820
ffffe903`ff33ee80 fffff804`2de29dea : 00000000`00000000 00000000`00000005 ffffca8a`283c3d30 00000000`00000000 : nt!IoCreateFile+0x8a
ffffe903`ff33ef10 fffff804`2de2957c : 00000000`00000103 00000000`00000000 00000000`00000001 fffff804`2de25280 : werkernel!WerpCreateReportDirectory+0x15e
ffffe903`ff33f210 fffff804`2de28a17 : 00000000`00000000 ffffca8a`283c3d30 00000000`00000000 ffff8189`93b2efc0 : werkernel!WerpCreateDumpFile+0x12c
ffffe903`ff33f300 fffff804`42aa0926 : 00000000`00000000 ffff8189`93b2efc0 00000000`00000000 fffff804`2cc5f9f0 : werkernel!WerLiveKernelOpenDumpFileExt+0x67
ffffe903`ff33f340 00000000`00000000 : ffff8189`93b2efc0 00000000`00000000 fffff804`2cc5f9f0 00000000`00000000 : 0xfffff804`42aa0926
STACK_COMMAND: .trap 0xffffe903ff33d780 ; kb
CHKIMG_EXTENSION: !chkimg -lo 50 -db !FLTMGR
2 errors : !FLTMGR (fffff8042e11eb3e-fffff8042e156b56)
fffff8042e11eb30 eb e1 cc cc cc cc cc cc 48 89 5c 24 08 57 *08 83 ........H.\$.W..
...
fffff8042e156b50 48 c7 45 27 08 00 *40 00 48 c7 45 37 08 00 00 00 H.E'..@.H.E7....
MODULE_NAME: memory_corruption
IMAGE_NAME: memory_corruption
FOLLOWUP_NAME: memory_corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
MEMORY_CORRUPTOR: STRIDE
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_STRIDE
BUCKET_ID: MEMORY_CORRUPTION_STRIDE
PRIMARY_PROBLEM_CLASS: MEMORY_CORRUPTION_STRIDE
TARGET_TIME: 2020-04-08T17:13:04.000Z
OSBUILD: 18362
OSSERVICEPACK: 752
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 2252
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:memory_corruption_stride
FAILURE_ID_HASH: {574dbc1b-92cb-fb09-cb7a-cacc1bb2c511}
Followup: memory_corruption
---------
KMODE_EXCEPTION_NOT_HANDLED (1e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff806645c8585, The address that the exception occurred at
Arg3: 0000000000000000, Parameter 0 of the exception
Arg4: ffffffffffffffff, Parameter 1 of the exception
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: Micro-Star International Co., Ltd.
SYSTEM_PRODUCT_NAME: MS-7B17
SYSTEM_SKU: Default string
SYSTEM_VERSION: 1.0
BIOS_VENDOR: American Megatrends Inc.
BIOS_VERSION: 1.60
BIOS_DATE: 08/08/2019
BASEBOARD_MANUFACTURER: Micro-Star International Co., Ltd.
BASEBOARD_PRODUCT: MPG Z390 GAMING PRO CARBON AC (MS-7B17)
BASEBOARD_VERSION: 1.0
DUMP_TYPE: 2
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff806645c8585
BUGCHECK_P3: 0
BUGCHECK_P4: ffffffffffffffff
READ_ADDRESS: fffff806649723b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
ffffffffffffffff
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
nt!SwapContext+4a5
fffff806`645c8585 c3 ret
EXCEPTION_PARAMETER2: ffffffffffffffff
BUGCHECK_STR: 0x1E_c0000005_R
CPU_COUNT: 8
CPU_MHZ: e10
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: d
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 2
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: chrome.exe
CURRENT_IRQL: 2
ANALYSIS_SESSION_HOST: DESKTOP-ME9UFOB
ANALYSIS_SESSION_TIME: 04-08-2020 23:01:51.0695
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
EXCEPTION_RECORD: 4800000006b841d2 -- (.exr 0x4800000006b841d2)
Cannot read Exception record @ 4800000006b841d2
TRAP_FRAME: 478b48ffe7f14ee9 -- (.trap 0x478b48ffe7f14ee9)
Unable to read trap frame at 478b48ff`e7f14ee9
BAD_STACK_POINTER: ffff99800fb7f8f8
LAST_CONTROL_TRANSFER: from fffff8066462fb47 to fffff806645c1080
STACK_TEXT:
ffff9980`0fb7f8f8 fffff806`6462fb47 : 00000000`0000001e ffffffff`c0000005 fffff806`645c8585 00000000`00000000 : nt!KeBugCheckEx
ffff9980`0fb7f900 fffff806`645c1f02 : 48000000`06b841d2 90ffac0a`11e8ce8b 478b48ff`e7f14ee9 0084978b`cd8b4920 : nt!KiDispatchException+0x1681c7
ffff9980`0fb7ffb0 fffff806`645c1ed0 : fffff806`645d3016 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxExceptionDispatchOnExceptionStack+0x12
fffff686`56edf298 fffff806`645d3016 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff806`6444ae26 : nt!KiExceptionDispatchOnExceptionStackContinue
fffff686`56edf2a0 fffff806`645ceda2 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0x116
fffff686`56edf480 fffff806`645c8585 : ffbff806`645c7e06 ffff9980`0f5a3180 fffff806`64448a75 ffffc208`912d61f0 : nt!KiGeneralProtectionFault+0x322
fffff686`56edf618 ffbff806`645c7e06 : ffff9980`0f5a3180 fffff806`64448a75 ffffc208`912d61f0 00000000`000000ff : nt!SwapContext+0x4a5
fffff686`56edf620 ffff9980`0f5a3180 : fffff806`64448a75 ffffc208`912d61f0 00000000`000000ff 00000000`00000000 : 0xffbff806`645c7e06
fffff686`56edf628 fffff806`64448a75 : ffffc208`912d61f0 00000000`000000ff 00000000`00000000 ffff9980`0f9cd180 : 0xffff9980`0f5a3180
fffff686`56edf630 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExitDispatcher+0x105
THREAD_SHA1_HASH_MOD_FUNC: 6e16cacf1180278236f9444969592afe09557af7
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: c55f91c13965f34861e3caff5b508684aa43b876
THREAD_SHA1_HASH_MOD: cb5f414824c2521bcc505eaa03e92fa10922dad8
FOLLOWUP_IP:
nt!SwapContext+4a5
fffff806`645c8585 c3 ret
FAULT_INSTR_CODE: cb8b48c3
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: nt!SwapContext+4a5
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 72ed27e3
IMAGE_VERSION: 10.0.18362.327
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 4a5
FAILURE_BUCKET_ID: 0x1E_c0000005_R_STACKPTR_ERROR_nt!SwapContext
BUCKET_ID: 0x1E_c0000005_R_STACKPTR_ERROR_nt!SwapContext
PRIMARY_PROBLEM_CLASS: 0x1E_c0000005_R_STACKPTR_ERROR_nt!SwapContext
TARGET_TIME: 2020-04-08T16:10:14.000Z
OSBUILD: 18362
OSSERVICEPACK: 327
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2031-02-06 14:47:47
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 27fd2
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x1e_c0000005_r_stackptr_error_nt!swapcontext
FAILURE_ID_HASH: {bd591bce-fa9d-a983-0398-0157fd169b8e}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff818887e05830, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff818887e05788, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 3
BUGCHECK_P2: ffff818887e05830
BUGCHECK_P3: ffff818887e05788
BUGCHECK_P4: 0
TRAP_FRAME: ffff818887e05830 -- (.trap 0xffff818887e05830)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffca047e0144e0 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000080000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80544250fba rsp=ffff818887e059c0 rbp=0000000000000001
r8=ffffca047e014120 r9=ffffca047e014410 r10=ffffca047e014490
r11=0000000000000002 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!MiRemoveUnusedSubsection+0x82:
fffff805`44250fba cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffff818887e05788 -- (.exr 0xffff818887e05788)
ExceptionAddress: fffff80544250fba (nt!MiRemoveUnusedSubsection+0x0000000000000082)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
CPU_COUNT: 8
CPU_MHZ: e10
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: d
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x139
PROCESS_NAME: System
CURRENT_IRQL: 2
DEFAULT_BUCKET_ID: FAIL_FAST_CORRUPT_LIST_ENTRY
ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
ANALYSIS_SESSION_HOST: DESKTOP-ME9UFOB
ANALYSIS_SESSION_TIME: 04-08-2020 23:01:49.0091
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff805443d2ee9 to fffff805443c1080
STACK_TEXT:
ffff8188`87e05508 fffff805`443d2ee9 : 00000000`00000139 00000000`00000003 ffff8188`87e05830 ffff8188`87e05788 : nt!KeBugCheckEx
ffff8188`87e05510 fffff805`443d3310 : 00000000`00000000 ffffca04`7e011360 ffff8188`87e05ae0 ffffb38e`1d57a808 : nt!KiBugCheckDispatch+0x69
ffff8188`87e05650 fffff805`443d16a5 : ffff8188`87e059c4 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffff8188`87e05830 fffff805`44250fba : fffff805`44669480 00000000`00000000 ffffb38e`1d3734c0 00000000`00000008 : nt!KiRaiseSecurityCheckFailure+0x325
ffff8188`87e059c0 fffff805`4422bbc0 : ffffca04`7e014490 ffffca04`79af8ae0 ffffb38e`1ce09c00 00000000`87e05ae0 : nt!MiRemoveUnusedSubsection+0x82
ffff8188`87e059f0 fffff805`4422b44d : 00000000`00000000 00000000`00000000 ffffca04`7e014490 ffffca04`7e014410 : nt!MiReferenceActiveSubsection+0xc0
ffff8188`87e05a50 fffff805`447d79f3 : 00000000`00000001 00000000`00000003 00000000`00000000 ffff8188`00000003 : nt!MiAddViewsForSection+0xed
ffff8188`87e05b50 fffff805`447d7613 : ffffca04`7e014410 ffff8188`87e05ea0 ffff8188`87e05e68 ffff8188`87e05e78 : nt!MiMapViewOfDataSection+0x1a3
ffff8188`87e05cc0 fffff805`447d6838 : 00000000`00000000 ffff8188`87e06040 00000000`00000000 00000000`00000000 : nt!MiMapViewOfSection+0x343
ffff8188`87e05e10 fffff805`443d2915 : ffffca04`79a9a600 ffff8188`87e06178 ffff8188`87e06218 00000000`00000000 : nt!NtMapViewOfSection+0x158
ffff8188`87e05f50 fffff805`443c4ec0 : fffff805`48ba7908 ffffb38e`1c804380 00000000`00000000 00000000`00000002 : nt!KiSystemServiceCopyEnd+0x25
ffff8188`87e06158 fffff805`48ba7908 : ffffb38e`1c804380 00000000`00000000 00000000`00000002 ffffb38e`1d5fe000 : nt!KiServiceLinkage
ffff8188`87e06160 fffff805`48ba7b78 : 00000000`00000000 00000000`c0000428 00000000`00000000 00000000`00000000 : CI!I_MapAndSizeDataFile+0x1e8
ffff8188`87e062b0 fffff805`48ba8aeb : ffff8188`87e06490 ffffb38e`1d6876d0 00000000`00000000 ffff8188`00000000 : CI!I_MapCatalog+0x194
ffff8188`87e063a0 fffff805`48ba8699 : 00000000`00000000 ffffb38e`1d511568 ffff8188`87e06501 00000000`00000100 : CI!I_ReloadCatalog+0x263
ffff8188`87e06420 fffff805`48ba837e : 00000000`00000000 ffffb38e`00000000 fffff805`00000001 fffff805`00000000 : CI!I_ReloadCatalogDirectory+0x299
ffff8188`87e06550 fffff805`48ba6f16 : 00000000`00000000 ffffb38e`00000001 ffff8188`87e066c0 00000000`00000000 : CI!I_ReloadCatalogs+0x17a
ffff8188`87e065c0 fffff805`48ba6a78 : ffff8188`87e06950 00000000`00000014 ffffb38e`1d4c5b40 00000000`00000001 : CI!I_FindFileOrHeaderHashInCatalogs+0x3c2
ffff8188`87e06720 fffff805`48bb202e : ffff8188`87e0690c ffff8188`87e06910 00000000`00000000 00000000`00000000 : CI!MinCrypK_VerifyHashInCatalog+0x110
ffff8188`87e067d0 fffff805`48badb46 : 00000000`00000000 00000000`00000000 00000000`00000001 fffff805`0000002a : CI!CiVerifyFileHashInCatalogs+0x18e
ffff8188`87e068b0 fffff805`48baef61 : ffff8188`87e06cc8 ffff8188`87e06bd1 00000000`00000000 ffff8188`87e06cc8 : CI!CipFindFileHash+0x2ce
ffff8188`87e06a10 fffff805`48bae932 : ffffb38e`1d31c660 ffffca04`7aa2cab0 ffffca04`79ab7300 fffff805`4a480000 : CI!CipValidateFileHash+0x261
ffff8188`87e06af0 fffff805`48baccfe : ffff8188`87e06e88 00000000`00000000 ffffca04`7aa2cab0 00000000`00000000 : CI!CipValidateImageHash+0xf2
ffff8188`87e06c20 fffff805`44881c16 : ffff8188`87e06e60 fffff805`4a480000 00000000`0000000f fffff805`4a480000 : CI!CiValidateImageHeader+0x6fe
ffff8188`87e06da0 fffff805`4488173a : 00000000`00000000 00000000`00000001 00000000`00000000 00000000`00094000 : nt!SeValidateImageHeader+0xd6
ffff8188`87e06e50 fffff805`4481f16a : 00000000`00000000 fffff805`448d767f 00000000`00000000 00000000`00000000 : nt!MiValidateSectionCreate+0x436
ffff8188`87e07040 fffff805`447f9321 : ffff8188`87e07370 ffff8188`87e071a0 00000000`40000000 ffff8188`87e07370 : nt!MiValidateSectionSigningPolicy+0xa6
ffff8188`87e070a0 fffff805`447d9440 : ffffca04`7aa2cab0 ffff8188`87e07370 ffff8188`87e07370 00000000`00000000 : nt!MiCreateNewSection+0x5ad
ffff8188`87e07200 fffff805`447d9744 : ffff8188`87e07230 ffffb38e`1d4da2f0 ffffca04`7aa2cab0 00000000`00000000 : nt!MiCreateImageOrDataSection+0x2d0
ffff8188`87e072f0 fffff805`44344ba8 : 00000000`00000000 00000000`ffffffff ffffffff`800001a4 fffff805`44233d40 : nt!MiCreateSection+0xf4
ffff8188`87e07470 fffff805`44901631 : 00000000`00000000 ffff8188`87e07589 ffffffff`800001a4 ffffb38e`1ce025a0 : nt!MiCreateSystemSection+0xa0
ffff8188`87e07510 fffff805`448ffe0a : fffff805`44647590 ffffffff`800001a4 ffff8188`87e07698 fffff805`447fc8bd : nt!MiCreateSectionForDriver+0x125
ffff8188`87e075f0 fffff805`448ff6e3 : ffff8188`87e07888 ffff8188`87e07740 00000000`00000000 fffff805`44245e97 : nt!MiObtainSectionForDriver+0xa6
ffff8188`87e07640 fffff805`4490df36 : ffff8188`87e07888 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmLoadSystemImageEx+0xd7
ffff8188`87e077f0 fffff805`4490da18 : ffff8188`87e07930 ffffb38e`1d329a00 00000000`00000000 00000000`00000000 : nt!MmLoadSystemImage+0x26
ffff8188`87e07830 fffff805`44c0fe99 : ffffca04`7a6fba48 ffffca04`7a6fba48 ffff8188`87e07a80 00000000`00000000 : nt!IopLoadDriver+0x224
ffff8188`87e07a10 fffff805`44c0f08a : fffff805`00000000 ffffb38e`1d329a50 00000000`00000000 fffff805`42777ed0 : nt!IopInitializeSystemDrivers+0x151
ffff8188`87e07ab0 fffff805`4495f6d2 : fffff805`42777ed0 fffff805`42777ed0 fffff805`4495f690 fffff805`42777ed0 : nt!IoInitSystem+0x12
ffff8188`87e07ae0 fffff805`4432a715 : ffffca04`79a9a600 fffff805`4495f690 fffff805`42777ed0 0f49da03`48f8478b : nt!Phase1Initialization+0x42
ffff8188`87e07b10 fffff805`443c86ca : fffff805`42aec180 ffffca04`79a9a600 fffff805`4432a6c0 8b49c38b`48c8034d : nt!PspSystemThreadStartup+0x55
ffff8188`87e07b60 00000000`00000000 : ffff8188`87e08000 ffff8188`87e01000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x2a
THREAD_SHA1_HASH_MOD_FUNC: 9e3ac06b664852c637c8a1826cc9d1e543b3e3ba
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: f2338a6d36ee03b1d25e443f72d4db83fc9ddfb5
THREAD_SHA1_HASH_MOD: 6186cd1573eab297e91c5fce2cd874a5951cba0d
FOLLOWUP_IP:
CI!I_MapAndSizeDataFile+1e8
fffff805`48ba7908 8bd8 mov ebx,eax
FAULT_INSTR_CODE: c085d88b
SYMBOL_STACK_INDEX: c
SYMBOL_NAME: CI!I_MapAndSizeDataFile+1e8
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: CI
IMAGE_NAME: CI.dll
DEBUG_FLR_IMAGE_TIMESTAMP: 64b700c8
IMAGE_VERSION: 10.0.18362.329
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1e8
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_CI!I_MapAndSizeDataFile
BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_CI!I_MapAndSizeDataFile
PRIMARY_PROBLEM_CLASS: 0x139_3_CORRUPT_LIST_ENTRY_CI!I_MapAndSizeDataFile
TARGET_TIME: 2020-04-08T15:02:38.000Z
OSBUILD: 18362
OSSERVICEPACK: 327
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2031-02-06 14:47:47
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 8bf1
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_3_corrupt_list_entry_ci!i_mapandsizedatafile
FAILURE_ID_HASH: {be616715-137e-03b3-3d47-834c7fc35a6d}
Followup: MachineOwner
---------