drive.google.com
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000001, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8066ca0c842, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2249
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 2265
Key : Analysis.Init.CPU.mSec
Value: 781
Key : Analysis.Init.Elapsed.mSec
Value: 6773
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
FILE_IN_CAB: 013022-12984-01.dmp
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
BUGCHECK_CODE: a
BUGCHECK_P1: 1
BUGCHECK_P2: 2
BUGCHECK_P3: 1
BUGCHECK_P4: fffff8066ca0c842
WORKER_ROUTINE:
+0
00000000`00000001 ?? ???
WORK_ITEM: fffff8066ca0c842
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: EpicWebHelper.
TRAP_FRAME: ffff8087a1c7d530 -- (.trap 0xffff8087a1c7d530)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000001
rdx=000000000000007b rsi=0000000000000000 rdi=0000000000000000
rip=fffff8066ca0c842 rsp=ffff8087a1c7d6c0 rbp=0000000000000000
r8=0000000000000000 r9=ffffd101ae54a180 r10=ffffaa0f9ca0e080
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!KiSwapThread+0x542:
fffff806`6ca0c842 488901 mov qword ptr [rcx],rax ds:00000000`00000001=????????????????
Resetting default scope
STACK_TEXT:
ffff8087`a1c7d3e8 fffff806`6cc09269 : 00000000`0000000a 00000000`00000001 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
ffff8087`a1c7d3f0 fffff806`6cc05569 : ffffd101`ae54a180 fffff806`6cbfe4f2 000f8067`b4bbbdff ffffaa0f`00000001 : nt!KiBugCheckDispatch+0x69
ffff8087`a1c7d530 fffff806`6ca0c842 : ffffd101`00000000 00000000`00000000 00000000`00000000 fffff806`00000000 : nt!KiPageFault+0x469
ffff8087`a1c7d6c0 fffff806`6ca0bd2f : ffffe50b`00000003 fffff806`00000001 00000000`00000001 ffffaa0f`00000000 : nt!KiSwapThread+0x542
ffff8087`a1c7d770 fffff806`6ca0f663 : ffffaa0f`00000000 ffffaa0f`00000000 00000000`00000000 00000000`00000001 : nt!KiCommitThreadWait+0x14f
ffff8087`a1c7d810 fffff806`6ca0f098 : ffffaa0f`9a979cc0 00000000`00000001 ffffaa0f`991b2720 fffff806`00000000 : nt!KeRemoveQueueEx+0x263
ffff8087`a1c7d8b0 fffff806`6ced76ed : 00000000`00000000 00000000`00000000 ffffd101`ae3d5180 fffff806`6ca86c0a : nt!IoRemoveIoCompletion+0x98
ffff8087`a1c7d9e0 fffff806`6cc08cb8 : ffffaa0f`9ae15080 0000007b`b161f378 ffff8087`a1c7daa8 0000020f`0e177880 : nt!NtRemoveIoCompletion+0x13d
ffff8087`a1c7da90 00007ffc`2112ce94 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
0000007b`b161f358 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`2112ce94
SYMBOL_NAME: nt!KiPageFault+469
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.1466
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 469
FAILURE_BUCKET_ID: AV_nt!KiPageFault
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {ec3e2762-48ae-ffe9-5b16-fbcb853e8320}
Followup: MachineOwner
---------
KERNEL_THREAD_PRIORITY_FLOOR_VIOLATION (157)
An illegal operation was attempted on the priority floor of a particular
thread.
Arguments:
Arg1: ffff9e83795df280, The address of the thread
Arg2: 0000000000000001, The target priority value
Arg3: 0000000000000002, The priority counter for the target priority underflowed
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3812
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 8046
Key : Analysis.Init.CPU.mSec
Value: 843
Key : Analysis.Init.Elapsed.mSec
Value: 6993
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
FILE_IN_CAB: 013122-11812-01.dmp
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
BUGCHECK_CODE: 157
BUGCHECK_P1: ffff9e83795df280
BUGCHECK_P2: 1
BUGCHECK_P3: 2
BUGCHECK_P4: 0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
STACK_TEXT:
ffff9688`7e0d67c8 fffff800`6187adec : 00000000`00000157 ffff9e83`795df280 00000000`00000001 00000000`00000002 : nt!KeBugCheckEx
ffff9688`7e0d67d0 fffff800`61607e8d : ffff9688`7e0d68e0 00000000`00000000 ffff9688`00000000 00000000`00000000 : nt!KiAbThreadUnboostCpuPriority+0x139fc8
ffff9688`7e0d6840 fffff800`616079f3 : ffff9e83`795df280 fffff800`709554a8 ffff9688`7e0d67e1 00000000`00000001 : nt!KiAbThreadRemoveBoosts+0x5d
ffff9688`7e0d6870 fffff800`7095951a : 00000000`00000000 fffff800`00000001 ffff8504`0000c965 ffff8504`cd878d84 : nt!ExReleasePushLockExclusiveEx+0x1a3
ffff9688`7e0d68d0 fffff800`70958f8f : 00000000`00000000 ffff8504`cd878c30 fffff800`709554b8 00000000`00000000 : bam!BampCommitThrottledProcessStateChange+0x43a
ffff9688`7e0d6bd0 fffff800`61755995 : ffff9e83`795df280 ffffffff`fd408b56 00000000`00000080 fffff800`70958df0 : bam!BampThrottlingWorker+0x19f
ffff9688`7e0d6c10 fffff800`617fe938 : ffffdc81`1d5d5180 ffff9e83`795df280 fffff800`61755940 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffff9688`7e0d6c60 00000000`00000000 : ffff9688`7e0d7000 ffff9688`7e0d1000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: bam!BampCommitThrottledProcessStateChange+43a
MODULE_NAME: bam
IMAGE_NAME: bam.sys
IMAGE_VERSION: 10.0.19041.1030
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 43a
FAILURE_BUCKET_ID: 0x157_bam!BampCommitThrottledProcessStateChange
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {795c6bb5-d704-935d-08b6-df419e6de781}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffffb07ccec85d0, Address of the trap frame for the exception that caused the BugCheck
Arg3: fffffb07ccec8528, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3077
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 23749
Key : Analysis.Init.CPU.mSec
Value: 874
Key : Analysis.Init.Elapsed.mSec
Value: 6782
Key : Analysis.Memory.CommitPeak.Mb
Value: 87
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
FILE_IN_CAB: 013022-12812-01.dmp
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: fffffb07ccec85d0
BUGCHECK_P3: fffffb07ccec8528
BUGCHECK_P4: 0
TRAP_FRAME: fffffb07ccec85d0 -- (.trap 0xfffffb07ccec85d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffb07ce748960 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80751e871ed rsp=fffffb07ccec8760 rbp=ffffe3870d5b4080
r8=0000000000000001 r9=0000000000000000 r10=00000000fffffffe
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!KiExitDispatcher+0x1ad:
fffff807`51e871ed cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: fffffb07ccec8528 -- (.exr 0xfffffb07ccec8528)
ExceptionAddress: fffff80751e871ed (nt!KiExitDispatcher+0x00000000000001ad)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: nvsphelper64.e
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
fffffb07`ccec82a8 fffff807`52009269 : 00000000`00000139 00000000`00000003 fffffb07`ccec85d0 fffffb07`ccec8528 : nt!KeBugCheckEx
fffffb07`ccec82b0 fffff807`52009690 : ffffcaad`c2859010 00000000`00000000 ffffcaad`c2859010 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffffb07`ccec83f0 fffff807`52007a23 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
fffffb07`ccec85d0 fffff807`51e871ed : 00000000`00000000 00000000`ffffffff 00000000`00000000 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x323
fffffb07`ccec8760 fffff807`51e0a6d3 : ffffe387`0b119f10 ffffcaad`00000000 ffffe387`0b119f10 00000000`00000000 : nt!KiExitDispatcher+0x1ad
fffffb07`ccec87d0 fffff807`51e0a248 : ffffe387`00000000 fffffb07`ccec8b80 00000000`000061a8 00000000`00000000 : nt!ExpReleaseResourceExclusiveForThreadLite+0x3c3
fffffb07`ccec88b0 ffffcae5`fca44914 : 00000000`00000000 00000000`00000000 000000d4`9c7ff338 00000000`00000000 : nt!ExReleaseResourceAndLeaveCriticalRegion+0x88
fffffb07`ccec8910 ffffcae5`fcd8224a : fffffb07`ccec89d8 00000000`00000000 00000000`00000000 fffffb07`ccec8aa8 : win32kbase!UserSessionSwitchLeaveCrit+0x74
fffffb07`ccec8980 ffffcae5`fd6771ad : ffffe387`0ebcd080 000000d4`9c7ff228 fffffb07`ccec8aa8 00000000`000202fe : win32kfull!NtUserPeekMessage+0x1aa
fffffb07`ccec8a40 fffff807`52008cb8 : fffffb07`ccec8b18 00000000`00000000 ffffe387`00000000 ffffe387`0eab98d0 : win32k!NtUserPeekMessage+0x29
fffffb07`ccec8a90 00007ffe`a48e1064 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000d4`9c7ff208 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`a48e1064
SYMBOL_NAME: win32kbase!UserSessionSwitchLeaveCrit+74
MODULE_NAME: win32kbase
IMAGE_NAME: win32kbase.sys
IMAGE_VERSION: 10.0.19041.1469
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 74
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_win32kbase!UserSessionSwitchLeaveCrit
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {0a5d7812-de29-e317-2ea0-92b5d30889e6}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000000, A stack-based buffer has been overrun.
Arg2: 0000000000000000, Address of the trap frame for the exception that caused the BugCheck
Arg3: 0000000000000000, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2390
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 2423
Key : Analysis.Init.CPU.mSec
Value: 734
Key : Analysis.Init.Elapsed.mSec
Value: 5650
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
FILE_IN_CAB: 020122-12531-01.dmp
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
BUGCHECK_CODE: 139
BUGCHECK_P1: 0
BUGCHECK_P2: 0
BUGCHECK_P3: 0
BUGCHECK_P4: 0
TRAP_FRAME: 0000000000000000 -- (.trap 0x0)
EXCEPTION_RECORD: 0000000000000000 -- (.exr 0x0)
Cannot read Exception record @ 0000000000000000
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
STACK_TEXT:
ffffa50c`3f0458a8 fffff803`4e7ffdeb : 00000000`00000139 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
ffffa50c`3f0458b0 fffff803`4e6816f2 : ffffc90c`99fca420 ffffa881`eefd5180 ffffa881`eefd5180 00000000`00000002 : nt!guard_icall_bugcheck+0x1b
ffffa50c`3f0458e0 fffff803`4e699a5d : 00000000`00000000 00000000`00000000 00000000`00140001 00000000`001096c1 : nt!KiProcessExpiredTimerList+0x172
ffffa50c`3f0459d0 fffff803`4e7fae4e : ffffffff`00000000 ffffa881`eefd5180 ffffa881`eefe01c0 ffffc90c`99155080 : nt!KiRetireDpcList+0x5dd
ffffa50c`3f045c60 00000000`00000000 : ffffa50c`3f046000 ffffa50c`3f040000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e
SYMBOL_NAME: nt!guard_icall_bugcheck+1b
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.1466
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 1b
FAILURE_BUCKET_ID: 0x139_0_LEGACY_GS_VIOLATION_nt!guard_icall_bugcheck
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {9bee41a7-2ef9-07ca-7e59-7d5a0c6e2d05}
Followup: MachineOwner
---------
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name is printed on
the BugCheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffffbd04be193298, Virtual address for the attempted execute.
Arg2: 810000009d508963, PTE contents.
Arg3: ffffb60aa34fb5e0, (reserved)
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3311
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 5470
Key : Analysis.Init.CPU.mSec
Value: 828
Key : Analysis.Init.Elapsed.mSec
Value: 5840
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
FILE_IN_CAB: 020122-12562-01.dmp
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
BUGCHECK_CODE: fc
BUGCHECK_P1: ffffbd04be193298
BUGCHECK_P2: 810000009d508963
BUGCHECK_P3: ffffb60aa34fb5e0
BUGCHECK_P4: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: EpicWebHelper.
TRAP_FRAME: ffffb60aa34fb5e0 -- (.trap 0xffffb60aa34fb5e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffa583fb90bac8 rbx=0000000000000000 rcx=0000000000000000
rdx=00000000000000ca rsi=0000000000000000 rdi=0000000000000000
rip=ffffbd04be193298 rsp=ffffb60aa34fb770 rbp=ffff8400fafd5180
r8=0000000000000000 r9=ffff8400fafd5180 r10=ffffa58408768340
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
ffffbd04`be193298 0020 add byte ptr [rax],ah ds:ffffa583`fb90bac8=??
Resetting default scope
STACK_TEXT:
ffffb60a`a34fb2f8 fffff803`16484028 : 00000000`000000fc ffffbd04`be193298 81000000`9d508963 ffffb60a`a34fb5e0 : nt!KeBugCheckEx
ffffb60a`a34fb300 fffff803`162bdbb6 : ffffbd04`be193298 ffffb60a`a34fb500 1a000001`00000000 ffff8000`00000000 : nt!MiCheckSystemNxFault+0x12dec0
ffffb60a`a34fb340 fffff803`1629f4d0 : 00000000`00082e45 00000000`00000011 ffffb60a`a34fb660 00000000`00000000 : nt!MiSystemFault+0x6c6
ffffb60a`a34fb440 fffff803`1640545e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0x400
ffffb60a`a34fb5e0 ffffbd04`be193298 : ffffbd04`00000003 fffff803`00000001 00000000`00000000 ffffa584`00000000 : nt!KiPageFault+0x35e
ffffb60a`a34fb770 ffffbd04`00000003 : fffff803`00000001 00000000`00000000 ffffa584`00000000 ffffbd04`00000000 : 0xffffbd04`be193298
ffffb60a`a34fb778 fffff803`00000001 : 00000000`00000000 ffffa584`00000000 ffffbd04`00000000 ffffa584`00ac6240 : 0xffffbd04`00000003
ffffb60a`a34fb780 00000000`00000000 : ffffa584`00000000 ffffbd04`00000000 ffffa584`00ac6240 ffff8400`00000000 : 0xfffff803`00000001
SYMBOL_NAME: nt!MiCheckSystemNxFault+12dec0
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.1466
STACK_COMMAND: .cxr; .ecxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 12dec0
FAILURE_BUCKET_ID: 0xFC_nt!MiCheckSystemNxFault
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {a6ae5288-6b71-974a-9b09-23f14d998164}
Followup: MachineOwner
---------
Machine ID Information [From Smbios 3.2, DMIVersion 0, Size=2318]
BiosMajorRelease = 5
BiosMinorRelease = 14
BiosVendor = American Megatrends Inc.
BiosVersion = F1
BiosReleaseDate = 12/10/2019
SystemManufacturer = Gigabyte Technology Co., Ltd.
SystemProductName = B450M H
SystemFamily = Default string
SystemVersion = Default string
SystemSKU = Default string
BaseBoardManufacturer = Gigabyte Technology Co., Ltd.
BaseBoardProduct = B450M H
BaseBoardVersion = x.xPAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffbe0ff7fbf5c0, memory referenced.
Arg2: 0000000000000011, value 0 = read operation, 1 = write operation.
Arg3: ffffbe0ff7fbf5c0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : AV.PTE
Value: Valid
Key : AV.Type
Value: Execute
Key : Analysis.CPU.mSec
Value: 3796
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 13576
Key : Analysis.Init.CPU.mSec
Value: 1030
Key : Analysis.Init.Elapsed.mSec
Value: 8608
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 072921-12484-01.dmp
BUGCHECK_CODE: 50
BUGCHECK_P1: ffffbe0ff7fbf5c0
BUGCHECK_P2: 11
BUGCHECK_P3: ffffbe0ff7fbf5c0
BUGCHECK_P4: 2
WRITE_ADDRESS: fffff80681cfa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffbe0ff7fbf5c0
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: audiodg.exe
TRAP_FRAME: fffff1812e748620 -- (.trap 0xfffff1812e748620)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000003c7ea6ef7 rbx=0000000000000000 rcx=fffff784c0002000
rdx=00000003ce51b45b rsi=0000000000000000 rdi=0000000000000000
rip=ffffbe0ff7fbf5c0 rsp=fffff1812e7487b0 rbp=00000003c7c74072
r8=fffffffff998ba9c r9=0000000000000008 r10=0000fffff8068136
r11=ffff9cfefea00000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
ffffbe0f`f7fbf5c0 06 ???
Resetting default scope
STACK_TEXT:
fffff181`2e748378 fffff806`8144a1a9 : 00000000`00000050 ffffbe0f`f7fbf5c0 00000000`00000011 fffff181`2e748620 : nt!KeBugCheckEx
fffff181`2e748380 fffff806`8129f500 : ffffbe0f`f53cc010 00000000`00000011 fffff181`2e7486a0 00000000`00000000 : nt!MiSystemFault+0x18cdf9
fffff181`2e748480 fffff806`8140505e : 00000000`00000000 00000000`00000000 00000000`00000000 fffff806`81284f57 : nt!MmAccessFault+0x400
fffff181`2e748620 ffffbe0f`f7fbf5c0 : 00000003`c7ea5c1c 00000000`00989680 fffff780`00000340 00000000`00335aac : nt!KiPageFault+0x35e
fffff181`2e7487b0 00000003`c7ea5c1c : 00000000`00989680 fffff780`00000340 00000000`00335aac 00000000`00000008 : 0xffffbe0f`f7fbf5c0
fffff181`2e7487b8 00000000`00989680 : fffff780`00000340 00000000`00335aac 00000000`00000008 00000000`00000000 : 0x00000003`c7ea5c1c
fffff181`2e7487c0 fffff780`00000340 : 00000000`00335aac 00000000`00000008 00000000`00000000 ffffbe0f`f547a390 : 0x989680
fffff181`2e7487c8 00000000`00335aac : 00000000`00000008 00000000`00000000 ffffbe0f`f547a390 00000000`00000000 : 0xfffff780`00000340
fffff181`2e7487d0 00000000`00000008 : 00000000`00000000 ffffbe0f`f547a390 00000000`00000000 00000000`00015f16 : 0x335aac
fffff181`2e7487d8 00000000`00000000 : ffffbe0f`f547a390 00000000`00000000 00000000`00015f16 fffff806`8134c919 : 0x8
SYMBOL_NAME: nt!MiSystemFault+18cdf9
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.1110
STACK_COMMAND: .cxr; .ecxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 18cdf9
FAILURE_BUCKET_ID: AV_X_(null)_nt!MiSystemFault
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {49578414-34a9-c6dc-c795-b8c5552d5975}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffc4807cf4f690, Address of the trap frame for the exception that caused the BugCheck
Arg3: ffffc4807cf4f5e8, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3234
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 9582
Key : Analysis.Init.CPU.mSec
Value: 827
Key : Analysis.Init.Elapsed.mSec
Value: 8095
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 072921-12500-01.dmp
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffffc4807cf4f690
BUGCHECK_P3: ffffc4807cf4f5e8
BUGCHECK_P4: 0
TRAP_FRAME: ffffc4807cf4f690 -- (.trap 0xffffc4807cf4f690)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff9d0fe2f8f1a0 rbx=0000000000000000 rcx=0000000000000003
rdx=ffff9d0fe4e71c40 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8041e47148f rsp=ffffc4807cf4f820 rbp=0000000000000057
r8=0000000000000001 r9=ffffc4807cf4f948 r10=0000000000000001
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!KiRemoveEntryTimer+0x149fcf:
fffff804`1e47148f cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffc4807cf4f5e8 -- (.exr 0xffffc4807cf4f5e8)
ExceptionAddress: fffff8041e47148f (nt!KiRemoveEntryTimer+0x0000000000149fcf)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: audiodg.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffffc480`7cf4f368 fffff804`1e408e69 : 00000000`00000139 00000000`00000003 ffffc480`7cf4f690 ffffc480`7cf4f5e8 : nt!KeBugCheckEx
ffffc480`7cf4f370 fffff804`1e409290 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffc480`7cf4f4b0 fffff804`1e407623 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffffc480`7cf4f690 fffff804`1e47148f : 00000001`ffffff01 fffffff6`00000000 00000000`00000000 01000000`00100000 : nt!KiRaiseSecurityCheckFailure+0x323
ffffc480`7cf4f820 fffff804`1e211bae : 00000000`00000000 00000000`00000000 00000000`00000000 ffffc480`7cf4f948 : nt!KiRemoveEntryTimer+0x149fcf
ffffc480`7cf4f890 fffff804`1e2114c5 : 00000000`00000000 ffffc480`7cf4faa8 ffffe1cc`1429da1f 00000000`0000000f : nt!ExpSetTimerObject+0x61e
ffffc480`7cf4fa40 fffff804`1e4088b8 : ffff9d0f`e42a1380 00000000`0000000f 00000000`00000000 00000000`00000a2c : nt!NtSetTimerEx+0x1b5
ffffc480`7cf4fb00 00007ffd`a70303f4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000ce`d0f7f5d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`a70303f4
SYMBOL_NAME: nt!KiRemoveEntryTimer+149fcf
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.1110
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 149fcf
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiRemoveEntryTimer
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {5cf1a79f-75db-1c81-82ec-116a11522249}
Followup: MachineOwner
---------
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
BugCheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: ffff8781ed07fe70
Arg3: 0000000000000000
Arg4: fffff80614208b34
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3359
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 13223
Key : Analysis.Init.CPU.mSec
Value: 890
Key : Analysis.Init.Elapsed.mSec
Value: 9505
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 073021-12562-01.dmp
BUGCHECK_CODE: 7f
BUGCHECK_P1: 8
BUGCHECK_P2: ffff8781ed07fe70
BUGCHECK_P3: 0
BUGCHECK_P4: fffff80614208b34
TRAP_FRAME: ffff8781ed07fe70 -- (.trap 0xffff8781ed07fe70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=000000000cac30ec
rdx=0000000000000030 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80614208b34 rsp=0000000000000000 rbp=000000000e23f0f8
r8=0000000000000000 r9=ffff8781ecfd5180 r10=ffffb08b67a6f9f0
r11=ffffb08b7764a080 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KiSystemServiceExit+0x274:
fffff806`14208b34 c3 ret
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: Discord.exe
STACK_TEXT:
ffff8781`ed07fd28 fffff806`14208e69 : 00000000`0000007f 00000000`00000008 ffff8781`ed07fe70 00000000`00000000 : nt!KeBugCheckEx
ffff8781`ed07fd30 fffff806`14203c83 : 50ea4f73`aacb7f4f b0ad2648`c2b0a6fc 6779674f`72b6b9ad c4b08501`89044f24 : nt!KiBugCheckDispatch+0x69
ffff8781`ed07fe70 fffff806`14208b34 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDoubleFaultAbort+0x2c3
00000000`00000000 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x274
SYMBOL_NAME: nt!KiDoubleFaultAbort+2c3
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.1110
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 2c3
FAILURE_BUCKET_ID: 0x7f_8_nt!KiDoubleFaultAbort
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {d1f8395a-8c58-45da-6ebf-e8bb4aad2fc5}
Followup: MachineOwner
---------
APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
BugCheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->CombinedApcDisable field. This consists of two separate 16-bit
fields, the SpecialApcDisable and the KernelApcDisable. A negative value
of either indicates that a driver has disabled special or normal APCs
(respectively) without re-enabling them; a positive value indicates that
a driver has enabled special or normal APCs (respectively) too many times.
Arguments:
Arg1: 00007ff92906cf44, Address of system call function or worker routine
Arg2: 0000000000000000, Thread->ApcStateIndex
Arg3: 000000000000ffff, (Thread->SpecialApcDisable << 16) | Thread->KernelApcDisable
Arg4: ffff968fd52b5b80, Call type (0 - system call, 1 - worker routine)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3655
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 8878
Key : Analysis.Init.CPU.mSec
Value: 827
Key : Analysis.Init.Elapsed.mSec
Value: 9744
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 073021-12890-01.dmp
BUGCHECK_CODE: 1
BUGCHECK_P1: 7ff92906cf44
BUGCHECK_P2: 0
BUGCHECK_P3: ffff
BUGCHECK_P4: ffff968fd52b5b80
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: chrome.exe
STACK_TEXT:
ffff968f`d52b5948 fffff802`7ea08c69 : 00000000`00000001 00007ff9`2906cf44 00000000`00000000 00000000`0000ffff : nt!KeBugCheckEx
ffff968f`d52b5950 fffff802`7ea08b33 : ffffbe01`46063080 000000ec`3fbff088 ffff968f`d52b5aa8 00005d4e`026be628 : nt!KiBugCheckDispatch+0x69
ffff968f`d52b5a90 00007ff9`2906cf44 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExitPico+0x1fe
000000ec`3fbff068 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`2906cf44
SYMBOL_NAME: nt!KiSystemServiceExitPico+1fe
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.985
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 1fe
FAILURE_BUCKET_ID: 0x1_SysCallNum_9_nt!KiSystemServiceExitPico
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {6e443843-03da-4362-9c96-0408520f2c85}
Followup: MachineOwner
---------
KERNEL_LOCK_ENTRY_LEAKED_ON_THREAD_TERMINATION (153)
A thread was terminated before it had freed all its AutoBoost lock entries.
This is typically caused when a thread never released a lock it previously
acquired (e.g. by relying on another thread to release it), or if the thread
did not supply a consistent set of flags to lock package APIs.
Arguments:
Arg1: ffffe20bb8d21080, The address of the thread
Arg2: ffffe20bb8d216d0, The address of the entry that was not freed
Arg3: 0000000000000002, Thread pointer reserved bits were set
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4124
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 15991
Key : Analysis.Init.CPU.mSec
Value: 796
Key : Analysis.Init.Elapsed.mSec
Value: 8864
Key : Analysis.Memory.CommitPeak.Mb
Value: 76
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
FILE_IN_CAB: 073021-13015-01.dmp
BUGCHECK_CODE: 153
BUGCHECK_P1: ffffe20bb8d21080
BUGCHECK_P2: ffffe20bb8d216d0
BUGCHECK_P3: 2
BUGCHECK_P4: 0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: chrome.exe
STACK_TEXT:
fffffc83`88a51ff8 fffff803`736972c7 : 00000000`00000153 ffffe20b`b8d21080 ffffe20b`b8d216d0 00000000`00000002 : nt!KeBugCheckEx
fffffc83`88a52000 fffff803`7355ad6e : ffffd00c`b5e00100 00000000`6c546553 ffffd00c`b5e00000 fffff803`735122c9 : nt!KiAbCleanupThreadState+0x13c507
fffffc83`88a52040 fffff803`739077ae : 00000000`00000000 fffffc83`88a52338 ffffe20b`ab010100 fffff803`73512172 : nt!KeCleanupThreadState+0xe
fffffc83`88a52070 fffff803`738e00f0 : ffffe20b`b8d21050 ffffe20b`b8d21050 fffffc83`88a52239 aaaaaaaa`aaaaaaaa : nt!PspThreadDelete+0x1e
fffffc83`88a520e0 fffff803`73408357 : 00000000`00000000 00000000`00000000 fffffc83`88a52239 ffffe20b`b8d21080 : nt!ObpRemoveObjectRoutine+0x80
fffffc83`88a52140 fffff803`7340827e : ffffe20b`b66bddd0 00000000`00000000 00000000`0000000b ffffd00c`bab2bda0 : nt!ObfDereferenceObjectWithTag+0xc7
fffffc83`88a52180 fffff803`7350e4d2 : 004f004a`004f004d 00360035`0032002e 00310039`002e0034 0031002e`00360035 : nt!HalPutDmaAdapter+0xe
fffffc83`88a521b0 fffff803`7350dda7 : ffffd00c`c15bc8d0 00000000`00000002 00000000`00000000 fffffc83`88a52338 : nt!IopfCompleteRequest+0x712
fffffc83`88a522a0 fffff803`808fea18 : ffffd00c`bab2bdb0 fffffc83`00000000 00000000`00000000 ffffe20b`bbb0d0e0 : nt!IofCompleteRequest+0x17
fffffc83`88a522d0 fffff803`808fe897 : 00000000`00000001 ffffe20b`ad06a7f0 ffffe20b`ad06a8a0 00000000`00000000 : Npfs!NpCommonCleanup+0x148
fffffc83`88a52380 fffff803`735185b5 : ffffe20b`addcfc70 ffffe20b`addcfc70 ffffe20b`bb5b4080 ffffe20b`bb007b70 : Npfs!NpFsdCleanup+0x27
fffffc83`88a523b0 fffff803`6fe04906 : ffffe20b`addcfc70 00000000`00000000 00000000`00000000 ffffe20b`bb5b4080 : nt!IofCallDriver+0x55
fffffc83`88a523f0 fffff803`735185b5 : ffffe20b`bbb0d0e0 fffff803`73518acd ffffe20b`ac2c8a60 fffffc83`88a52609 : FLTMGR!FltpDispatch+0xd6
fffffc83`88a52450 fffff803`738e2b6a : 00000000`00000000 ffffe20b`bbb0d0e0 00000000`00000000 00000000`00040080 : nt!IofCallDriver+0x55
fffffc83`88a52490 fffff803`737f36dc : 00000000`00000000 00000000`00007fe9 00000000`00000000 ffffe20b`ac2fbf00 : nt!IopCloseFile+0x17a
fffffc83`88a52520 fffff803`738c9605 : ffffe20b`b97cc098 fffff803`73408649 ffffe20b`b97cc060 00000000`00000000 : nt!ObCloseHandleTableEntry+0x24c
fffffc83`88a52660 fffff803`738cb45d : ffffe20b`b97cc060 ffffe20b`b9b65080 ffffffff`ffffff01 ffffe20b`bb5b44d8 : nt!ExSweepHandleTable+0xd5
fffffc83`88a52710 fffff803`738c9350 : ffffffff`ffffffff ffffe20b`bb5b4080 fffffc83`88a52760 fffff803`7381ff7c : nt!ObKillProcess+0x35
fffffc83`88a52740 fffff803`7385b856 : ffffe20b`bb5b4080 ffffd00d`13e6b060 fffffc83`88a52990 00000000`00000000 : nt!PspRundownSingleProcess+0x204
fffffc83`88a527d0 fffff803`738a5698 : 03030103`00000000 00000000`00000001 fffffc83`88a529e0 00000057`b8b9c000 : nt!PspExitThread+0x5f6
fffffc83`88a528d0 fffff803`7340f0d7 : 00000000`407a0088 00000000`00000000 00000000`00000000 bc6bec2e`bd7c86a1 : nt!KiSchedulerApcTerminate+0x38
fffffc83`88a52910 fffff803`735fb290 : 00000057`bb3ff758 fffffc83`88a529c0 fffffc83`88a52b80 00000863`00000000 : nt!KiDeliverApc+0x487
fffffc83`88a529c0 fffff803`7360875f : ffffe20b`b9b65080 ffffe20b`ad9d8a60 fffffc83`88a52b18 ffffffff`eced3000 : nt!KiInitiateUserApc+0x70
fffffc83`88a52b00 00007ffd`238acea4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
00000057`bb3ff728 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`238acea4
SYMBOL_NAME: Npfs!NpCommonCleanup+148
MODULE_NAME: Npfs
IMAGE_NAME: Npfs.SYS
IMAGE_VERSION: 10.0.19041.1030
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 148
FAILURE_BUCKET_ID: 0x153_KERNEL_LOCK_ENTRY_LEAKED_ON_THREAD_TERMINATION_RESERVED_BITS_SET_Npfs!NpCommonCleanup
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {cba35b18-25e8-c6b6-f67b-28fcea7c373f}
Followup: MachineOwner
---------Ama bunu dediğimizde de tersleniyoruz hocam.
Demek ki bilene danışacakmışsın.
