MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000000782, The subtype of the bugcheck.
Arg2: ffffa48cc38c6a80
Arg3: ffffbc04c1080000
Arg4: ffffe086e12b1c60
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: Gigabyte Technology Co., Ltd.
SYSTEM_PRODUCT_NAME: G31M-ES2C
BIOS_VENDOR: Award Software International, Inc.
BIOS_VERSION: F8
BIOS_DATE: 09/29/2009
BASEBOARD_MANUFACTURER: Gigabyte Technology Co., Ltd.
BASEBOARD_PRODUCT: G31M-S2C
DUMP_TYPE: 2
BUGCHECK_P1: 782
BUGCHECK_P2: ffffa48cc38c6a80
BUGCHECK_P3: ffffbc04c1080000
BUGCHECK_P4: ffffe086e12b1c60
BUGCHECK_STR: 0x1a_782
CPU_COUNT: 2
CPU_MHZ: bb8
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 17
CPU_STEPPING: a
CPU_MICROCODE: 6,17,a,0 (F,M,S,R) SIG: A0C'00000000 (cache) A0C'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-ME9UFOB
ANALYSIS_SESSION_TIME: 04-20-2020 16:49:25.0375
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff8013b22b2a8 to fffff8013b1c2390
STACK_TEXT:
ffffce0c`c9aed938 fffff801`3b22b2a8 : 00000000`0000001a 00000000`00000782 ffffa48c`c38c6a80 ffffbc04`c1080000 : nt!KeBugCheckEx
ffffce0c`c9aed940 fffff801`3b6852bf : ffffbc04`c1080000 ffffe086`e12b1c60 ffffa48c`00000000 fffff801`3b025719 : nt!MmUnmapViewInSystemCache+0x198028
ffffce0c`c9aeda50 fffff801`3b092232 : 00000000`00000000 ffffa48c`c712d010 ffffa48c`c45d5848 00000000`00000000 : nt!CcUnmapVacb+0x63
ffffce0c`c9aeda90 fffff801`3b025b0e : ffff9062`5fea4801 00000000`00000001 ffffce0c`c9aedb00 ffffa48c`baf049b0 : nt!CcUnmapVacbArray+0x202
ffffce0c`c9aedb00 fffff801`3b0235a6 : ffffce0c`c9aedb00 ffffce0c`c9aedbe8 ffffce0c`c9aedbe8 fffff801`3b6a1ac1 : nt!CcUnmapAndPurge+0x36
ffffce0c`c9aedb40 fffff801`3b0244a0 : 00000000`0009ca00 ffffce0c`c9aedc09 ffffa48c`c6681720 00000000`00000000 : nt!CcDeleteSharedCacheMap+0x12a
ffffce0c`c9aedb90 fffff801`3b0f43b5 : ffffa48c`baf02c00 ffffa48c`00000000 00000000`0009ca00 ffffce0c`c8cc3b90 : nt!CcWriteBehindInternal+0x3a0
ffffce0c`c9aedc70 fffff801`3b06bcd5 : ffffa48c`c28b5040 00000000`00000080 ffffa48c`bae66300 00000000`a9db3ffe : nt!ExpWorkerThread+0x105
ffffce0c`c9aedd10 fffff801`3b1c9998 : fffff801`39440180 ffffa48c`c28b5040 fffff801`3b06bc80 00000000`00000246 : nt!PspSystemThreadStartup+0x55
ffffce0c`c9aedd60 00000000`00000000 : ffffce0c`c9aee000 ffffce0c`c9ae8000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
THREAD_SHA1_HASH_MOD_FUNC: e4d3bdbcf5216ed798f02cbaa1ab96b279eb0c6a
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: ae627bafa35fff555d10ae30b213a675d02be0e3
THREAD_SHA1_HASH_MOD: bc100a5647b828107ac4e18055e00abcbe1ec406
FOLLOWUP_IP:
nt!MmUnmapViewInSystemCache+198028
fffff801`3b22b2a8 cc int 3
FAULT_INSTR_CODE: 8c980cc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MmUnmapViewInSystemCache+198028
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 5629d63a
IMAGE_VERSION: 10.0.18362.778
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: memory_corruption
BUCKET_ID_FUNC_OFFSET: 198028
FAILURE_BUCKET_ID: 0x1a_782_nt!MmUnmapViewInSystemCache
BUCKET_ID: 0x1a_782_nt!MmUnmapViewInSystemCache
PRIMARY_PROBLEM_CLASS: 0x1a_782_nt!MmUnmapViewInSystemCache
TARGET_TIME: 2020-04-20T11:56:44.000Z
OSBUILD: 18362
OSSERVICEPACK: 778
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2015-10-23 09:39:54
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 1170
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x1a_782_nt!mmunmapviewinsystemcache
FAILURE_ID_HASH: {5bec27fd-3f50-8b08-1311-aa1df42d7be2}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff930d16e068f0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff930d16e06848, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: Gigabyte Technology Co., Ltd.
SYSTEM_PRODUCT_NAME: G31M-ES2C
BIOS_VENDOR: Award Software International, Inc.
BIOS_VERSION: F8
BIOS_DATE: 09/29/2009
BASEBOARD_MANUFACTURER: Gigabyte Technology Co., Ltd.
BASEBOARD_PRODUCT: G31M-S2C
DUMP_TYPE: 2
BUGCHECK_P1: 3
BUGCHECK_P2: ffff930d16e068f0
BUGCHECK_P3: ffff930d16e06848
BUGCHECK_P4: 0
TRAP_FRAME: ffff930d16e068f0 -- (.trap 0xffff930d16e068f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff81030628fc70 rbx=0000000000000000 rcx=0000000000000003
rdx=ffff81030628f710 rsi=0000000000000000 rdi=0000000000000000
rip=fffff809752f4759 rsp=ffff930d16e06a80 rbp=ffff930d16e06bc0
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=ffff930d16e06a00 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
dxgmms1!VIDMM_LINEAR_POOL::MarkBlockForEviction+0x15d:
fffff809`752f4759 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffff930d16e06848 -- (.exr 0xffff930d16e06848)
ExceptionAddress: fffff809752f4759 (dxgmms1!VIDMM_LINEAR_POOL::MarkBlockForEviction+0x000000000000015d)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
CPU_COUNT: 2
CPU_MHZ: bb8
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 17
CPU_STEPPING: a
CPU_MICROCODE: 6,17,a,0 (F,M,S,R) SIG: A0C'00000000 (cache) A0C'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x139
PROCESS_NAME: System
CURRENT_IRQL: 0
DEFAULT_BUCKET_ID: FAIL_FAST_CORRUPT_LIST_ENTRY
ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
ANALYSIS_SESSION_HOST: DESKTOP-ME9UFOB
ANALYSIS_SESSION_TIME: 04-20-2020 16:49:21.0659
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff802345d41e9 to fffff802345c2390
STACK_TEXT:
ffff930d`16e065c8 fffff802`345d41e9 : 00000000`00000139 00000000`00000003 ffff930d`16e068f0 ffff930d`16e06848 : nt!KeBugCheckEx
ffff930d`16e065d0 fffff802`345d4610 : ffffad8e`52e25000 00000000`00000000 ffffad8e`52e25000 fffff809`752eddf6 : nt!KiBugCheckDispatch+0x69
ffff930d`16e06710 fffff802`345d29a3 : 00000000`00000000 fffff802`345c884e 00000000`00000001 00000000`00000001 : nt!KiFastFailDispatch+0xd0
ffff930d`16e068f0 fffff809`752f4759 : ffff930d`16e06a90 00000000`00000018 00000000`00000000 ffffad8e`541695a0 : nt!KiRaiseSecurityCheckFailure+0x323
ffff930d`16e06a80 fffff809`752f3a80 : 00000000`00000000 00000000`00000001 ffff8103`0612ad50 ffffad8e`52e3d000 : dxgmms1!VIDMM_LINEAR_POOL::MarkBlockForEviction+0x15d
ffff930d`16e06ac0 fffff809`752f43a3 : 00000000`00000000 ffffad8e`52e23000 ffffad8e`52deb000 ffffad8e`52deb000 : dxgmms1!VIDMM_GLOBAL::ProcessDeferredCommand+0x7a0
ffff930d`16e06c30 fffff809`75304813 : ffffad8e`00000000 ffffad8e`57d209a0 ffffad8e`578673a0 ffffad8e`00000000 : dxgmms1!VidMmiProcessTerminationCommand+0x53
ffff930d`16e06c80 fffff809`753046e3 : ffffad8e`52deb000 00000000`00000080 fffff809`75304630 ffffad8e`52deb000 : dxgmms1!VidSchiRun_PriorityTable+0x123
ffff930d`16e06cd0 fffff802`3446bcd5 : ffffad8e`52e396c0 fffff809`75304630 ffffad8e`52deb000 00000000`a9db3ffe : dxgmms1!VidSchiWorkerThread+0xb3
ffff930d`16e06d10 fffff802`345c9998 : ffffc200`11c00180 ffffad8e`52e396c0 fffff802`3446bc80 00790072`006f0074 : nt!PspSystemThreadStartup+0x55
ffff930d`16e06d60 00000000`00000000 : ffff930d`16e07000 ffff930d`16e01000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
THREAD_SHA1_HASH_MOD_FUNC: 1ad86f20b8ea636917d4e03de11ba96ca6c0493c
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: c49af16bd571658360676dec5ae775f4edce63bb
THREAD_SHA1_HASH_MOD: ddc86373129abfecee228c7f8a6ae298bc8c6eff
FOLLOWUP_IP:
dxgmms1!VIDMM_LINEAR_POOL::MarkBlockForEviction+15d
fffff809`752f4759 cd29 int 29h
FAULT_INSTR_CODE: cccc29cd
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: dxgmms1!VIDMM_LINEAR_POOL::MarkBlockForEviction+15d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: dxgmms1
IMAGE_NAME: dxgmms1.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 26f5874d
IMAGE_VERSION: 10.0.18362.809
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 15d
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_dxgmms1!VIDMM_LINEAR_POOL::MarkBlockForEviction
BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_dxgmms1!VIDMM_LINEAR_POOL::MarkBlockForEviction
PRIMARY_PROBLEM_CLASS: 0x139_3_CORRUPT_LIST_ENTRY_dxgmms1!VIDMM_LINEAR_POOL::MarkBlockForEviction
TARGET_TIME: 2020-04-20T09:55:33.000Z
OSBUILD: 18362
OSSERVICEPACK: 778
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2015-10-23 09:39:54
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: cdb
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_3_corrupt_list_entry_dxgmms1!vidmm_linear_pool::markblockforeviction
FAILURE_ID_HASH: {5225080b-d16a-fc72-d632-70b8f5158c27}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 000000000000001d, Type of memory safety violation
Arg2: ffffd207c94d08d0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffd207c94d0828, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: Gigabyte Technology Co., Ltd.
SYSTEM_PRODUCT_NAME: G31M-ES2C
BIOS_VENDOR: Award Software International, Inc.
BIOS_VERSION: F8
BIOS_DATE: 09/29/2009
BASEBOARD_MANUFACTURER: Gigabyte Technology Co., Ltd.
BASEBOARD_PRODUCT: G31M-S2C
DUMP_TYPE: 2
BUGCHECK_P1: 1d
BUGCHECK_P2: ffffd207c94d08d0
BUGCHECK_P3: ffffd207c94d0828
BUGCHECK_P4: 0
TRAP_FRAME: ffffd207c94d08d0 -- (.trap 0xffffd207c94d08d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffad80c7ed3d48 rbx=0000000000000000 rcx=000000000000001d
rdx=ffffad80c7ed3dc8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80510a65c3b rsp=ffffd207c94d0a68 rbp=0000000000000000
r8=0000000000000000 r9=ffffad80c7ed3d48 r10=ffffad80c26d7db8
r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe cy
nt!RtlRbRemoveNode+0x148d3b:
fffff805`10a65c3b cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffd207c94d0828 -- (.exr 0xffffd207c94d0828)
ExceptionAddress: fffff80510a65c3b (nt!RtlRbRemoveNode+0x0000000000148d3b)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 000000000000001d
Subcode: 0x1d FAST_FAIL_INVALID_BALANCED_TREE
CPU_COUNT: 2
CPU_MHZ: bb8
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 17
CPU_STEPPING: a
CPU_MICROCODE: 6,17,a,0 (F,M,S,R) SIG: A0C'00000000 (cache) A0C'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x139
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
DEFAULT_BUCKET_ID: FAIL_FAST_INVALID_BALANCED_TREE
ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 000000000000001d
ANALYSIS_SESSION_HOST: DESKTOP-ME9UFOB
ANALYSIS_SESSION_TIME: 04-20-2020 16:49:19.0266
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff805109d41e9 to fffff805109c2390
STACK_TEXT:
ffffd207`c94d05a8 fffff805`109d41e9 : 00000000`00000139 00000000`0000001d ffffd207`c94d08d0 ffffd207`c94d0828 : nt!KeBugCheckEx
ffffd207`c94d05b0 fffff805`109d4610 : 00000000`00014000 ffffd587`aa42e1e0 00000000`00000000 ffffad80`bdd20380 : nt!KiBugCheckDispatch+0x69
ffffd207`c94d06f0 fffff805`109d29a3 : 00000000`00000800 00000000`00000000 00000000`00000000 fffff3f9`e960f010 : nt!KiFastFailDispatch+0xd0
ffffd207`c94d08d0 fffff805`10a65c3b : 00000000`00000022 ffffad80`c58357f0 fffff805`1091b778 ffffd207`c94d0af9 : nt!KiRaiseSecurityCheckFailure+0x323
ffffd207`c94d0a68 fffff805`1091b778 : ffffd207`c94d0af9 00000000`00000023 ffffad80`c58357f0 ffffad80`bd200280 : nt!RtlRbRemoveNode+0x148d3b
ffffd207`c94d0a80 fffff805`1091b639 : 00010000`00000000 fffff805`00000000 00000000`00000002 00000000`00000000 : nt!RtlpHpVsChunkSplit+0x48
ffffd207`c94d0b50 fffff805`10854a09 : 00000000`00000023 ffffad80`00000210 ffffad80`00000210 00000000`00000004 : nt!RtlpHpVsContextAllocateInternal+0x3c9
ffffd207`c94d0bc0 fffff805`1090ba0b : fffff805`10c71a80 ffffd207`c94d0d40 ffffad80`00000001 fffff380`00001000 : nt!RtlpHpVsContextMultiAlloc+0x69
ffffd207`c94d0c40 fffff805`10b6f08d : 00000000`00000001 00000000`00000000 00000000`00000000 00000000`00000200 : nt!ExAllocateHeapPool+0x95b
ffffd207`c94d0d80 fffff805`10ed40fa : 00000000`00000200 ffffd207`c94d0df0 ffffad80`c321ebe0 00000000`00000000 : nt!ExAllocatePoolWithTag+0x5d
ffffd207`c94d0dd0 fffff805`10ed3b88 : ffffad80`c2385db0 00000000`00000002 ffffad80`c2385db0 fffed006`510dc623 : nt!PopEtAggregateGet+0x6a
ffffd207`c94d0e20 fffff805`10ed389d : ffffd587`aff0d080 ffffd587`aff0d080 00000000`000001b0 ffffad80`c321ebb0 : nt!PopEtEnergyTrackerUpdateAggregate+0x70
ffffd207`c94d1040 fffff805`10ed37de : 00000000`000001b0 ffffad80`c2385db0 ffffd587`aff0d080 ffffd207`c94d13e8 : nt!PopEtProcessSnapshotUpdate+0x55
ffffd207`c94d1090 fffff805`10e41be7 : 00000000`00003000 ffffd587`aff0c3c0 ffffd587`aff0d080 fffff805`10ed3740 : nt!PopEtProcessEnumSnapshotCallback+0x9e
ffffd207`c94d1280 fffff805`10dfd735 : ffffad80`c321ebb0 ffffd207`c94d1c80 00000000`00000000 00000000`00000001 : nt!PsEnumProcesses+0x37
ffffd207`c94d12b0 fffff805`10de672b : 00000000`0000005d 00000000`00000001 ffffd587`afc3f2c0 00000000`00000000 : nt!PopEtEnergyTrackerQuery+0x129
ffffd207`c94d1440 fffff805`109d3c15 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtPowerInformation+0x1b0b
ffffd207`c94d1b90 00007fff`035fcc44 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000001`2cdfc7f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`035fcc44
THREAD_SHA1_HASH_MOD_FUNC: 95a475fe7318134a1102e3005ea2243e58273a23
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 57800fc590a52bd03ffe8f46ce4d3216d6293730
THREAD_SHA1_HASH_MOD: 82d14546c43bd06881f781d6d197c4c7f7ceb9cb
FOLLOWUP_IP:
nt!KiFastFailDispatch+d0
fffff805`109d4610 c644242000 mov byte ptr [rsp+20h],0
FAULT_INSTR_CODE: 202444c6
SYMBOL_STACK_INDEX: 2
SYMBOL_NAME: nt!KiFastFailDispatch+d0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 5629d63a
IMAGE_VERSION: 10.0.18362.778
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: 0x139_1d_INVALID_BALANCED_TREE_nt!KiFastFailDispatch
BUCKET_ID: 0x139_1d_INVALID_BALANCED_TREE_nt!KiFastFailDispatch
PRIMARY_PROBLEM_CLASS: 0x139_1d_INVALID_BALANCED_TREE_nt!KiFastFailDispatch
TARGET_TIME: 2020-04-20T09:44:00.000Z
OSBUILD: 18362
OSSERVICEPACK: 778
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2015-10-23 09:39:54
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: ced
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_1d_invalid_balanced_tree_nt!kifastfaildispatch
FAILURE_ID_HASH: {67ec97ad-ad0b-071e-ab87-6dc661e22d1b}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 000000000000001d, Type of memory safety violation
Arg2: ffffbe03b03b5c40, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffbe03b03b5b98, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: Gigabyte Technology Co., Ltd.
SYSTEM_PRODUCT_NAME: G31M-ES2C
BIOS_VENDOR: Award Software International, Inc.
BIOS_VERSION: F8
BIOS_DATE: 09/29/2009
BASEBOARD_MANUFACTURER: Gigabyte Technology Co., Ltd.
BASEBOARD_PRODUCT: G31M-S2C
DUMP_TYPE: 2
BUGCHECK_P1: 1d
BUGCHECK_P2: ffffbe03b03b5c40
BUGCHECK_P3: ffffbe03b03b5b98
BUGCHECK_P4: 0
TRAP_FRAME: ffffbe03b03b5c40 -- (.trap 0xffffbe03b03b5c40)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=000000000000001d
rdx=ffff960894fd3878 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8027d265c3b rsp=ffffbe03b03b5dd8 rbp=0000000000000022
r8=0000000000000000 r9=0000000000000000 r10=ffff960894ff6a98
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe cy
nt!RtlRbRemoveNode+0x148d3b:
fffff802`7d265c3b cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffbe03b03b5b98 -- (.exr 0xffffbe03b03b5b98)
ExceptionAddress: fffff8027d265c3b (nt!RtlRbRemoveNode+0x0000000000148d3b)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 000000000000001d
Subcode: 0x1d FAST_FAIL_INVALID_BALANCED_TREE
CPU_COUNT: 2
CPU_MHZ: bb8
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 17
CPU_STEPPING: a
CPU_MICROCODE: 6,17,a,0 (F,M,S,R) SIG: A0C'00000000 (cache) A0C'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x139
PROCESS_NAME: System
CURRENT_IRQL: 2
DEFAULT_BUCKET_ID: FAIL_FAST_INVALID_BALANCED_TREE
ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 000000000000001d
ANALYSIS_SESSION_HOST: DESKTOP-ME9UFOB
ANALYSIS_SESSION_TIME: 04-20-2020 16:49:32.0927
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff8027d1d41e9 to fffff8027d1c2390
STACK_TEXT:
ffffbe03`b03b5918 fffff802`7d1d41e9 : 00000000`00000139 00000000`0000001d ffffbe03`b03b5c40 ffffbe03`b03b5b98 : nt!KeBugCheckEx
ffffbe03`b03b5920 fffff802`7d1d4610 : 00000000`00000001 ffffbc5e`2f178bf0 ffffbc5e`2f178bc0 ffffbc5e`2f178bc0 : nt!KiBugCheckDispatch+0x69
ffffbe03`b03b5a60 fffff802`7d1d29a3 : ffffb47a`20d48ce5 fffff802`7d6ce56a 00000000`00000103 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffffbe03`b03b5c40 fffff802`7d265c3b : 00000022`00220000 00010022`00220000 fffff802`7d11cc80 00000000`00000022 : nt!KiRaiseSecurityCheckFailure+0x323
ffffbe03`b03b5dd8 fffff802`7d11cc80 : 00000000`00000022 ffff9608`94fd3a90 00000000`00000000 ffff9608`94fd3870 : nt!RtlRbRemoveNode+0x148d3b
ffffbe03`b03b5df0 fffff802`7d11c73a : ffff9608`88c02280 ffff9608`88c02280 ffff9608`955f0b70 ffffbe03`b03b5f00 : nt!RtlpHpVsChunkCoalesce+0xb0
ffffbe03`b03b5e60 fffff802`7d11e9ad : ffffab8a`0000007a ffffab8a`00000000 00000000`00960017 01000000`00000000 : nt!RtlpHpVsContextFree+0x18a
ffffbe03`b03b5f00 fffff802`7d36f019 : 00000000`00002000 00000000`00000210 ffff9608`955b6ea0 01000000`00100000 : nt!ExFreeHeapPool+0x56d
ffffbe03`b03b6020 fffff802`7e331eee : ffff9608`00000000 ffff9608`89be64a0 00000000`00000000 ffff9608`930d0040 : nt!ExFreePool+0x9
ffffbe03`b03b6050 fffff802`7e33889e : ffff9608`955b6ea0 00000000`00000000 ffffab8a`61e29748 ffff9608`89be64a0 : FLTMGR!ExFreeToNPagedLookasideList+0x52
ffffbe03`b03b6080 fffff802`7e36efb2 : ffff9608`955b6ea0 00000000`00000000 00000000`00000000 ffff9608`955b6ea0 : FLTMGR!FltpReleaseStreamListCtrl+0xbe
ffffbe03`b03b60c0 fffff802`7d5c174b : ffffab8a`61e29700 ffff9608`955b6ea8 ffffab8a`00000000 ffff9608`97f7bd78 : FLTMGR!DeleteStreamListCtrlCallback+0xc2
ffffbe03`b03b6100 fffff802`7eeeece1 : ffffab8a`61e29700 ffffbe03`b03b6238 ffff9608`97f7bd78 00000000`00000705 : nt!FsRtlTeardownPerStreamContexts+0xcb
ffffbe03`b03b6140 fffff802`7eeef632 : ffffab8a`61e29700 fffff802`7ee1a12a ffffab8a`0000019c ffffab8a`00000000 : Ntfs!NtfsDeleteScb+0x161
ffffbe03`b03b61d0 fffff802`7ee14225 : ffffab8a`61e295e0 ffffab8a`61e29700 ffffab8a`61e295a0 ffffab8a`61e29700 : Ntfs!NtfsRemoveScb+0xba
ffffbe03`b03b6230 fffff802`7eeef370 : ffff9608`97f7bd78 ffffbe03`b03b6660 ffffab8a`61e295a0 ffffab8a`61e29900 : Ntfs!NtfsPrepareFcbForRemoval+0x75
ffffbe03`b03b6270 fffff802`7ee1892a : ffff9608`97f7bd78 ffffbe03`b03b6371 ffffab8a`61e299e8 ffff9608`97f7bd78 : Ntfs!NtfsTeardownStructures+0xa0
ffffbe03`b03b62f0 fffff802`7ef10bac : ffffbe03`b03b6400 ffffab8a`00000000 ffff9608`00000000 ffff9608`97f7bd78 : Ntfs!NtfsDecrementCloseCounts+0xaa
ffffbe03`b03b6330 fffff802`7ef0faf1 : ffff9608`97f7bd78 ffffab8a`61e29700 ffffab8a`61e295a0 ffff9608`89bec180 : Ntfs!NtfsCommonClose+0x45c
ffffbe03`b03b6410 fffff802`7f028ddd : ffff9608`00000001 00000000`00000000 ffffbe03`b03b6701 ffff9608`00000020 : Ntfs!NtfsFspCloseInternal+0x241
ffffbe03`b03b6570 fffff802`7f0292c7 : ffffbe03`b03b67d0 ffff9608`89bec180 ffff9608`89bec180 ffff9608`89bec180 : Ntfs!NtfsCheckpointVolumeForShutdown+0x65
ffffbe03`b03b65f0 fffff802`7f0293ec : ffffbe03`b03b67d0 ffff9608`911c6700 ffff9608`89bec180 ffff9608`89bec180 : Ntfs!NtfsShutdownVolume+0xc7
ffffbe03`b03b6680 fffff802`7ef29134 : ffff9608`911c6702 ffff9608`89bec180 ffff9608`89bec180 ffff9608`911c6700 : Ntfs!NtfsShutdownVolumeWorker+0xc
ffffbe03`b03b66b0 fffff802`7f02906d : ffffbe03`b03b67d0 00000000`00000000 00000000`00000000 fffff802`7f0293e0 : Ntfs!NtfsForEachVcb+0x208
ffffbe03`b03b6760 fffff802`7d10a929 : ffff9608`89a57280 ffffffff`ffffffff ffff9608`89a569b0 00000000`00000000 : Ntfs!NtfsFsdShutdown+0x15d
ffffbe03`b03b6a50 fffff802`7e333f43 : ffff9608`89a57280 ffff9608`89a569b0 ffff9608`911c6700 fffff802`7d4637d0 : nt!IofCallDriver+0x59
ffffbe03`b03b6a90 fffff802`7d10a929 : ffff9608`89a57280 fffff802`7d501990 00000000`00000000 ffffbe03`b03b6b80 : FLTMGR!FltpDispatch+0xe3
ffffbe03`b03b6af0 fffff802`7d5a9e01 : ffff9608`89a56a00 ffffbe03`b03b6c20 00000000`00000000 ffff9608`89a569b0 : nt!IofCallDriver+0x59
ffffbe03`b03b6b30 fffff802`7d5a9b33 : 00000000`00000001 ffff9608`893136a0 fffff802`7d444360 00000000`00000001 : nt!IopShutdownBaseFileSystems+0xcd
ffffbe03`b03b6bb0 fffff802`7d5aeaea : 00000000`00000002 00000000`00000002 fffff802`7d444360 00000000`00000000 : nt!IoShutdownSystem+0x15b
ffffbe03`b03b6c30 fffff802`7d0f43b5 : ffff9608`893136a0 ffff9608`930d0000 ffff9608`89313600 ffff9608`893136a0 : nt!PopGracefulShutdown+0x23a
ffffbe03`b03b6c70 fffff802`7d06bcd5 : ffff9608`930d0040 00000000`00000080 ffff9608`89279080 00000000`00030d40 : nt!ExpWorkerThread+0x105
ffffbe03`b03b6d10 fffff802`7d1c9998 : ffffe400`25200180 ffff9608`930d0040 fffff802`7d06bc80 ffff8263`d7626146 : nt!PspSystemThreadStartup+0x55
ffffbe03`b03b6d60 00000000`00000000 : ffffbe03`b03b7000 ffffbe03`b03b1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
THREAD_SHA1_HASH_MOD_FUNC: a9438569ea7a2ab8b27359ce59bb12ee88c31785
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: c1262ba5bca15e7ef3a34d4f7c8bca6c2e9a7357
THREAD_SHA1_HASH_MOD: 92dc0b8f45d7c474e3b2ff838b0573e5dcdf1d45
FOLLOWUP_IP:
nt!ExFreePool+9
fffff802`7d36f019 4883c428 add rsp,28h
FAULT_INSTR_CODE: 28c48348
SYMBOL_STACK_INDEX: 8
SYMBOL_NAME: nt!ExFreePool+9
FOLLOWUP_NAME: Pool_corruption
IMAGE_NAME: Pool_Corruption
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.778
MODULE_NAME: Pool_Corruption
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 9
FAILURE_BUCKET_ID: 0x139_1d_INVALID_BALANCED_TREE_nt!ExFreePool
BUCKET_ID: 0x139_1d_INVALID_BALANCED_TREE_nt!ExFreePool
PRIMARY_PROBLEM_CLASS: 0x139_1d_INVALID_BALANCED_TREE_nt!ExFreePool
TARGET_TIME: 2020-04-20T13:02:31.000Z
OSBUILD: 18362
OSSERVICEPACK: 778
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2015-10-23 09:39:54
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 12eb
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_1d_invalid_balanced_tree_nt!exfreepool
FAILURE_ID_HASH: {ab43366d-59cb-5971-8e17-b53398bf3f90}
Followup: Pool_corruption
---------
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8072469332a, The address that the exception occurred at
Arg3: ffffb50550178fe8, Exception Record Address
Arg4: ffffb50550178830, Context Record Address
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : AV.Dereference
Value: NullClassPtr
Key : AV.Fault
Value: Read
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: Gigabyte Technology Co., Ltd.
SYSTEM_PRODUCT_NAME: G31M-ES2C
BIOS_VENDOR: Award Software International, Inc.
BIOS_VERSION: F8
BIOS_DATE: 09/29/2009
BASEBOARD_MANUFACTURER: Gigabyte Technology Co., Ltd.
BASEBOARD_PRODUCT: G31M-S2C
DUMP_TYPE: 2
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8072469332a
BUGCHECK_P3: ffffb50550178fe8
BUGCHECK_P4: ffffb50550178830
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
FAULTING_IP:
nt!MmUnmapViewInSystemCache+aa
fffff807`2469332a 488b4040 mov rax,qword ptr [rax+40h]
EXCEPTION_RECORD: ffffb50550178fe8 -- (.exr 0xffffb50550178fe8)
ExceptionAddress: fffff8072469332a (nt!MmUnmapViewInSystemCache+0x00000000000000aa)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000040
Attempt to read from address 0000000000000040
CONTEXT: ffffb50550178830 -- (.cxr 0xffffb50550178830)
rax=0000000000000000 rbx=ffffd001ec086370 rcx=fffff80724a68100
rdx=0000000000000000 rsi=0000000000000000 rdi=ffffbb8d4c8d87f0
rip=fffff8072469332a rsp=ffffb50550179220 rbp=ffffa50422300000
r8=0000000000000000 r9=ffffbb8d4c8d8828 r10=0000000000000006
r11=0000000000000000 r12=0000000000000001 r13=0000000000000000
r14=ffff8b5282111800 r15=0000000000000001
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00010246
nt!MmUnmapViewInSystemCache+0xaa:
fffff807`2469332a 488b4040 mov rax,qword ptr [rax+40h] ds:002b:00000000`00000040=????????????????
Resetting default scope
CPU_COUNT: 2
CPU_MHZ: bb8
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 17
CPU_STEPPING: a
CPU_MICROCODE: 6,17,a,0 (F,M,S,R) SIG: A0C'00000000 (cache) A0C'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
CURRENT_IRQL: 1
FOLLOWUP_IP:
nt!MmUnmapViewInSystemCache+aa
fffff807`2469332a 488b4040 mov rax,qword ptr [rax+40h]
BUGCHECK_STR: AV
READ_ADDRESS: fffff80724b733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
0000000000000040
DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE
ERROR_CODE: (NTSTATUS) 0xc0000005 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000040
ANALYSIS_SESSION_HOST: DESKTOP-ME9UFOB
ANALYSIS_SESSION_TIME: 04-20-2020 16:49:29.0395
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff80724c852bf to fffff8072469332a
STACK_TEXT:
ffffb505`50179220 fffff807`24c852bf : ffffa504`22300000 ffffd001`ec086370 00000000`00000000 ffffbb8d`4fd1bad0 : nt!MmUnmapViewInSystemCache+0xaa
ffffb505`50179330 fffff807`24692232 : 00000000`00000000 ffffbb8d`4c8d87f0 ffffbb8d`4c71bcb8 00000000`00000000 : nt!CcUnmapVacb+0x63
ffffb505`50179370 fffff807`24625b0e : 00000000`00000601 00000000`00000000 ffffb505`50179400 ffffbb8d`3f39b9e0 : nt!CcUnmapVacbArray+0x202
ffffb505`501793e0 fffff807`246235a6 : ffffb505`50179400 ffffb505`501794a0 ffffb505`501794a0 fffff807`2471e9ad : nt!CcUnmapAndPurge+0x36
ffffb505`50179420 fffff807`2468d740 : ffffbb8d`4c8d87f0 ffffb505`501794f0 ffffbb8d`3f39b9e0 00000000`00000000 : nt!CcDeleteSharedCacheMap+0x12a
ffffb505`50179470 fffff807`2814254a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!CcUninitializeCacheMap+0x310
ffffb505`50179530 fffff807`280ef699 : ffffd001`e6b623d0 ffffd001`e6b62010 ffffd001`e6b62200 ffffd001`e6b623d0 : Ntfs!NtfsDeleteInternalAttributeStream+0xee
ffffb505`50179570 fffff807`28014225 : ffffd001`e6b62050 ffffd001`e6b62170 ffffd001`e6b62010 00000000`00000000 : Ntfs!NtfsRemoveScb+0x121
ffffb505`501795d0 fffff807`28014559 : ffffbb8d`3fbed180 fffff807`28145310 ffffd001`e3c735a0 ffffd001`e6b62010 : Ntfs!NtfsPrepareFcbForRemoval+0x75
ffffb505`50179610 fffff807`280ef3be : ffffb505`501799f0 ffffbb8d`3fbed180 ffffd001`e3c735a0 ffffd001`e3c739e8 : Ntfs!NtfsTeardownFromLcb+0x2b9
ffffb505`501796b0 fffff807`2801892a : ffffb505`501799f0 ffffb505`501797b1 ffffd001`e3c739e8 ffffb505`501799f0 : Ntfs!NtfsTeardownStructures+0xee
ffffb505`50179730 fffff807`28110bac : ffffb505`50179800 ffffd001`00000000 ffffb505`00000000 ffffb505`501799f0 : Ntfs!NtfsDecrementCloseCounts+0xaa
ffffb505`50179770 fffff807`2810faf1 : ffffb505`501799f0 ffffd001`e3c73700 ffffd001`e3c735a0 ffffbb8d`3fbed180 : Ntfs!NtfsCommonClose+0x45c
ffffb505`50179850 fffff807`28145398 : 00000000`0000001c fffff807`24b8f240 00000000`00000000 00000000`00000000 : Ntfs!NtfsFspCloseInternal+0x241
ffffb505`501799b0 fffff807`246f43b5 : ffffbb8d`3f3249e0 fffff807`24bf6d00 ffffbb8d`3f324900 ffffbb8d`3f3249e0 : Ntfs!NtfsFspClose+0x88
ffffb505`50179c70 fffff807`2466bcd5 : ffffbb8d`488e7040 00000000`00000080 ffffbb8d`3f279080 ffff94c8`465d6146 : nt!ExpWorkerThread+0x105
ffffb505`50179d10 fffff807`247c9998 : ffffe200`13a00180 ffffbb8d`488e7040 fffff807`2466bc80 00000000`00000001 : nt!PspSystemThreadStartup+0x55
ffffb505`50179d60 00000000`00000000 : ffffb505`5017a000 ffffb505`50174000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
THREAD_SHA1_HASH_MOD_FUNC: 96ee7c3ecea50f70a0bad63fe5623d722563a164
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: a99dd834005143b9a8772022eef0f9b5d4ff8cad
THREAD_SHA1_HASH_MOD: 0f2dac333869d087841043490f807e2d26b9d0fe
FAULT_INSTR_CODE: 40408b48
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: nt!MmUnmapViewInSystemCache+aa
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 5629d63a
IMAGE_VERSION: 10.0.18362.778
STACK_COMMAND: .cxr 0xffffb50550178830 ; kb
IMAGE_NAME: memory_corruption
BUCKET_ID_FUNC_OFFSET: aa
FAILURE_BUCKET_ID: AV_nt!MmUnmapViewInSystemCache
BUCKET_ID: AV_nt!MmUnmapViewInSystemCache
PRIMARY_PROBLEM_CLASS: AV_nt!MmUnmapViewInSystemCache
TARGET_TIME: 2020-04-20T12:35:07.000Z
OSBUILD: 18362
OSSERVICEPACK: 778
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 2015-10-23 09:39:54
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 75db
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_nt!mmunmapviewinsystemcache
FAILURE_ID_HASH: {80afe466-eb8f-b487-72ea-f53cab570ee4}
Followup: MachineOwner
---------
