KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffffd01dac4c730, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffffd01dac4c688, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2921
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 5111
Key : Analysis.Init.CPU.mSec
Value: 531
Key : Analysis.Init.Elapsed.mSec
Value: 6311
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: fffffd01dac4c730
BUGCHECK_P3: fffffd01dac4c688
BUGCHECK_P4: 0
TRAP_FRAME: fffffd01dac4c730 -- (.trap 0xfffffd01dac4c730)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffd01dac4ca88 rbx=0000000000000000 rcx=0000000000000003
rdx=fffff80774e074b8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80774e5ff9c rsp=fffffd01dac4c8c0 rbp=ffffc4012cf40180
r8=fffffd01dac4c9c8 r9=0000000000000001 r10=ffff980bb9070110
r11=00007fffffff0000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po cy
nt!IopQueueIrpToFileObject+0x171f3c:
fffff807`74e5ff9c cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: fffffd01dac4c688 -- (.exr 0xfffffd01dac4c688)
ExceptionAddress: fffff80774e5ff9c (nt!IopQueueIrpToFileObject+0x0000000000171f3c)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: opera.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
fffffd01`dac4c408 fffff807`74e07a69 : 00000000`00000139 00000000`00000003 fffffd01`dac4c730 fffffd01`dac4c688 : nt!KeBugCheckEx
fffffd01`dac4c410 fffff807`74e07e90 : ffffc401`00000000 fffff807`74f193ce ffff980b`c989e080 fffffd01`dac4c500 : nt!KiBugCheckDispatch+0x69
fffffd01`dac4c550 fffff807`74e06223 : 00000000`00000008 ffffc401`2cf40180 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
fffffd01`dac4c730 fffff807`74e5ff9c : 980bc743`5c40b719 00000000`001a019f fffffd01`dac4c8f8 00000175`309368e0 : nt!KiRaiseSecurityCheckFailure+0x323
fffffd01`dac4c8c0 fffff807`74ffd970 : fffffd01`dac4cb80 fffff807`7502b17e ffff980b`d1364b70 00000000`00000000 : nt!IopQueueIrpToFileObject+0x171f3c
fffffd01`dac4c910 fffff807`74fe59b9 : ffff980b`00000000 fffffd01`dac4cb80 00000000`00000000 00000062`871ff7c0 : nt!IopSynchronousServiceTail+0x2a0
fffffd01`dac4c9b0 fffff807`74e074b8 : ffff980b`00000000 00000000`00000000 00000000`00000000 00000175`309368e0 : nt!NtReadFile+0x599
fffffd01`dac4ca90 00007ff8`fa4ec6e4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000062`871ff738 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`fa4ec6e4
SYMBOL_NAME: nt!KiFastFailDispatch+d0
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.804
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {3aede96a-54dd-40d6-d4cb-2a161a843851}
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffdf0f108dd560, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffdf0f108dd4b8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2405
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 2431
Key : Analysis.Init.CPU.mSec
Value: 390
Key : Analysis.Init.Elapsed.mSec
Value: 4223
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffffdf0f108dd560
BUGCHECK_P3: ffffdf0f108dd4b8
BUGCHECK_P4: 0
TRAP_FRAME: ffffdf0f108dd560 -- (.trap 0xffffdf0f108dd560)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffbe864319b1a0 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffbe864319b1a0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80571e35e6f rsp=ffffdf0f108dd6f0 rbp=0000000375f56a41
r8=0000000375f56a41 r9=fffff80571a00000 r10=fffff8056f9d8ac0
r11=ffffdf0f108dd800 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac pe cy
nt!KiInsertTimerTable+0x1cf1ef:
fffff805`71e35e6f cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffdf0f108dd4b8 -- (.exr 0xffffdf0f108dd4b8)
ExceptionAddress: fffff80571e35e6f (nt!KiInsertTimerTable+0x00000000001cf1ef)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
PROCESS_NAME: opera.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffffdf0f`108dd238 fffff805`71e07a69 : 00000000`00000139 00000000`00000003 ffffdf0f`108dd560 ffffdf0f`108dd4b8 : nt!KeBugCheckEx
ffffdf0f`108dd240 fffff805`71e07e90 : 00000000`0000003f 00000000`0000003f 00000000`00000008 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffdf0f`108dd380 fffff805`71e06223 : ffffbe86`3fd41080 ffffdf0f`108dd500 00000000`00000000 fffff805`71dfc806 : nt!KiFastFailDispatch+0xd0
ffffdf0f`108dd560 fffff805`71e35e6f : ffffdf0f`108dd710 ffffdf0f`108dd708 00000000`0000003f 00000000`0000003f : nt!KiRaiseSecurityCheckFailure+0x323
ffffdf0f`108dd6f0 fffff805`71c64fed : ffffbe86`4319b080 fffff805`8252d272 00000000`00000000 ffffbe86`00000000 : nt!KiInsertTimerTable+0x1cf1ef
ffffdf0f`108dd770 fffff805`71c686b3 : ffffbe86`0000007d ffffbe86`00000000 00000000`00000001 00000000`00000001 : nt!KiCommitThreadWait+0x3bd
ffffdf0f`108dd810 fffff805`71c680e8 : ffffbe86`40e7fec0 00000000`00000001 ffffbe86`444dea30 fffff805`00000002 : nt!KeRemoveQueueEx+0x263
ffffdf0f`108dd8b0 fffff805`720b7e9d : 00000000`00000000 00000000`00000000 ffff9480`639ea180 fffff805`71c4a31a : nt!IoRemoveIoCompletion+0x98
ffffdf0f`108dd9e0 fffff805`71e074b8 : ffffbe86`4319b080 000000da`9c9ff618 ffffdf0f`108ddaa8 00000239`4730a960 : nt!NtRemoveIoCompletion+0x13d
ffffdf0f`108dda90 00007ffa`ab46c744 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000da`9c9ff5f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`ab46c744
SYMBOL_NAME: nt!KiInsertTimerTable+1cf1ef
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1cf1ef
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiInsertTimerTable
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {f89e8bcc-9d62-a3aa-7602-6fa1ac774850}
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffffb18072033158, Virtual address for the attempted execute.
Arg2: 81000001ce712963, PTE contents.
Arg3: ffffeb07f3adf5e0, (reserved)
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2531
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 4224
Key : Analysis.Init.CPU.mSec
Value: 484
Key : Analysis.Init.Elapsed.mSec
Value: 9342
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: fc
BUGCHECK_P1: ffffb18072033158
BUGCHECK_P2: 81000001ce712963
BUGCHECK_P3: ffffeb07f3adf5e0
BUGCHECK_P4: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: opera.exe
TRAP_FRAME: ffffeb07f3adf5e0 -- (.trap 0xffffeb07f3adf5e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffda8c53802228 rbx=0000000000000000 rcx=0000000000000000
rdx=00000000000000da rsi=0000000000000000 rdi=0000000000000000
rip=ffffb18072033158 rsp=ffffeb07f3adf770 rbp=ffffc480a6140180
r8=00000001000000ed r9=ffffc480a6350180 r10=ffffda8c4ea75300
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
ffffb180`72033158 8831 mov byte ptr [rcx],dh ds:00000000`00000000=??
Resetting default scope
STACK_TEXT:
ffffeb07`f3adf2f8 fffff800`232718f0 : 00000000`000000fc ffffb180`72033158 81000001`ce712963 ffffeb07`f3adf5e0 : nt!KeBugCheckEx
ffffeb07`f3adf300 fffff800`2302aed6 : ffffb180`72033158 ffffeb07`f3adf500 00000000`00000000 ffff8000`00000000 : nt!MiCheckSystemNxFault+0x159368
ffffeb07`f3adf340 fffff800`2300c960 : 3ed3950e`c7f71438 00000000`00000011 ffffeb07`f3adf660 00000000`00000000 : nt!MiSystemFault+0x6c6
ffffeb07`f3adf440 fffff800`23203c5e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0x400
ffffeb07`f3adf5e0 ffffb180`72033158 : ffffb180`00000002 fffff800`00000005 00000000`00000000 ffffda8c`00000000 : nt!KiPageFault+0x35e
ffffeb07`f3adf770 ffffb180`00000002 : fffff800`00000005 00000000`00000000 ffffda8c`00000000 ffffb180`00000000 : 0xffffb180`72033158
ffffeb07`f3adf778 fffff800`00000005 : 00000000`00000000 ffffda8c`00000000 ffffb180`00000000 ffffda8c`534533b0 : 0xffffb180`00000002
ffffeb07`f3adf780 00000000`00000000 : ffffda8c`00000000 ffffb180`00000000 ffffda8c`534533b0 ffffc480`00000000 : 0xfffff800`00000005
SYMBOL_NAME: nt!MiCheckSystemNxFault+159368
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.804
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 159368
FAILURE_BUCKET_ID: 0xFC_nt!MiCheckSystemNxFault
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {a6ae5288-6b71-974a-9b09-23f14d998164}
Followup: MachineOwner
---------
KERNEL_MODE_HEAP_CORRUPTION (13a)
The kernel mode heap manager has detected corruption in a heap.
Arguments:
Arg1: 0000000000000011, Type of corruption detected
Arg2: ffff9902ae010100, Address of the heap that reported the corruption
Arg3: ffff9902b8c0b180, Address at which the corruption was detected
Arg4: 0000000000000000
Debugging Details:
------------------
fffff8015c8fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
HeapDbgInitExtension Failed
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 5593
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 7511
Key : Analysis.Init.CPU.mSec
Value: 468
Key : Analysis.Init.Elapsed.mSec
Value: 2965
Key : Analysis.Memory.CommitPeak.Mb
Value: 72
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 13a
BUGCHECK_P1: 11
BUGCHECK_P2: ffff9902ae010100
BUGCHECK_P3: ffff9902b8c0b180
BUGCHECK_P4: 0
POOL_ADDRESS: Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffff9902b8c0b180
FREED_POOL_TAG: NpFR
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: chrome.exe
IRP_ADDRESS: ffff9902bc31d788
STACK_TEXT:
ffffef86`3fe06588 fffff801`5c18da88 : 00000000`0000013a 00000000`00000011 ffff9902`ae010100 ffff9902`b8c0b180 : nt!KeBugCheckEx
ffffef86`3fe06590 fffff801`5c18dae8 : 00000000`00000011 00000000`00000000 ffff9902`ae010100 00000000`00000000 : nt!RtlpHeapHandleError+0x40
ffffef86`3fe065d0 fffff801`5c18d715 : 00000000`00000080 ffff9902`b8c02000 00000000`00000000 00000000`00000000 : nt!RtlpHpHeapHandleError+0x58
ffffef86`3fe06600 fffff801`5c025fae : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!RtlpLogHeapFailure+0x45
ffffef86`3fe06630 fffff801`5be4caf2 : ffff9902`ae010340 00000000`000000ff 00000000`00000000 00000000`00000000 : nt!RtlpHpLfhSubsegmentFreeBlock+0x1ed85e
ffffef86`3fe066e0 fffff801`5c5b1019 : 00000000`00000000 ffff9902`bc4911b0 ffff9902`b6c941c0 01000000`00100000 : nt!ExFreeHeapPool+0x362
ffffef86`3fe067c0 fffff801`5be4984e : 00000000`00000000 00000000`00000000 ffff9902`b6c94080 fffff801`5be686b3 : nt!ExFreePool+0x9
ffffef86`3fe067f0 fffff801`5be683e3 : ffff9902`bc31d800 00000000`00000001 ffff9902`bcf800d0 ffff9902`bcf800c0 : nt!IopCompleteRequest+0x8e
ffffef86`3fe068b0 fffff801`5c2b7ebd : 00000000`00000000 00000000`00000000 ffffa900`7adea180 fffff801`5be4a31a : nt!IoRemoveIoCompletion+0x393
ffffef86`3fe069e0 fffff801`5c0075b8 : ffff9902`b6c94080 000000bb`cffff878 ffffef86`3fe06aa8 000066b0`0042a9e8 : nt!NtRemoveIoCompletion+0x13d
ffffef86`3fe06a90 00007ff8`c708cd34 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000bb`cffff858 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`c708cd34
SYMBOL_NAME: nt!RtlpHeapHandleError+40
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.867
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 40
FAILURE_BUCKET_ID: 0x13a_11_NpFR_nt!RtlpHeapHandleError
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {fb64e459-d0f8-9b93-8910-770f3e5ecf0d}
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8003895a266, Address of the instruction which caused the bugcheck
Arg3: ffffc7819a592920, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2656
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 4752
Key : Analysis.Init.CPU.mSec
Value: 593
Key : Analysis.Init.Elapsed.mSec
Value: 25644
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 3b
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff8003895a266
BUGCHECK_P3: ffffc7819a592920
BUGCHECK_P4: 0
CONTEXT: ffffc7819a592920 -- (.cxr 0xffffc7819a592920)
rax=ffffa10a44e07be8 rbx=ffffa10a446de080 rcx=a10a44e07bb0b06b
rdx=0000000000000000 rsi=0000000000000000 rdi=ffffa10a44e07be0
rip=fffff8003895a266 rsp=ffffc68d79ef4940 rbp=ffffc68d79ef4a01
r8=0000000000000000 r9=000000260630757e r10=0000000000000002
r11=fffff780000003b0 r12=0000000000000000 r13=a10a44e07bb0b06b
r14=0000000000000000 r15=ffffa10a446de1c0
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050282
nt!KeAbPreWait+0x6:
fffff800`3895a266 0fb64120 movzx eax,byte ptr [rcx+20h] ds:002b:a10a44e0`7bb0b08b=??
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: Discord.exe
STACK_TEXT:
ffffc68d`79ef4940 fffff800`38a34951 : 00000000`0000008b fffff800`38c2b3e1 ffffffff`ffffff01 ffffa10a`446de1c0 : nt!KeAbPreWait+0x6
ffffc68d`79ef4970 fffff800`38c2cb01 : ffffa10a`44e07be0 00000000`00000006 00000000`00000001 ffffa10a`00000000 : nt!KeWaitForSingleObject+0x1d0561
ffffc68d`79ef4a60 fffff800`38c2cbaa : ffffa10a`446de080 00000000`00000000 00000000`00000000 00000000`21eff96c : nt!ObWaitForSingleObject+0x91
ffffc68d`79ef4ac0 fffff800`38a075b8 : ffffa10a`446de080 ffffa10a`44974080 ffffc68d`79ef4b18 ffffffff`ffff3cb0 : nt!NtWaitForSingleObject+0x6a
ffffc68d`79ef4b00 00000000`771f1cfc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`1367f218 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x771f1cfc
SYMBOL_NAME: nt!KeAbPreWait+6
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.867
STACK_COMMAND: .cxr 0xffffc7819a592920 ; kb
BUCKET_ID_FUNC_OFFSET: 6
FAILURE_BUCKET_ID: 0x3B_c0000005_nt!KeAbPreWait
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {9ca4a719-6b4f-fb47-f634-e80e5eda3be8}
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff8085e820d560, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff8085e820d4b8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2515
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 6257
Key : Analysis.Init.CPU.mSec
Value: 577
Key : Analysis.Init.Elapsed.mSec
Value: 23311
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffff8085e820d560
BUGCHECK_P3: ffff8085e820d4b8
BUGCHECK_P4: 0
TRAP_FRAME: ffff8085e820d560 -- (.trap 0xffff8085e820d560)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd181dbecb1a0 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffd181dbecb1a0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80520a35e6f rsp=ffff8085e820d6f0 rbp=000000028c59d294
r8=000000028c59d294 r9=fffff80520600000 r10=fffff8051dba4ac0
r11=ffff8085e820d800 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po cy
nt!KiInsertTimerTable+0x1cf1ef:
fffff805`20a35e6f cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffff8085e820d4b8 -- (.exr 0xffff8085e820d4b8)
ExceptionAddress: fffff80520a35e6f (nt!KiInsertTimerTable+0x00000000001cf1ef)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: opera.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffff8085`e820d238 fffff805`20a07a69 : 00000000`00000139 00000000`00000003 ffff8085`e820d560 ffff8085`e820d4b8 : nt!KeBugCheckEx
ffff8085`e820d240 fffff805`20a07e90 : 000de1ba`0000ffff 00000000`000000ff 00000000`ffffffff 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffff8085`e820d380 fffff805`20a06223 : ffffd181`db9a5080 ffff8085`e820d500 00000000`00000000 fffff805`209fc806 : nt!KiFastFailDispatch+0xd0
ffff8085`e820d560 fffff805`20a35e6f : ffff8085`e820d710 ffff8085`e820d708 00000000`0000003f 00000000`0000003f : nt!KiRaiseSecurityCheckFailure+0x323
ffff8085`e820d6f0 fffff805`20864fed : ffffd181`dbecb080 fffff805`3168d272 00000000`00000000 ffffd181`00000000 : nt!KiInsertTimerTable+0x1cf1ef
ffff8085`e820d770 fffff805`208686b3 : ffffd181`00000016 ffffd181`00000000 00000000`00000001 00000000`00000001 : nt!KiCommitThreadWait+0x3bd
ffff8085`e820d810 fffff805`208680e8 : ffffd181`dbe18a00 00000000`00000001 ffffd181`de8161f0 fffff805`00000002 : nt!KeRemoveQueueEx+0x263
ffff8085`e820d8b0 fffff805`20cb7e9d : 00000000`00000000 00000000`00000000 fffff805`1dba1180 fffff805`2084a31a : nt!IoRemoveIoCompletion+0x98
ffff8085`e820d9e0 fffff805`20a074b8 : ffffd181`dbecb080 00000044`6a25f358 ffff8085`e820daa8 00000237`84172620 : nt!NtRemoveIoCompletion+0x13d
ffff8085`e820da90 00007fff`a92ec744 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000044`6a25f338 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`a92ec744
SYMBOL_NAME: nt!KiInsertTimerTable+1cf1ef
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.804
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1cf1ef
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiInsertTimerTable
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {f89e8bcc-9d62-a3aa-7602-6fa1ac774850}
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffff983c3efb810, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffff983c3efb768, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2609
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 11020
Key : Analysis.Init.CPU.mSec
Value: 593
Key : Analysis.Init.Elapsed.mSec
Value: 21186
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: fffff983c3efb810
BUGCHECK_P3: fffff983c3efb768
BUGCHECK_P4: 0
TRAP_FRAME: fffff983c3efb810 -- (.trap 0xfffff983c3efb810)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd489e0080158 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffc20041f47d80 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800038127b0 rsp=fffff983c3efb9a0 rbp=fffff80001509180
r8=0000000000000000 r9=0000000000000000 r10=0000fffff8000300
r11=ffffa2000a10a8c0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!KiTryUnwaitThread+0x1c6460:
fffff800`038127b0 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: fffff983c3efb768 -- (.exr 0xfffff983c3efb768)
ExceptionAddress: fffff800038127b0 (nt!KiTryUnwaitThread+0x00000000001c6460)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: Discord.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
fffff983`c3efb4e8 fffff800`03807a69 : 00000000`00000139 00000000`00000003 fffff983`c3efb810 fffff983`c3efb768 : nt!KeBugCheckEx
fffff983`c3efb4f0 fffff800`03807e90 : 00000000`00000000 00000000`00000005 00000000`00000002 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff983`c3efb630 fffff800`03806223 : 00000000`c3000001 00000001`00000000 ffffd489`dfb19080 00000000`00000000 : nt!KiFastFailDispatch+0xd0
fffff983`c3efb810 fffff800`038127b0 : 00000000`0000a292 fffff800`03a2b3c1 00000000`00000000 fffff983`00000000 : nt!KiRaiseSecurityCheckFailure+0x323
fffff983`c3efb9a0 fffff800`0364a388 : ffffd489`dac0c5e0 00000000`00000000 fffff800`01509180 00000000`00000000 : nt!KiTryUnwaitThread+0x1c6460
fffff983`c3efba00 fffff800`039fb17d : 00000000`00000000 fffff983`c3efbb80 00000000`1aa7e798 ffffd489`e00801c0 : nt!KeSetEvent+0x158
fffff983`c3efba90 fffff800`038074b8 : ffffd489`de78a080 ffffd489`e29e2560 fffff983`00000000 ffffd489`00000000 : nt!NtSetEvent+0xbd
fffff983`c3efbb00 00000000`77e41cfc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`1aa7f088 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77e41cfc
SYMBOL_NAME: nt!KiFastFailDispatch+d0
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.804
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {3aede96a-54dd-40d6-d4cb-2a161a843851}
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffdf0f108dd560, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffdf0f108dd4b8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2531
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 7420
Key : Analysis.Init.CPU.mSec
Value: 484
Key : Analysis.Init.Elapsed.mSec
Value: 19118
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffffdf0f108dd560
BUGCHECK_P3: ffffdf0f108dd4b8
BUGCHECK_P4: 0
TRAP_FRAME: ffffdf0f108dd560 -- (.trap 0xffffdf0f108dd560)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffbe864319b1a0 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffbe864319b1a0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80571e35e6f rsp=ffffdf0f108dd6f0 rbp=0000000375f56a41
r8=0000000375f56a41 r9=fffff80571a00000 r10=fffff8056f9d8ac0
r11=ffffdf0f108dd800 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac pe cy
nt!KiInsertTimerTable+0x1cf1ef:
fffff805`71e35e6f cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffdf0f108dd4b8 -- (.exr 0xffffdf0f108dd4b8)
ExceptionAddress: fffff80571e35e6f (nt!KiInsertTimerTable+0x00000000001cf1ef)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: opera.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffffdf0f`108dd238 fffff805`71e07a69 : 00000000`00000139 00000000`00000003 ffffdf0f`108dd560 ffffdf0f`108dd4b8 : nt!KeBugCheckEx
ffffdf0f`108dd240 fffff805`71e07e90 : 00000000`0000003f 00000000`0000003f 00000000`00000008 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffdf0f`108dd380 fffff805`71e06223 : ffffbe86`3fd41080 ffffdf0f`108dd500 00000000`00000000 fffff805`71dfc806 : nt!KiFastFailDispatch+0xd0
ffffdf0f`108dd560 fffff805`71e35e6f : ffffdf0f`108dd710 ffffdf0f`108dd708 00000000`0000003f 00000000`0000003f : nt!KiRaiseSecurityCheckFailure+0x323
ffffdf0f`108dd6f0 fffff805`71c64fed : ffffbe86`4319b080 fffff805`8252d272 00000000`00000000 ffffbe86`00000000 : nt!KiInsertTimerTable+0x1cf1ef
ffffdf0f`108dd770 fffff805`71c686b3 : ffffbe86`0000007d ffffbe86`00000000 00000000`00000001 00000000`00000001 : nt!KiCommitThreadWait+0x3bd
ffffdf0f`108dd810 fffff805`71c680e8 : ffffbe86`40e7fec0 00000000`00000001 ffffbe86`444dea30 fffff805`00000002 : nt!KeRemoveQueueEx+0x263
ffffdf0f`108dd8b0 fffff805`720b7e9d : 00000000`00000000 00000000`00000000 ffff9480`639ea180 fffff805`71c4a31a : nt!IoRemoveIoCompletion+0x98
ffffdf0f`108dd9e0 fffff805`71e074b8 : ffffbe86`4319b080 000000da`9c9ff618 ffffdf0f`108ddaa8 00000239`4730a960 : nt!NtRemoveIoCompletion+0x13d
ffffdf0f`108dda90 00007ffa`ab46c744 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000da`9c9ff5f8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`ab46c744
SYMBOL_NAME: nt!KiInsertTimerTable+1cf1ef
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.804
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1cf1ef
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiInsertTimerTable
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {f89e8bcc-9d62-a3aa-7602-6fa1ac774850}
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8075ab55a25, Address of the instruction which caused the bugcheck
Arg3: fffff8075e6c4920, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3343
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 17879
Key : Analysis.Init.CPU.mSec
Value: 562
Key : Analysis.Init.Elapsed.mSec
Value: 16545
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 3b
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff8075ab55a25
BUGCHECK_P3: fffff8075e6c4920
BUGCHECK_P4: 0
CONTEXT: fffff8075e6c4920 -- (.cxr 0xfffff8075e6c4920)
rax=ffffc1839dd05378 rbx=ffffc1839dd52080 rcx=ffffc183983f8080
rdx=c1838fe59eb05e65 rsi=ffffc1839dd52378 rdi=ffffc1839dd52080
rip=fffff8075ab55a25 rsp=ffffd30ef7e676d0 rbp=ffffc183983f8080
r8=0000000000000001 r9=0000000000000000 r10=0000fffff8075ab6
r11=ffff87f934c00000 r12=0000000000000002 r13=0000000000000001
r14=ffffc183983f8080 r15=0000000000000001
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0000 ds=002b es=002b fs=0053 gs=002b efl=00050286
nt!KeTerminateThread+0x9d:
fffff807`5ab55a25 48397208 cmp qword ptr [rdx+8],rsi ds:002b:c1838fe5`9eb05e6d=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
STACK_TEXT:
ffffd30e`f7e676d0 fffff807`5af069a9 : ffffc183`9dd524b8 00000000`00000000 ffffd30e`f7e67920 00000000`00000000 : nt!KeTerminateThread+0x9d
ffffd30e`f7e67760 fffff807`5aed2868 : 00000000`40010004 00000000`00000000 00000000`00004438 00000000`421aa000 : nt!PspExitThread+0x489
ffffd30e`f7e67860 fffff807`5aa67fb7 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSchedulerApcTerminate+0x38
ffffd30e`f7e678a0 fffff807`5abfa020 : 00000000`00000002 ffffd30e`f7e67950 00000000`00000000 00000000`00000000 : nt!KiDeliverApc+0x487
ffffd30e`f7e67950 fffff807`5ac0755f : 00000000`4debf310 ffffc183`9dd52080 00000000`4debf328 ffffd30e`f7e67aa8 : nt!KiInitiateUserApc+0x70
ffffd30e`f7e67a90 00000000`77281cfc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExit+0x9f
00000000`4debf308 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77281cfc
SYMBOL_NAME: nt!KeTerminateThread+9d
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.804
STACK_COMMAND: .cxr 0xfffff8075e6c4920 ; kb
BUCKET_ID_FUNC_OFFSET: 9d
FAILURE_BUCKET_ID: 0x3B_c0000005_nt!KeTerminateThread
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {fda1cdc8-9131-aeee-19ba-1ee82538d84d}
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffffc987bf0a98f8, Virtual address for the attempted execute.
Arg2: 81000001d7ea3963, PTE contents.
Arg3: ffffdc8f18aca5e0, (reserved)
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2937
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 12863
Key : Analysis.Init.CPU.mSec
Value: 593
Key : Analysis.Init.Elapsed.mSec
Value: 14105
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: fc
BUGCHECK_P1: ffffc987bf0a98f8
BUGCHECK_P2: 81000001d7ea3963
BUGCHECK_P3: ffffdc8f18aca5e0
BUGCHECK_P4: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: opera.exe
TRAP_FRAME: ffffdc8f18aca5e0 -- (.trap 0xffffdc8f18aca5e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffde098f607138 rbx=0000000000000000 rcx=0000000000000000
rdx=0000000000000019 rsi=0000000000000000 rdi=0000000000000000
rip=ffffc987bf0a98f8 rsp=ffffdc8f18aca770 rbp=ffff870075140180
r8=0000000100000143 r9=ffff870075140180 r10=ffffde098a666340
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
ffffc987`bf0a98f8 28990abf87c9 sub byte ptr [rcx-367840F6h],bl ds:ffffffff`c987bf0a=??
Resetting default scope
STACK_TEXT:
ffffdc8f`18aca2f8 fffff806`7b4718f0 : 00000000`000000fc ffffc987`bf0a98f8 81000001`d7ea3963 ffffdc8f`18aca5e0 : nt!KeBugCheckEx
ffffdc8f`18aca300 fffff806`7b22aed6 : ffffc987`bf0a98f8 ffffdc8f`18aca500 ffffdc8f`00000000 ffff8000`00000000 : nt!MiCheckSystemNxFault+0x159368
ffffdc8f`18aca340 fffff806`7b20c960 : 00000000`00000000 00000000`00000011 ffffdc8f`18aca660 00000000`00000000 : nt!MiSystemFault+0x6c6
ffffdc8f`18aca440 fffff806`7b403c5e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0x400
ffffdc8f`18aca5e0 ffffc987`bf0a98f8 : ffffc987`00000002 fffff806`00000003 00000000`00000000 ffffde09`00000000 : nt!KiPageFault+0x35e
ffffdc8f`18aca770 ffffc987`00000002 : fffff806`00000003 00000000`00000000 ffffde09`00000000 ffffc987`00000000 : 0xffffc987`bf0a98f8
ffffdc8f`18aca778 fffff806`00000003 : 00000000`00000000 ffffde09`00000000 ffffc987`00000000 ffffde09`8f58db00 : 0xffffc987`00000002
ffffdc8f`18aca780 00000000`00000000 : ffffde09`00000000 ffffc987`00000000 ffffde09`8f58db00 ffff8700`00000000 : 0xfffff806`00000003
SYMBOL_NAME: nt!MiCheckSystemNxFault+159368
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.804
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 159368
FAILURE_BUCKET_ID: 0xFC_nt!MiCheckSystemNxFault
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {a6ae5288-6b71-974a-9b09-23f14d998164}
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffe585c1909560, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffe585c19094b8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2577
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 6325
Key : Analysis.Init.CPU.mSec
Value: 624
Key : Analysis.Init.Elapsed.mSec
Value: 11490
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffffe585c1909560
BUGCHECK_P3: ffffe585c19094b8
BUGCHECK_P4: 0
TRAP_FRAME: ffffe585c1909560 -- (.trap 0xffffe585c1909560)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffd586768451e0 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffd586768451e0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80626435e6f rsp=ffffe585c19096f0 rbp=00000007eeb5b724
r8=00000007eeb5b724 r9=fffff80626000000 r10=fffff80623860ac0
r11=ffffe585c1909800 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po cy
nt!KiInsertTimerTable+0x1cf1ef:
fffff806`26435e6f cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffe585c19094b8 -- (.exr 0xffffe585c19094b8)
ExceptionAddress: fffff80626435e6f (nt!KiInsertTimerTable+0x00000000001cf1ef)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: opera.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffffe585`c1909238 fffff806`26407a69 : 00000000`00000139 00000000`00000003 ffffe585`c1909560 ffffe585`c19094b8 : nt!KeBugCheckEx
ffffe585`c1909240 fffff806`26407e90 : 00000000`0000003f 00000000`0000003f 00000000`00000008 00000000`00000001 : nt!KiBugCheckDispatch+0x69
ffffe585`c1909380 fffff806`26406223 : ffffd586`76841080 ffffe585`c1909500 00000000`00000000 fffff806`263fc806 : nt!KiFastFailDispatch+0xd0
ffffe585`c1909560 fffff806`26435e6f : 00000000`00000000 00000000`c1909708 00000000`00000000 00000000`0000003f : nt!KiRaiseSecurityCheckFailure+0x323
ffffe585`c19096f0 fffff806`26264fed : ffffd586`768450c0 fffff806`00000000 00000000`00000000 ffffd586`00000000 : nt!KiInsertTimerTable+0x1cf1ef
ffffe585`c1909770 fffff806`262686b3 : ffffd586`000000ad ffffd586`00000000 00000000`00000001 00000000`00000001 : nt!KiCommitThreadWait+0x3bd
ffffe585`c1909810 fffff806`262680e8 : ffffd586`76476b80 00000000`00000001 ffffd586`7acc29e0 fffff806`00000002 : nt!KeRemoveQueueEx+0x263
ffffe585`c19098b0 fffff806`266b7e9d : 00000000`00000000 00000000`00000000 ffffc381`f5742180 fffff806`2624a31a : nt!IoRemoveIoCompletion+0x98
ffffe585`c19099e0 fffff806`264074b8 : ffffd586`768450c0 000000b6`46bff8e8 ffffe585`c1909aa8 0000021a`b4d69fa0 : nt!NtRemoveIoCompletion+0x13d
ffffe585`c1909a90 00007ff9`be56c744 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000b6`46bff8c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`be56c744
SYMBOL_NAME: nt!KiInsertTimerTable+1cf1ef
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.804
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1cf1ef
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiInsertTimerTable
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {f89e8bcc-9d62-a3aa-7602-6fa1ac774850}
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 00000000a297a3f0, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8054de773d0, address which referenced memory
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3015
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 15461
Key : Analysis.Init.CPU.mSec
Value: 561
Key : Analysis.Init.Elapsed.mSec
Value: 32580
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: a
BUGCHECK_P1: a297a3f0
BUGCHECK_P2: ff
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8054de773d0
READ_ADDRESS: fffff8054e8fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
00000000a297a3f0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffffdd0f216374f0 -- (.trap 0xffffdd0f216374f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000a297a3f0 rbx=0000000000000000 rcx=0000000000000000
rdx=00000002f649e8dd rsi=0000000000000000 rdi=0000000000000000
rip=fffff8054de773d0 rsp=ffffdd0f21637680 rbp=0000000000000001
r8=0000000000000001 r9=ffffde8ea4cc6101 r10=0000fffff8054dee
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di pl zr na po nc
nt!KeAcquireSpinLockAtDpcLevel+0x30:
fffff805`4de773d0 f0480fba2b00 lock bts qword ptr [rbx],0 ds:00000000`00000000=????????????????
Resetting default scope
STACK_TEXT:
ffffdd0f`216373a8 fffff805`4e007a69 : 00000000`0000000a 00000000`a297a3f0 00000000`000000ff 00000000`00000000 : nt!KeBugCheckEx
ffffdd0f`216373b0 fffff805`4e003d69 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffdd0f`216374f0 fffff805`4de773d0 : ffff9681`6c940180 fffff805`4de72230 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x469
ffffdd0f`21637680 fffff805`4e161275 : 00000000`00000200 fffffd17`1b07af70 00000002`f649e89e ffffde8e`a4cc6100 : nt!KeAcquireSpinLockAtDpcLevel+0x30
ffffdd0f`216376b0 fffff805`4de70d62 : ffffde8e`a4cc6010 00000000`00000000 ffffde8e`a4cc6010 00000002`f649e89e : nt!PpmIdleUpdateConcurrency+0x35
ffffdd0f`216376f0 fffff805`4de70154 : 00000000`00000000 00001f80`00f3003b 00000000`00000003 00000000`00000002 : nt!PpmIdleExecuteTransition+0xa92
ffffdd0f`21637af0 fffff805`4dff95a4 : ffffffff`00000000 ffff9681`6c94b1c0 ffffde8e`ae16d080 00000000`000006c0 : nt!PoIdle+0x374
ffffdd0f`21637c60 00000000`00000000 : ffffdd0f`21638000 ffffdd0f`21632000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x54
SYMBOL_NAME: nt!KeAcquireSpinLockAtDpcLevel+30
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.804
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 30
FAILURE_BUCKET_ID: AV_nt!KeAcquireSpinLockAtDpcLevel
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {83a2e79c-7ee0-6968-f863-105a1ecf5ef5}
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffc50c32d4b2a0, memory referenced.
Arg2: 0000000000000011, value 0 = read operation, 1 = write operation.
Arg3: ffffc50c32d4b2a0, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3140
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 63751
Key : Analysis.Init.CPU.mSec
Value: 687
Key : Analysis.Init.Elapsed.mSec
Value: 412966
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 50
BUGCHECK_P1: ffffc50c32d4b2a0
BUGCHECK_P2: 11
BUGCHECK_P3: ffffc50c32d4b2a0
BUGCHECK_P4: 2
WRITE_ADDRESS: fffff80282cfa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffc50c32d4b2a0
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: chrome.exe
TRAP_FRAME: ffff9001d49fe5e0 -- (.trap 0xffff9001d49fe5e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffc50c32d131d8 rbx=0000000000000000 rcx=0000000000000000
rdx=000000000000005c rsi=0000000000000000 rdi=0000000000000000
rip=ffffc50c32d4b2a0 rsp=ffff9001d49fe770 rbp=ffffb1809ff40180
r8=00000001000000f0 r9=ffffb1809fbea180 r10=ffffc50c2f9de080
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
ffffc50c`32d4b2a0 a0b2d4320cc5ffffa0 mov al,byte ptr [A0FFFFC50C32D4B2h] ds:a0ffffc5`0c32d4b2=??
Resetting default scope
STACK_TEXT:
ffff9001`d49fe338 fffff802`82435de9 : 00000000`00000050 ffffc50c`32d4b2a0 00000000`00000011 ffff9001`d49fe5e0 : nt!KeBugCheckEx
ffff9001`d49fe340 fffff802`82212d00 : ffff9001`d49fe4a0 00000000`00000011 ffff9001`d49fe660 00000000`00000000 : nt!MiSystemFault+0x1ae0e9
ffff9001`d49fe440 fffff802`823ec01e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0x400
ffff9001`d49fe5e0 ffffc50c`32d4b2a0 : ffffc50c`00000002 00000000`00000005 00000000`00000000 ffffb180`00000000 : nt!KiPageFault+0x35e
ffff9001`d49fe770 ffffc50c`00000002 : 00000000`00000005 00000000`00000000 ffffb180`00000000 ffffc50c`2ee2d000 : 0xffffc50c`32d4b2a0
ffff9001`d49fe778 00000000`00000005 : 00000000`00000000 ffffb180`00000000 ffffc50c`2ee2d000 ffffc50c`307b2248 : 0xffffc50c`00000002
ffff9001`d49fe780 00000000`00000000 : ffffb180`00000000 ffffc50c`2ee2d000 ffffc50c`307b2248 ffffc50c`00000000 : 0x5
SYMBOL_NAME: nt!MiSystemFault+1ae0e9
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.450
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 1ae0e9
FAILURE_BUCKET_ID: AV_INVALID_nt!MiSystemFault
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {8a33c6b1-a9f1-4efe-025b-a861cc33d6e2}
Followup: MachineOwner
---------
3: kd> db ffffc50c32d4b2a0
ffffc50c`32d4b2a0 a0 b2 d4 32 0c c5 ff ff-a0 b2 d4 32 0c c5 ff ff ...2.......2....
ffffc50c`32d4b2b0 50 1d aa 30 0c c5 ff ff-00 00 00 00 00 00 00 00 P..0............
ffffc50c`32d4b2c0 50 31 d1 32 0c c5 ff ff-50 31 d1 32 0c c5 ff ff P1.2....P1.2....
ffffc50c`32d4b2d0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
ffffc50c`32d4b2e0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
ffffc50c`32d4b2f0 01 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
ffffc50c`32d4b300 00 00 00 00 00 00 00 00-ff ff ff ff ff ff ff ff ................
ffffc50c`32d4b310 00 ff 19 02 46 69 6c 65-ff ff ff ff ff ff ff ff ....File........
3: kd> !address ffffc50c32d4b2a0
Mapping user range ...
ERROR: !address: extension exception 0x80004005.
"ExtRemoteTyped::Set from type and offset"
3: kd> u ffffc50c32d4b2a0
ffffc50c`32d4b2a0 a0b2d4320cc5ffffa0 mov al,byte ptr [A0FFFFC50C32D4B2h]
ffffc50c`32d4b2a9 b2d4 mov dl,0D4h
ffffc50c`32d4b2ab 320cc5ffff501d xor cl,byte ptr [rax*8+1D50FFFFh]
ffffc50c`32d4b2b2 aa stos byte ptr [rdi]
ffffc50c`32d4b2b3 300cc5ffff0000 xor byte ptr [rax*8+0FFFFh],cl
ffffc50c`32d4b2ba 0000 add byte ptr [rax],al
ffffc50c`32d4b2bc 0000 add byte ptr [rax],al
ffffc50c`32d4b2be 0000 add byte ptr [rax],al
3: kd> r
rax=0000000000000000 rbx=ffffc50c32d4b2a0 rcx=0000000000000050
rdx=ffffc50c32d4b2a0 rsi=0000000000000000 rdi=ffff9001d49fe500
rip=fffff802823ddf40 rsp=ffff9001d49fe338 rbp=ffffc50c2ee2d080
r8=0000000000000011 r9=ffff9001d49fe5e0 r10=0000000000000000
r11=ffff9001d49fe5e0 r12=0000000000000000 r13=ffff800000000000
r14=ffffc50c32d4b2a0 r15=0000000000001000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00040246
nt!KeBugCheckEx:
fffff802`823ddf40 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffff9001`d49fe340=0000000000000050
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 0000000000000018, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000008, value 0 = read operation, 1 = write operation
Arg4: 0000000000000018, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2827
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 12097
Key : Analysis.Init.CPU.mSec
Value: 624
Key : Analysis.Init.Elapsed.mSec
Value: 504924
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: d1
BUGCHECK_P1: 18
BUGCHECK_P2: 2
BUGCHECK_P3: 8
BUGCHECK_P4: 18
READ_ADDRESS: fffff80378afa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000018
PROCESS_NAME: chrome.exe
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
TRAP_FRAME: ffffb78f78ab5500 -- (.trap 0xffffb78f78ab5500)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=ffffd58160140180
rdx=fffff80377e00000 rsi=0000000000000000 rdi=0000000000000000
rip=0000000000000018 rsp=ffffb78f78ab5690 rbp=0000000000000000
r8=ffffb78f78ab56c0 r9=ffffd58160140180 r10=000000000000003f
r11=ffffb78f78ab55d0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
00000000`00000018 ?? ???
Resetting default scope
FAILED_INSTRUCTION_ADDRESS:
+0
00000000`00000018 ?? ???
STACK_TEXT:
ffffb78f`78ab53b8 fffff803`781efe29 : 00000000`0000000a 00000000`00000018 00000000`00000002 00000000`00000008 : nt!KeBugCheckEx
ffffb78f`78ab53c0 fffff803`781ec129 : ffffd581`6014e000 ffffa70c`fd8c2080 00000000`00000000 00000000`00000090 : nt!KiBugCheckDispatch+0x69
ffffb78f`78ab5500 00000000`00000018 : 00000000`00000003 ffffb78f`78ab56c8 ffffb78f`78ab56c0 ffffd581`60140180 : nt!KiPageFault+0x469
ffffb78f`78ab5690 00000000`00000003 : ffffb78f`78ab56c8 ffffb78f`78ab56c0 ffffd581`60140180 ffffd581`60140180 : 0x18
ffffb78f`78ab5698 ffffb78f`78ab56c8 : ffffb78f`78ab56c0 ffffd581`60140180 ffffd581`60140180 fffff803`7820ce76 : 0x3
ffffb78f`78ab56a0 ffffb78f`78ab56c0 : ffffd581`60140180 ffffd581`60140180 fffff803`7820ce76 ffffd581`00000000 : 0xffffb78f`78ab56c8
ffffb78f`78ab56a8 ffffd581`60140180 : ffffd581`60140180 fffff803`7820ce76 ffffd581`00000000 00000000`00000000 : 0xffffb78f`78ab56c0
ffffb78f`78ab56b0 ffffd581`60140180 : fffff803`7820ce76 ffffd581`00000000 00000000`00000000 ffffa70c`fe010100 : 0xffffd581`60140180
ffffb78f`78ab56b8 fffff803`7820ce76 : ffffd581`00000000 00000000`00000000 ffffa70c`fe010100 fffff803`00000000 : 0xffffd581`60140180
ffffb78f`78ab56c0 fffff803`780272cf : ffffe582`00000002 fffff803`00000004 00000000`00000000 ffffa70d`00000000 : nt!KiSwapThread+0x1e55d6
ffffb78f`78ab5770 fffff803`7802ac03 : ffffa70d`00000000 ffffa70d`00000000 00000000`00000000 00000000`00000001 : nt!KiCommitThreadWait+0x14f
ffffb78f`78ab5810 fffff803`7802a638 : ffffa70d`0b214240 00000000`00000001 ffffa70d`15f72600 fffff803`00000000 : nt!KeRemoveQueueEx+0x263
ffffb78f`78ab58b0 fffff803`784dd26d : 00000000`00000000 00000000`00000000 ffffd581`60140180 fffff803`7803e2aa : nt!IoRemoveIoCompletion+0x98
ffffb78f`78ab59e0 fffff803`781ef878 : ffffa70d`0ce24080 000000b8`0cfff758 ffffb78f`78ab5aa8 000001f4`cd5518e0 : nt!NtRemoveIoCompletion+0x13d
ffffb78f`78ab5a90 00007fff`365abee4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000b8`0cfff738 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007fff`365abee4
SYMBOL_NAME: nt!KiPageFault+469
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.450
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 469
FAILURE_BUCKET_ID: AV_CODE_AV_NULL_IP_nt!KiPageFault
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {4ce35ff9-c5cf-d66d-0323-0f05e33f6692}
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffd28282668660, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffd282826685b8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3014
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 6813
Key : Analysis.Init.CPU.mSec
Value: 468
Key : Analysis.Init.Elapsed.mSec
Value: 83598
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffffd28282668660
BUGCHECK_P3: ffffd282826685b8
BUGCHECK_P4: 0
TRAP_FRAME: ffffd28282668660 -- (.trap 0xffffd28282668660)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff990a1d50d6c0 rbx=0000000000000000 rcx=0000000000000003
rdx=ffff840170740180 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8045722c457 rsp=ffffd282826687f0 rbp=ffffd28282668b80
r8=0000000000000001 r9=0000000000000000 r10=00000000ffffffff
r11=0000000000000025 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po cy
nt!IopCompleteRequest+0x1e2c97:
fffff804`5722c457 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffd282826685b8 -- (.exr 0xffffd282826685b8)
ExceptionAddress: fffff8045722c457 (nt!IopCompleteRequest+0x00000000001e2c97)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: chrome.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
IRP_ADDRESS: ffff990a1c18fb88
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffffd282`82668338 fffff804`57207a69 : 00000000`00000139 00000000`00000003 ffffd282`82668660 ffffd282`826685b8 : nt!KeBugCheckEx
ffffd282`82668340 fffff804`57207e90 : ffffd282`82668571 fffff804`570501c1 ffff990a`0c010340 ffff990a`0c0141c0 : nt!KiBugCheckDispatch+0x69
ffffd282`82668480 fffff804`57206223 : 00000000`00000000 ffff8401`7074b1c0 ffff990a`1c355080 01800080`70740180 : nt!KiFastFailDispatch+0xd0
ffffd282`82668660 fffff804`5722c457 : 00000000`00000001 ffffd282`82668b80 ffff990a`1c355080 fffff804`570686b3 : nt!KiRaiseSecurityCheckFailure+0x323
ffffd282`826687f0 fffff804`570683e3 : ffff990a`1c18fc00 00000000`00000001 ffff990a`1c18fc80 ffff990a`1d50d6a0 : nt!IopCompleteRequest+0x1e2c97
ffffd282`826688b0 fffff804`574b7e9d : 00000000`00000000 00000000`00000000 ffff8401`703ea180 fffff804`5704a31a : nt!IoRemoveIoCompletion+0x393
ffffd282`826689e0 fffff804`572074b8 : ffff990a`1c355080 000000e1`afdff4f8 ffffd282`82668aa8 000002b2`a1491de0 : nt!NtRemoveIoCompletion+0x13d
ffffd282`82668a90 00007ffa`2106c744 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000e1`afdff4d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`2106c744
SYMBOL_NAME: nt!KiFastFailDispatch+d0
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.804
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {3aede96a-54dd-40d6-d4cb-2a161a843851}
Followup: MachineOwner
---------
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 000000005fbf4930, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8034de773d0, address which referenced memory
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2655
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 10883
Key : Analysis.Init.CPU.mSec
Value: 390
Key : Analysis.Init.Elapsed.mSec
Value: 86210
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: a
BUGCHECK_P1: 5fbf4930
BUGCHECK_P2: ff
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8034de773d0
READ_ADDRESS: fffff8034e8fb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
000000005fbf4930
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffffcb8e2c2374f0 -- (.trap 0xffffcb8e2c2374f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000005fbf4930 rbx=0000000000000000 rcx=0000000000000000
rdx=0000003f943160d6 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8034de773d0 rsp=ffffcb8e2c237680 rbp=0000000000000001
r8=0000000000000001 r9=ffffe00961be2101 r10=0000fffff8034dee
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di pl zr na po nc
nt!KeAcquireSpinLockAtDpcLevel+0x30:
fffff803`4de773d0 f0480fba2b00 lock bts qword ptr [rbx],0 ds:00000000`00000000=????????????????
Resetting default scope
STACK_TEXT:
ffffcb8e`2c2373a8 fffff803`4e007a69 : 00000000`0000000a 00000000`5fbf4930 00000000`000000ff 00000000`00000000 : nt!KeBugCheckEx
ffffcb8e`2c2373b0 fffff803`4e003d69 : 00000000`00140001 00000000`0000003f 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffcb8e`2c2374f0 fffff803`4de773d0 : ffffcd00`62140180 fffff803`4de72230 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x469
ffffcb8e`2c237680 fffff803`4e161275 : 00000000`00000200 ffffb04e`64ca8931 0000003f`943160a2 ffffe009`61be2100 : nt!KeAcquireSpinLockAtDpcLevel+0x30
ffffcb8e`2c2376b0 fffff803`4de70d62 : ffffe009`61be2010 00000000`00000000 ffffe009`61be2010 0000003f`943160a2 : nt!PpmIdleUpdateConcurrency+0x35
ffffcb8e`2c2376f0 fffff803`4de70154 : 00000000`00000000 00001fa0`00f3003b 00000000`00000003 00000000`00000002 : nt!PpmIdleExecuteTransition+0xa92
ffffcb8e`2c237af0 fffff803`4dff95a4 : ffffffff`00000000 ffffcd00`6214b1c0 ffffe009`6f2055c0 00000000`00000438 : nt!PoIdle+0x374
ffffcb8e`2c237c60 00000000`00000000 : ffffcb8e`2c238000 ffffcb8e`2c232000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x54
SYMBOL_NAME: nt!KeAcquireSpinLockAtDpcLevel+30
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.804
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 30
FAILURE_BUCKET_ID: AV_nt!KeAcquireSpinLockAtDpcLevel
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {83a2e79c-7ee0-6968-f863-105a1ecf5ef5}
Followup: MachineOwner
---------
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff80748e645d1, Address of the instruction which caused the bugcheck
Arg3: ffffda80f4fff920, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2577
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 4660
Key : Analysis.Init.CPU.mSec
Value: 499
Key : Analysis.Init.Elapsed.mSec
Value: 89176
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 3b
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff80748e645d1
BUGCHECK_P3: ffffda80f4fff920
BUGCHECK_P4: 0
CONTEXT: ffffda80f4fff920 -- (.cxr 0xffffda80f4fff920)
rax=ffffb50cfa4d79e8 rbx=ffffb50cf9bdd080 rcx=ffffb50c05040001
rdx=0000000000000000 rsi=0000000000000000 rdi=ffffb50cfa4d79e0
rip=fffff80748e645d1 rsp=ffffea815f230110 rbp=ffffea815f2301a1
r8=0000000000000000 r9=00000000e9fe5849 r10=0000000000000002
r11=fffff780000003b0 r12=0000000000000000 r13=ffffda80f4bea180
r14=0000000000000000 r15=ffffb50cf9bdd1c0
iopl=0 nv up ei ng nz na pe cy
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050283
nt!KeWaitForSingleObject+0x1e1:
fffff807`48e645d1 483901 cmp qword ptr [rcx],rax ds:002b:ffffb50c`05040001=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: Spotify.exe
STACK_TEXT:
ffffea81`5f230110 fffff807`48e43efb : ffffb50c`fa4d79e0 00001f80`00000006 00000000`00000001 ffffda80`f4e80100 : nt!KeWaitForSingleObject+0x1e1
ffffea81`5f230200 fffff807`491f7aa0 : ffffea81`5f2305c0 00000000`00000001 00000000`00000000 00000000`00000000 : nt!KeWaitForMultipleObjects+0x45b
ffffea81`5f230310 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!ObWaitForMultipleObjects+0x2f0
SYMBOL_NAME: nt!KeWaitForSingleObject+1e1
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.804
STACK_COMMAND: .cxr 0xffffda80f4fff920 ; kb
BUCKET_ID_FUNC_OFFSET: 1e1
FAILURE_BUCKET_ID: 0x3B_c0000005_nt!KeWaitForSingleObject
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {5b409308-384c-7d02-5716-ce0af54fd5df}
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffc48d1c4a04d0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffc48d1c4a0428, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3890
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 141349
Key : Analysis.Init.CPU.mSec
Value: 514
Key : Analysis.Init.Elapsed.mSec
Value: 91445
Key : Analysis.Memory.CommitPeak.Mb
Value: 79
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffffc48d1c4a04d0
BUGCHECK_P3: ffffc48d1c4a0428
BUGCHECK_P4: 0
TRAP_FRAME: ffffc48d1c4a04d0 -- (.trap 0xffffc48d1c4a04d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffc48d1c4a0960 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80172c43edf rsp=ffffc48d1c4a0660 rbp=ffffc48d1c4a0729
r8=0000000000000000 r9=0000000000000000 r10=ffffc5812e896180
r11=ffffc48d1c4a0900 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe nc
nt!KeWaitForMultipleObjects+0x43f:
fffff801`72c43edf cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffc48d1c4a0428 -- (.exr 0xffffc48d1c4a0428)
ExceptionAddress: fffff80172c43edf (nt!KeWaitForMultipleObjects+0x000000000000043f)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffffc48d`1c4a01a8 fffff801`72e07a69 : 00000000`00000139 00000000`00000003 ffffc48d`1c4a04d0 ffffc48d`1c4a0428 : nt!KeBugCheckEx
ffffc48d`1c4a01b0 fffff801`72e07e90 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffc48d`1c4a02f0 fffff801`72e06223 : ffffc581`2e740100 ffffc581`2e74b1c0 ffff8e03`e2133080 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffffc48d`1c4a04d0 fffff801`72c43edf : 00000000`00000001 00000000`00000001 00000000`00000000 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x323
ffffc48d`1c4a0660 fffff801`81eceb81 : 00000000`00000200 00000000`00989680 ffff8e03`e77f2460 ffff8e03`e77f2460 : nt!KeWaitForMultipleObjects+0x43f
ffffc48d`1c4a0770 fffff801`81f0909c : ffffc581`00000008 ffff8e03`e77f2460 fffff801`81f09060 ffff8e03`e77f2460 : dxgkrnl!BLTQUEUE::BltQueueWorker+0x2dd
ffffc48d`1c4a0be0 fffff801`72d17e25 : ffff8e03`e2133080 fffff801`81f09060 ffff8e03`e77f2460 00000000`00000001 : dxgkrnl!BLTQUEUE::BltQueueWorkerThread+0x3c
ffffc48d`1c4a0c10 fffff801`72dfd0d8 : ffffc581`2e896180 ffff8e03`e2133080 fffff801`72d17dd0 00000000`00000246 : nt!PspSystemThreadStartup+0x55
ffffc48d`1c4a0c60 00000000`00000000 : ffffc48d`1c4a1000 ffffc48d`1c49b000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: dxgkrnl!BLTQUEUE::BltQueueWorker+2dd
MODULE_NAME: dxgkrnl
IMAGE_NAME: dxgkrnl.sys
IMAGE_VERSION: 10.0.19041.804
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 2dd
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_dxgkrnl!BLTQUEUE::BltQueueWorker
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {c37780bf-65ad-6f36-df59-1976243cb246}
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 00000000000000ff, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8042518a967, address which referenced memory
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3874
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 39925
Key : Analysis.Init.CPU.mSec
Value: 562
Key : Analysis.Init.Elapsed.mSec
Value: 93506
Key : Analysis.Memory.CommitPeak.Mb
Value: 75
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: a
BUGCHECK_P1: 0
BUGCHECK_P2: ff
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8042518a967
READ_ADDRESS: fffff80425afb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000000
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: fffff388bda37480 -- (.trap 0xfffff388bda37480)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff9a0063d40180 rbx=0000000000000000 rcx=0000000000000000
rdx=fffff388bda37698 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8042518a967 rsp=fffff388bda37610 rbp=0000000000000200
r8=fffff388bda37678 r9=0000000000000000 r10=000000000002d19f
r11=ffffd08e391273e8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di pl zr na po nc
nt!HvlGetPpmStatsForProcessor+0x37:
fffff804`2518a967 4d8b04c9 mov r8,qword ptr [r9+rcx*8] ds:00000000`00000000=????????????????
Resetting default scope
STACK_TEXT:
fffff388`bda37338 fffff804`25207a69 : 00000000`0000000a 00000000`00000000 00000000`000000ff 00000000`00000000 : nt!KeBugCheckEx
fffff388`bda37340 fffff804`25203d69 : 00000000`00004d7c 00000000`00000000 0000000d`80ec4391 00000000`00000000 : nt!KiBugCheckDispatch+0x69
fffff388`bda37480 fffff804`2518a967 : fffff388`bda37680 ffffdbbc`eb7241a7 00000000`00000001 ffffd08e`390bf398 : nt!KiPageFault+0x469
fffff388`bda37610 fffff804`2523ab96 : ffffd08e`390e5330 ffff9a00`63d48218 000000e4`1993d9ac ffff9a00`63d48210 : nt!HvlGetPpmStatsForProcessor+0x37
fffff388`bda37640 fffff804`25070e63 : 00000000`00009558 00000000`00000001 00000000`00000000 00000000`00000000 : nt!PpmUpdatePerformanceFeedback+0x1c8d36
fffff388`bda376f0 fffff804`25070154 : 00000000`00000000 00001f80`0013003b 00000000`00000003 00000000`00000002 : nt!PpmIdleExecuteTransition+0xb93
fffff388`bda37af0 fffff804`251f95a4 : ffffffff`00000000 ffff9a00`63d4b1c0 ffffd08e`41a95080 00000000`000007e0 : nt!PoIdle+0x374
fffff388`bda37c60 00000000`00000000 : fffff388`bda38000 fffff388`bda32000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x54
SYMBOL_NAME: nt!HvlGetPpmStatsForProcessor+37
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.804
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 37
FAILURE_BUCKET_ID: AV_nt!HvlGetPpmStatsForProcessor
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {fd5527ca-e73f-b9f5-58be-487b87626f6f}
Followup: MachineOwner
---------
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: ffff898f46269738, Virtual address for the attempted execute.
Arg2: 81000001b1b1a963, PTE contents.
Arg3: ffffd18dcec305e0, (reserved)
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2468
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 4497
Key : Analysis.Init.CPU.mSec
Value: 577
Key : Analysis.Init.Elapsed.mSec
Value: 96509
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: fc
BUGCHECK_P1: ffff898f46269738
BUGCHECK_P2: 81000001b1b1a963
BUGCHECK_P3: ffffd18dcec305e0
BUGCHECK_P4: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: opera.exe
TRAP_FRAME: ffffd18dcec305e0 -- (.trap 0xffffd18dcec305e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffac09e30062d8 rbx=0000000000000000 rcx=0000000000000000
rdx=000000000000009e rsi=0000000000000000 rdi=0000000000000000
rip=ffff898f46269738 rsp=ffffd18dcec30770 rbp=ffffc10111340180
r8=00000001000000b7 r9=ffffc10111340180 r10=ffffac09e09ee080
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
ffff898f`46269738 689726468f push 0FFFFFFFF8F462697h
Resetting default scope
STACK_TEXT:
ffffd18d`cec302f8 fffff801`416718f0 : 00000000`000000fc ffff898f`46269738 81000001`b1b1a963 ffffd18d`cec305e0 : nt!KeBugCheckEx
ffffd18d`cec30300 fffff801`4142aed6 : ffff898f`46269738 ffffd18d`cec30500 00000000`00000000 ffff8000`00000000 : nt!MiCheckSystemNxFault+0x159368
ffffd18d`cec30340 fffff801`4140c960 : ffffd18d`cec30470 00000000`00000011 ffffd18d`cec30660 00000000`00000000 : nt!MiSystemFault+0x6c6
ffffd18d`cec30440 fffff801`41603c5e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0x400
ffffd18d`cec305e0 ffff898f`46269738 : ffff898f`00000002 fffff801`00000005 00000000`00000000 ffffac09`00000000 : nt!KiPageFault+0x35e
ffffd18d`cec30770 ffff898f`00000002 : fffff801`00000005 00000000`00000000 ffffac09`00000000 ffff898f`00000000 : 0xffff898f`46269738
ffffd18d`cec30778 fffff801`00000005 : 00000000`00000000 ffffac09`00000000 ffff898f`00000000 ffffac09`e0b75bc0 : 0xffff898f`00000002
ffffd18d`cec30780 00000000`00000000 : ffffac09`00000000 ffff898f`00000000 ffffac09`e0b75bc0 ffffc101`00000000 : 0xfffff801`00000005
SYMBOL_NAME: nt!MiCheckSystemNxFault+159368
MODULE_NAME: nt
IMAGE_VERSION: 10.0.19041.804
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: ntkrnlmp.exe
BUCKET_ID_FUNC_OFFSET: 159368
FAILURE_BUCKET_ID: 0xFC_nt!MiCheckSystemNxFault
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {a6ae5288-6b71-974a-9b09-23f14d998164}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffffd01dac4c730, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffffd01dac4c688, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2890
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 4811
Key : Analysis.Init.CPU.mSec
Value: 514
Key : Analysis.Init.Elapsed.mSec
Value: 99443
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: fffffd01dac4c730
BUGCHECK_P3: fffffd01dac4c688
BUGCHECK_P4: 0
TRAP_FRAME: fffffd01dac4c730 -- (.trap 0xfffffd01dac4c730)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffffd01dac4ca88 rbx=0000000000000000 rcx=0000000000000003
rdx=fffff80774e074b8 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80774e5ff9c rsp=fffffd01dac4c8c0 rbp=ffffc4012cf40180
r8=fffffd01dac4c9c8 r9=0000000000000001 r10=ffff980bb9070110
r11=00007fffffff0000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po cy
nt!IopQueueIrpToFileObject+0x171f3c:
fffff807`74e5ff9c cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: fffffd01dac4c688 -- (.exr 0xfffffd01dac4c688)
ExceptionAddress: fffff80774e5ff9c (nt!IopQueueIrpToFileObject+0x0000000000171f3c)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: opera.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
fffffd01`dac4c408 fffff807`74e07a69 : 00000000`00000139 00000000`00000003 fffffd01`dac4c730 fffffd01`dac4c688 : nt!KeBugCheckEx
fffffd01`dac4c410 fffff807`74e07e90 : ffffc401`00000000 fffff807`74f193ce ffff980b`c989e080 fffffd01`dac4c500 : nt!KiBugCheckDispatch+0x69
fffffd01`dac4c550 fffff807`74e06223 : 00000000`00000008 ffffc401`2cf40180 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
fffffd01`dac4c730 fffff807`74e5ff9c : 980bc743`5c40b719 00000000`001a019f fffffd01`dac4c8f8 00000175`309368e0 : nt!KiRaiseSecurityCheckFailure+0x323
fffffd01`dac4c8c0 fffff807`74ffd970 : fffffd01`dac4cb80 fffff807`7502b17e ffff980b`d1364b70 00000000`00000000 : nt!IopQueueIrpToFileObject+0x171f3c
fffffd01`dac4c910 fffff807`74fe59b9 : ffff980b`00000000 fffffd01`dac4cb80 00000000`00000000 00000062`871ff7c0 : nt!IopSynchronousServiceTail+0x2a0
fffffd01`dac4c9b0 fffff807`74e074b8 : ffff980b`00000000 00000000`00000000 00000000`00000000 00000175`309368e0 : nt!NtReadFile+0x599
fffffd01`dac4ca90 00007ff8`fa4ec6e4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000062`871ff738 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff8`fa4ec6e4
SYMBOL_NAME: nt!KiFastFailDispatch+d0
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.804
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_nt!KiFastFailDispatch
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {3aede96a-54dd-40d6-d4cb-2a161a843851}
Followup: MachineOwner
---------
KERNEL_MODE_HEAP_CORRUPTION (13a)
The kernel mode heap manager has detected corruption in a heap.
Arguments:
Arg1: 0000000000000012, Type of corruption detected
Arg2: ffff9905ca010100, Address of the heap that reported the corruption
Arg3: ffff9905dd384000, Address at which the corruption was detected
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4499
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 112269
Key : Analysis.Init.CPU.mSec
Value: 686
Key : Analysis.Init.Elapsed.mSec
Value: 209643
Key : Analysis.Memory.CommitPeak.Mb
Value: 84
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 13a
BUGCHECK_P1: 12
BUGCHECK_P2: ffff9905ca010100
BUGCHECK_P3: ffff9905dd384000
BUGCHECK_P4: 0
CORRUPTING_POOL_ADDRESS: fffff80381efb390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffff9905dd384000
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: msedge.exe
STACK_TEXT:
fffff581`8f7a3708 fffff803`8178d1c8 : 00000000`0000013a 00000000`00000012 ffff9905`ca010100 ffff9905`dd384000 : nt!KeBugCheckEx
fffff581`8f7a3710 fffff803`8178d228 : 00000000`00000012 fffff581`8f7a3820 ffff9905`ca010100 00000000`00000000 : nt!RtlpHeapHandleError+0x40
fffff581`8f7a3750 fffff803`8178ce55 : ffff9905`dd384000 ffff9905`ca010280 ffff9905`ca010280 ffff9905`c96f3830 : nt!RtlpHpHeapHandleError+0x58
fffff581`8f7a3780 fffff803`81667dde : ffff9905`dd3e6b20 00000000`00000000 00000000`00000000 00000000`00000000 : nt!RtlpLogHeapFailure+0x45
fffff581`8f7a37b0 fffff803`814c73d4 : ffff9905`00000000 ffff9905`dd3e6a60 00000000`00000000 00000000`00000000 : nt!RtlpHpVsContextFree+0x19f51e
fffff581`8f7a3850 fffff803`81bb1019 : 00000000`000c6060 00000000`00000000 00000000`00000000 01000000`00100000 : nt!ExFreeHeapPool+0x4d4
fffff581`8f7a3930 fffff803`817ff8c8 : 00010268`00000000 00000058`2ebfef70 00000000`00000000 00000000`00000001 : nt!ExFreePool+0x9
fffff581`8f7a3960 fffff803`817ff109 : 00000058`2ebfeee8 00000000`00000000 00000058`2ebfef70 00000058`2ebfef50 : nt!IopCreateFile+0x7a8
fffff581`8f7a3a00 fffff803`81606bb8 : ffff9905`c9b2a080 fffff581`8f7a3b80 00000058`2ebfe4e8 fffff581`8f7a3aa8 : nt!NtCreateFile+0x79
fffff581`8f7a3a90 00007ff9`406ec844 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000058`2ebfee58 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`406ec844
SYMBOL_NAME: nt!ExFreePool+9
IMAGE_NAME: Pool_Corruption
IMAGE_VERSION: 10.0.19041.631
MODULE_NAME: Pool_Corruption
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 9
FAILURE_BUCKET_ID: 0x13a_12_nt!ExFreePool
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {0e8bc89c-9b1f-e697-ed6c-83210db041e2}
Followup: Pool_corruption
---------
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80233643ca4, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2936
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 38572
Key : Analysis.Init.CPU.mSec
Value: 546
Key : Analysis.Init.Elapsed.mSec
Value: 177207
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: a
BUGCHECK_P1: 0
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff80233643ca4
READ_ADDRESS: fffff802340fa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000000
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: audiodg.exe
TRAP_FRAME: ffffd40149a92060 -- (.trap 0xffffd40149a92060)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000020f618 rbx=0000000000000000 rcx=ffffac00ed928180
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80233643ca4 rsp=ffffd40149a921f0 rbp=ffffd40149a922b9
r8=0000000000000000 r9=0000000000000000 r10=ffffac00ed928180
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KeWaitForMultipleObjects+0x204:
fffff802`33643ca4 4b8b1cfb mov rbx,qword ptr [r11+r15*8] ds:00000000`00000000=????????????????
Resetting default scope
STACK_TEXT:
ffffd401`49a91f18 fffff802`33807769 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffd401`49a91f20 fffff802`33803a69 : 00031902`ed92ffff 00000000`ed9331ff ffff9685`ffffffff 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffd401`49a92060 fffff802`33643ca4 : 00000000`00000001 00000000`000000ff ffffd401`49a92200 00000000`00000000 : nt!KiPageFault+0x469
ffffd401`49a921f0 fffff802`339f7740 : 00000000`000000c0 ffffd401`49a92340 ffff9685`3bc68fb0 00000000`00000000 : nt!KeWaitForMultipleObjects+0x204
ffffd401`49a92300 fffff802`339f7419 : 00000000`00000000 00000000`00000774 00000000`00000000 00000000`00000001 : nt!ObWaitForMultipleObjects+0x2f0
ffffd401`49a92800 fffff802`338071b8 : 00000000`00000000 00000000`00000000 ffff9685`34ba2080 fffff802`33ab9c10 : nt!NtWaitForMultipleObjects+0x119
ffffd401`49a92a90 00007ffd`554ecb04 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000052`938ffa18 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`554ecb04
SYMBOL_NAME: nt!KeWaitForMultipleObjects+204
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.746
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 204
FAILURE_BUCKET_ID: AV_nt!KeWaitForMultipleObjects
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {0d335bc1-87c8-f4ad-8a69-d4d9985e727a}
Followup: MachineOwner
---------
MULTIPLE_IRP_COMPLETE_REQUESTS (44)
A driver has requested that an IRP be completed (IoCompleteRequest()), but
the packet has already been completed. This is a tough bug to find because
the easiest case, a driver actually attempted to complete its own packet
twice, is generally not what happened. Rather, two separate drivers each
believe that they own the packet, and each attempts to complete it. The
first actually works, and the second fails. Tracking down which drivers
in the system actually did this is difficult, generally because the trails
of the first driver have been covered by the second. However, the driver
stack for the current request can be found by examining the DeviceObject
fields in each of the stack locations.
Arguments:
Arg1: ffffbb028e1780a0, Address of the IRP
Arg2: 0000000000001232
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3280
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 6612
Key : Analysis.Init.CPU.mSec
Value: 687
Key : Analysis.Init.Elapsed.mSec
Value: 181091
Key : Analysis.Memory.CommitPeak.Mb
Value: 76
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 44
BUGCHECK_P1: ffffbb028e1780a0
BUGCHECK_P2: 1232
BUGCHECK_P3: 0
BUGCHECK_P4: 0
IRP_ADDRESS: ffffbb028e1780a0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: Discord.exe
STACK_TEXT:
ffff9588`c24fb678 fffff800`76c2babc : 00000000`00000044 ffffbb02`8e1780a0 00000000`00001232 00000000`00000000 : nt!KeBugCheckEx
ffff9588`c24fb680 fffff800`76a48727 : ffffbb02`8c6e8080 00000000`00000002 ffffbb02`8c5be9d0 ffffbb02`00000000 : nt!IopfCompleteRequest+0x1e337c
ffff9588`c24fb770 fffff800`82c1d834 : 00000000`00000000 00000000`15f5dd38 ffffbb02`8df64280 ffffbb02`8c6e8080 : nt!IofCompleteRequest+0x17
ffff9588`c24fb7a0 fffff800`76a52f55 : ffffbb02`7d8c5950 ffffbb02`7d8c5950 00000000`00000001 ffffbb02`8df64280 : Npfs!NpFsdWrite+0x94
ffff9588`c24fb810 fffff800`736b4906 : 00000000`00000000 00000000`76aec5ca 00000000`00000000 ffffbb02`8c6e8050 : nt!IofCallDriver+0x55
ffff9588`c24fb850 fffff800`76a52f55 : ffffbb02`8df64280 ffff8581`d9728180 ffffbb02`8c6e8080 fffff800`76a64d7f : FLTMGR!FltpDispatch+0xd6
ffff9588`c24fb8b0 fffff800`76dfd518 : ffffbb02`8df64280 00000000`00000000 ffffbb02`8df64280 00000000`00000000 : nt!IofCallDriver+0x55
ffff9588`c24fb8f0 fffff800`76de448f : ffffe309`00000000 ffff9588`c24fbb80 00000000`145cf1b4 ffff9588`c24fbb80 : nt!IopSynchronousServiceTail+0x1a8
ffff9588`c24fb990 fffff800`76c071b8 : 00000000`00000000 00000000`00000000 00000000`00000001 00000000`0cc24d78 : nt!NtWriteFile+0x66f
ffff9588`c24fba90 00000000`772d1cfc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`144cebd8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x772d1cfc
SYMBOL_NAME: Npfs!NpFsdWrite+94
MODULE_NAME: Npfs
IMAGE_NAME: Npfs.SYS
IMAGE_VERSION: 10.0.19041.1030
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 94
FAILURE_BUCKET_ID: 0x44_Npfs!NpFsdWrite
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {947b2e94-712f-fbfc-7620-19ee913c5b76}
Followup: MachineOwner
---------
2: kd> lmvm Npfs
Browse full module list
start end module name
fffff800`82c10000 fffff800`82c2c000 Npfs # (pdb symbols) C:\ProgramData\Dbg\sym\npfs.pdb\B6BDF22083B39213E8C6DAA6F39837F41\npfs.pdb
Loaded symbol image file: Npfs.SYS
Mapped memory image file: C:\ProgramData\Dbg\sym\Npfs.SYS\9E3E4C731c000\Npfs.SYS
Image path: \SystemRoot\System32\Drivers\Npfs.SYS
Image name: Npfs.SYS
Browse all global symbols functions data
Image was built with /Brepro flag.
Timestamp: 9E3E4C73 (This is a reproducible build file hash, not a timestamp)
CheckSum: 000192F7
ImageSize: 0001C000
File version: 10.0.19041.1030
Product version: 10.0.19041.1030
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0409.04b0
Information from resource tables:
CompanyName: Microsoft Corporation
ProductName: Microsoft® Windows® Operating System
InternalName: npfs.sys
OriginalFilename: npfs.sys
ProductVersion: 10.0.19041.1030
FileVersion: 10.0.19041.1030 (WinBuild.160101.0800)
FileDescription: NPFS Driver
LegalCopyright: © Microsoft Corporation. All rights reserved.
DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000001, The system cumulatively spent an extended period of time at
DISPATCH_LEVEL or above. The offending component can usually be
identified with a stack trace.
Arg2: 0000000000001e00, The watchdog period.
Arg3: fffff803712fa320, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
additional information regarding the cumulative timeout
Arg4: 0000000000000000
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: TickPeriods ***
*** ***
*************************************************************************
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4046
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 37825
Key : Analysis.Init.CPU.mSec
Value: 530
Key : Analysis.Init.Elapsed.mSec
Value: 183214
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 133
BUGCHECK_P1: 1
BUGCHECK_P2: 1e00
BUGCHECK_P3: fffff803712fa320
BUGCHECK_P4: 0
DPC_TIMEOUT_TYPE: DPC_QUEUE_EXECUTION_TIMEOUT_EXCEEDED
TRAP_FRAME: fffff803768af610 -- (.trap 0xfffff803768af610)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000a0490b84 rbx=0000000000000000 rcx=fffff803768af7f0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80370844567 rsp=fffff803768af7a0 rbp=fffff8036e5c7180
r8=0000000000000102 r9=0000000000000000 r10=fffff8036e5caac0
r11=00000010fadf37aa r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!KeYieldProcessorEx+0x17:
fffff803`70844567 4883c420 add rsp,20h
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
STACK_TEXT:
fffff803`768bdc88 fffff803`70a3aa0c : 00000000`00000133 00000000`00000001 00000000`00001e00 fffff803`712fa320 : nt!KeBugCheckEx
fffff803`768bdc90 fffff803`7087541d : 0000184b`f15ab990 fffff803`6e5c7180 00000000`00000246 00000000`00073d35 : nt!KeAccumulateTicks+0x1c880c
fffff803`768bdcf0 fffff803`708759c1 : 00000000`00000000 00000000`00045098 fffff803`6e5c7180 00000000`00000001 : nt!KiUpdateRunTime+0x5d
fffff803`768bdd40 fffff803`7086f833 : fffff803`6e5c7180 00000000`00000000 fffff803`71231650 00000000`00000000 : nt!KiUpdateTime+0x4a1
fffff803`768bde80 fffff803`708781f2 : fffff803`768af610 fffff803`768af690 fffff803`768af600 00000000`00000002 : nt!KeClockInterruptNotify+0x2e3
fffff803`768bdf30 fffff803`70927ef5 : 00000011`427a9086 fffff803`712f39a0 fffff803`712f3a50 ffff4c5f`cfcfacfc : nt!HalpTimerClockInterrupt+0xe2
fffff803`768bdf60 fffff803`709f722a : fffff803`768af690 fffff803`712f39a0 00000000`00000102 00000000`00000000 : nt!KiCallInterruptServiceRoutine+0xa5
fffff803`768bdfb0 fffff803`709f7797 : fffff803`768af630 fffff803`768af628 ffff9408`b5d04080 fffff803`709f77a4 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
fffff803`768af610 fffff803`70844567 : 00000000`00000010 00000000`00000286 fffff803`768af7c8 00000000`00000018 : nt!KiInterruptDispatchNoLockNoEtw+0x37
fffff803`768af7a0 fffff803`7084c620 : 00000000`00000000 00000000`00989680 00000000`00000002 00000000`00000000 : nt!KeYieldProcessorEx+0x17
fffff803`768af7d0 fffff803`708452d6 : ffff9408`b5d04188 00000000`00000000 ffff9408`b5d04250 00000000`00000000 : nt!KiTryUnwaitThread+0x2d0
fffff803`768af830 fffff803`70844e7c : ffff9408`b5d04180 00000000`00000000 fffff803`768afb18 00000000`00000000 : nt!KiTimerWaitTest+0x1e6
fffff803`768af8e0 fffff803`708072e9 : 00000000`00000000 00000000`00000000 00000000`00140001 00000000`00043ecf : nt!KiProcessExpiredTimerList+0xdc
fffff803`768af9d0 fffff803`709f92ee : 00000000`00000000 fffff803`6e5c7180 fffff803`71326600 ffff9408`b2fca080 : nt!KiRetireDpcList+0x9d9
fffff803`768afc60 00000000`00000000 : fffff803`768b0000 fffff803`768aa000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e
SYMBOL_NAME: nt!KeAccumulateTicks+1c880c
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.746
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1c880c
FAILURE_BUCKET_ID: 0x133_ISR_nt!KeAccumulateTicks
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {65350307-c3b9-f4b5-8829-4d27e9ff9b06}
Followup: MachineOwner
---------
0: kd> !pcr
KPCR for Processor 0 at fffff8036e5c7000:
Major 1 Minor 1
NtTib.ExceptionList: fffff803768a5fb0
NtTib.StackBase: fffff803768a4000
NtTib.StackLimit: 0000000016f0ed78
NtTib.SubSystemTib: fffff8036e5c7000
NtTib.Version: 000000006e5c7180
NtTib.UserPointer: fffff8036e5c7870
NtTib.SelfTib: 0000000000809000
SelfPcr: 0000000000000000
Prcb: fffff8036e5c7180
Irql: 0000000000000000
IRR: 0000000000000000
IDR: 0000000000000000
InterruptMode: 0000000000000000
IDT: 0000000000000000
GDT: 0000000000000000
TSS: 0000000000000000
CurrentThread: fffff80371326600
NextThread: 0000000000000000
IdleThread: fffff80371326600
DpcQueue: Unable to read nt!_KDPC_DATA.DpcListHead.Flink @ fffff8036e5ca240
0: kd> dt nt!_KPRCB fffff8036e5c7180 Dpc*
+0x3090 DpcRuntimeHistoryHashTable : (null)
+0x3098 DpcRuntimeHistoryHashTableCleanupDpc : (null)
+0x30c0 DpcData : [2] _KDPC_DATA
+0x3110 DpcStack : 0xfffff803`768b6fb0 Void
+0x311c DpcRequestRate : 0
+0x3124 DpcLastCount : 0x9e3f55
+0x312a DpcRoutineActive : 0 ''
+0x312c DpcRequestSummary : 0n43
+0x312c DpcRequestSlot : [2] 0n43
+0x312c DpcNormalProcessingActive : 0y1
+0x312c DpcNormalProcessingRequested : 0y1
+0x312c DpcNormalThreadSignal : 0y0
+0x312c DpcNormalTimerExpiration : 0y1
+0x312c DpcNormalDpcPresent : 0y0
+0x312c DpcNormalLocalInterrupt : 0y1
+0x312c DpcNormalSpare : 0y0000000000 (0)
+0x312c DpcThreadActive : 0y0
+0x312c DpcThreadRequested : 0y0
+0x312c DpcThreadSpare : 0y00000000000000 (0)
+0x7b80 DpcGate : _KGATE
+0x7be8 DpcWatchdogPeriod : 0n7680
+0x7bec DpcWatchdogCount : 0n7680
+0x7bf4 DpcWatchdogProfileCumulativeDpcThreshold : 0x1b80
+0x7c2c DpcWatchdogSequenceNumber : 0x6ccf7
+0x7e8c DpcTime : 0x1b0e
+0x7e9c DpcTimeCount : 0
+0x7ea0 DpcTimeLimit : 0x500
+0x7f00 DpcWatchdogProfileSingleDpcThreshold : 0x496
+0x8258 DpcWatchdogDpc : _KDPC
+0x8298 DpcWatchdogTimer : _KTIMER
+0x84a8 DpcWatchdogProfile : 0xffff9408`a2035000 -> 0x00000000`0000000d Void
+0x84b0 DpcWatchdogProfileCurrentEmptyCapture : 0xffff9408`a2047c78 -> (null)
DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000001, The system cumulatively spent an extended period of time at
DISPATCH_LEVEL or above. The offending component can usually be
identified with a stack trace.
Arg2: 0000000000001e00, The watchdog period.
Arg3: fffff8064eefa320, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
additional information regarding the cumulative timeout
Arg4: 0000000000000000
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: TickPeriods ***
*** ***
*************************************************************************
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3890
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 10890
Key : Analysis.Init.CPU.mSec
Value: 562
Key : Analysis.Init.Elapsed.mSec
Value: 185419
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 133
BUGCHECK_P1: 1
BUGCHECK_P2: 1e00
BUGCHECK_P3: fffff8064eefa320
BUGCHECK_P4: 0
DPC_TIMEOUT_TYPE: DPC_QUEUE_EXECUTION_TIMEOUT_EXCEEDED
TRAP_FRAME: ffffc58f34837500 -- (.trap 0xffffc58f34837500)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000a7ab8559 rbx=0000000000000000 rcx=ffffc58f34837728
rdx=ffffdb8c0a2df0c0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8064e444567 rsp=ffffc58f34837690 rbp=00000025c1d35b20
r8=ffffc58f348378e8 r9=0000000000000000 r10=0000000000000000
r11=ffffc58f348378c0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!KeYieldProcessorEx+0x17:
fffff806`4e444567 4883c420 add rsp,20h
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
STACK_TEXT:
ffff8b01`4a17fc88 fffff806`4e63aa0c : 00000000`00000133 00000000`00000001 00000000`00001e00 fffff806`4eefa320 : nt!KeBugCheckEx
ffff8b01`4a17fc90 fffff806`4e47541d : 00003f81`058208b5 ffff8b01`4a128180 00000000`00000246 00000000`0012f5e2 : nt!KeAccumulateTicks+0x1c880c
ffff8b01`4a17fcf0 fffff806`4e4759c1 : 00000000`00000000 00000000`000b4d23 ffff8b01`4a128180 00000000`00000001 : nt!KiUpdateRunTime+0x5d
ffff8b01`4a17fd40 fffff806`4e46f833 : ffff8b01`4a128180 00000000`00000000 fffff806`4ee31530 00000000`00000000 : nt!KiUpdateTime+0x4a1
ffff8b01`4a17fe80 fffff806`4e4781f2 : ffffc58f`34837500 ffffc58f`34837580 ffffc58f`34837500 00000000`00000002 : nt!KeClockInterruptNotify+0x2e3
ffff8b01`4a17ff30 fffff806`4e527ef5 : 0000002d`34a5c43e ffffdb8c`00d03200 ffffdb8c`00d032b0 ffffc78c`4a3d79e2 : nt!HalpTimerClockInterrupt+0xe2
ffff8b01`4a17ff60 fffff806`4e5f722a : ffffc58f`34837580 ffffdb8c`00d03200 ffffc58f`34837b10 00000000`00000000 : nt!KiCallInterruptServiceRoutine+0xa5
ffff8b01`4a17ffb0 fffff806`4e5f7797 : ffffc58f`34837560 00000000`00000000 ffffdb8c`0a2df0c0 fffff806`4e5f77a4 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
ffffc58f`34837500 fffff806`4e444567 : 00000000`00000010 00000000`00000282 ffffc58f`348376b8 00000000`00000018 : nt!KiInterruptDispatchNoLockNoEtw+0x37
ffffc58f`34837690 fffff806`4e44b78a : 00000000`00000246 fffff806`4e44a891 00000000`00000000 00000000`00000000 : nt!KeYieldProcessorEx+0x17
ffffc58f`348376c0 fffff806`4e444c4d : 00000000`000b3b5a ffffc58f`34837b10 00000000`00000080 ffff8b01`4a128180 : nt!KiDeferredReadySingleThread+0xc3a
ffffc58f`348378b0 fffff806`4e445030 : ffff8b01`4a128180 00000000`00000000 ffffdb8c`0a48a260 00000000`00000000 : nt!KiReadyThread+0x4d
ffffc58f`348378e0 fffff806`4e406eed : 00000000`00000000 00000000`00000000 00000000`00140001 00000000`000b3b5a : nt!KiProcessExpiredTimerList+0x290
ffffc58f`348379d0 fffff806`4e5f92ee : ffffffff`00000000 ffff8b01`4a128180 ffff8b01`4a1331c0 ffffdb8c`16fde080 : nt!KiRetireDpcList+0x5dd
ffffc58f`34837c60 00000000`00000000 : ffffc58f`34838000 ffffc58f`34832000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e
SYMBOL_NAME: nt!KeAccumulateTicks+1c880c
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.746
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1c880c
FAILURE_BUCKET_ID: 0x133_ISR_nt!KeAccumulateTicks
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {65350307-c3b9-f4b5-8829-4d27e9ff9b06}
Followup: MachineOwner
---------
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind
that the kernel isn't allowed to have/catch (bound trap) or that
is always instant death (double fault). The first number in the
bugcheck params is the number of the trap (8 = double fault, etc)
Consult an Intel x86 family manual to learn more about what these
traps are. Here is a *portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 0000000000000008, EXCEPTION_DOUBLE_FAULT
Arg2: ffffbe8093da0e70
Arg3: ffffe3854bca8f40
Arg4: fffff8033560c58d
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2827
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 7331
Key : Analysis.Init.CPU.mSec
Value: 483
Key : Analysis.Init.Elapsed.mSec
Value: 187848
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 7f
BUGCHECK_P1: 8
BUGCHECK_P2: ffffbe8093da0e70
BUGCHECK_P3: ffffe3854bca8f40
BUGCHECK_P4: fffff8033560c58d
TRAP_FRAME: ffffbe8093da0e70 -- (.trap 0xffffbe8093da0e70)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000000
rdx=ffffe3854bca8000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8033560c58d rsp=ffffe3854bca8f40 rbp=ffffe3854bca9160
r8=ffffe3854bca9200 r9=ffffe3854bca90e0 r10=ffffe3854bca8000
r11=ffffe3854bca90d8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!MmAccessFault+0x2d:
fffff803`3560c58d 4c89642430 mov qword ptr [rsp+30h],r12 ss:0018:ffffe385`4bca8f70=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: opera.exe
STACK_OVERFLOW: Stack Limit: ffffe3854bca9000. Use (kF) and (!stackusage) to investigate stack usage.
STACKUSAGE_FUNCTION: The function at address 0xfffff8033572ab86 was blamed for the stack overflow. It is using 8640 bytes of stack total in 5 instances (likely recursion).
STACK_TEXT:
ffffe385`4bca8f40 fffff803`3580395e : fd37d8da`8d04c865 4141a307`7a78fd2f 2e1c02fc`80b01881 79aa40f5`feef84e0 : nt!MmAccessFault+0x2d
ffffe385`4bca90e0 fffff803`357fe246 : ffffe385`4bca9430 ffffe385`4bca94a0 fffff803`3572be19 ffffe385`4bca94e0 : nt!KiPageFault+0x35e
ffffe385`4bca9278 fffff803`3572be19 : ffffe385`4bca94e0 00000000`00000000 ffffe385`4bca9ca8 555a8e07`000004d0 : nt!_chkstk+0x36
ffffe385`4bca9290 fffff803`3572ab86 : ffffe385`4bca9ca8 ffffe385`4bca99e0 ffffe385`4bca9ca8 fffff803`354b1678 : nt!RtlDispatchException+0x119
ffffe385`4bca94b0 fffff803`358078ac : 00000000`00001000 ffffe385`4bca9d50 ffff8000`00000000 00000000`00000000 : nt!KiDispatchException+0x186
ffffe385`4bca9b70 fffff803`35803a43 : 21c3db22`0c97a711 816df942`b57d72e4 eb205c27`757f7e5a 44395c5a`c3ea0e31 : nt!KiExceptionDispatch+0x12c
ffffe385`4bca9d50 fffff803`3572e028 : f0da9290`24527bc7 812d41a3`ffa0505f 0c2f8c7f`fc808c19 0ab75c0c`42d558c4 : nt!KiPageFault+0x443
ffffe385`4bca9ee0 fffff803`3572da94 : fffff803`35400000 fffff803`00000000 00000000`000000e0 00007fff`fffeffff : nt!RtlpUnwindPrologue+0x248
ffffe385`4bca9f40 fffff803`3572c1af : fffff803`354e38d4 ffffe385`00000000 ffffe385`4bcaaf58 fffff803`354e38d4 : nt!RtlpxVirtualUnwind+0x104
ffffe385`4bca9fc0 fffff803`3572bece : ffffe385`4bcaa580 00000000`00000000 ffffe385`4bcaea90 fffff803`358071b8 : nt!RtlVirtualUnwind+0x5f
ffffe385`4bcaa040 fffff803`3572ab86 : ffffe385`4bcaaf58 ffffe385`4bcaac90 ffffe385`4bcaaf58 fffff803`354b1678 : nt!RtlDispatchException+0x1ce
ffffe385`4bcaa760 fffff803`358078ac : 00000000`00001000 ffffe385`4bcab000 ffff8000`00000000 00000000`00000000 : nt!KiDispatchException+0x186
ffffe385`4bcaae20 fffff803`35803a43 : 00000002`4ee80429 400010a9`25247f75 25248001`4ee80661 40001a81`00000002 : nt!KiExceptionDispatch+0x12c
ffffe385`4bcab000 fffff803`3572e028 : 25246b71`43714f31 4ee80429`00000380 43714f31`0000000a 3ada33c1`50b6a811 : nt!KiPageFault+0x443
ffffe385`4bcab190 fffff803`3572da94 : fffff803`35400000 fffff803`00000000 00000000`000000e0 00007fff`fffeffff : nt!RtlpUnwindPrologue+0x248
ffffe385`4bcab1f0 fffff803`3572c1af : fffff803`354e38d4 ffffe385`00000000 ffffe385`4bcac208 fffff803`354e38d4 : nt!RtlpxVirtualUnwind+0x104
ffffe385`4bcab270 fffff803`3572bece : ffffe385`4bcab830 00000000`00000000 ffffe385`4bcaea90 fffff803`358071b8 : nt!RtlVirtualUnwind+0x5f
ffffe385`4bcab2f0 fffff803`3572ab86 : ffffe385`4bcac208 ffffe385`4bcabf40 ffffe385`4bcac208 fffff803`354b1678 : nt!RtlDispatchException+0x1ce
ffffe385`4bcaba10 fffff803`358078ac : 00000000`00001000 ffffe385`4bcac2b0 ffff8000`00000000 00000000`00000000 : nt!KiDispatchException+0x186
ffffe385`4bcac0d0 fffff803`35803a43 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiExceptionDispatch+0x12c
ffffe385`4bcac2b0 fffff803`3572e028 : 000000f8`00000001 000001d3`d39e8dc0 000001d3`d39e8dc8 000001d3`d39e8dc8 : nt!KiPageFault+0x443
ffffe385`4bcac440 fffff803`3572da94 : fffff803`35400000 fffff803`00000000 00000000`000000e0 00007fff`fffeffff : nt!RtlpUnwindPrologue+0x248
ffffe385`4bcac4a0 fffff803`3572c1af : fffff803`354e38d4 ffffe385`00000000 ffffe385`4bcad4b8 fffff803`354e38d4 : nt!RtlpxVirtualUnwind+0x104
ffffe385`4bcac520 fffff803`3572bece : ffffe385`4bcacae0 00000000`00000000 ffffe385`4bcaea90 fffff803`358071b8 : nt!RtlVirtualUnwind+0x5f
ffffe385`4bcac5a0 fffff803`3572ab86 : ffffe385`4bcad4b8 ffffe385`4bcad1f0 ffffe385`4bcad4b8 00000000`00000000 : nt!RtlDispatchException+0x1ce
ffffe385`4bcaccc0 fffff803`358078ac : 00000000`00000000 00000006`00020410 00000000`00000000 00000000`00000000 : nt!KiDispatchException+0x186
ffffe385`4bcad380 fffff803`35801216 : fffff803`3540f8f8 ffffaa0c`08cf0990 00000000`00000003 fffff803`35656d89 : nt!KiExceptionDispatch+0x12c
ffffe385`4bcad560 fffff803`35703864 : ffffe385`4bcad758 ffffe385`4bcad798 00000000`00000000 ffffe385`4bcad800 : nt!KiBreakpointTrap+0x316
ffffe385`4bcad6f0 fffff803`357cbecb : fffff803`359e57e0 fffff803`354fbc88 00000000`00000000 00000000`00000000 : nt!KeCheckStackAndTargetAddress+0x54
ffffe385`4bcad720 fffff803`357fe642 : fffff803`354fbc88 ffffe385`4bcadd00 fffff803`357cbe90 00000000`00000000 : nt!_C_specific_handler+0x3b
ffffe385`4bcad790 fffff803`3572bf97 : ffffe385`4bcadd00 00000000`00000000 ffffe385`4bcae9b0 fffff803`359e57e0 : nt!RtlpExecuteHandlerForException+0x12
ffffe385`4bcad7c0 fffff803`3572ab86 : ffffe385`4bcae6d8 ffffe385`4bcae410 ffffe385`4bcae6d8 ffffbe80`93d40180 : nt!RtlDispatchException+0x297
ffffe385`4bcadee0 fffff803`358078ac : 00000000`00001000 ffffe385`4bcae780 ffff8000`00000000 00000000`00000000 : nt!KiDispatchException+0x186
ffffe385`4bcae5a0 fffff803`35803a43 : 00000000`00000002 ffffbe80`93c80180 00000000`00000001 fffff803`3564b0b6 : nt!KiExceptionDispatch+0x12c
ffffe385`4bcae780 00000000`00000000 : ffffaa0c`1e0d6080 fffff803`35a2ad3e ffffaa0c`1ebf4080 00000000`00000001 : nt!KiPageFault+0x443
STACK_COMMAND: .trap 0xffffbe8093da0e70 ; kb
SYMBOL_NAME: nt!KiDispatchException+186
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.746
BUCKET_ID_FUNC_OFFSET: 186
FAILURE_BUCKET_ID: 0x7f_8_STACK_USAGE_RECURSION_nt!KiDispatchException
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {cbb9a1ac-821c-b542-365f-2dd5602e6100}
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000000, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff80071436c6d, address which referenced memory
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 5155
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 130846
Key : Analysis.Init.CPU.mSec
Value: 577
Key : Analysis.Init.Elapsed.mSec
Value: 190173
Key : Analysis.Memory.CommitPeak.Mb
Value: 85
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: a
BUGCHECK_P1: 0
BUGCHECK_P2: 2
BUGCHECK_P3: 1
BUGCHECK_P4: fffff80071436c6d
WRITE_ADDRESS: fffff80071efa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000000
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
TRAP_FRAME: ffffec89752376a0 -- (.trap 0xffffec89752376a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000ffff7f rbx=0000000000000000 rcx=0000000000000005
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80071436c6d rsp=ffffec8975237830 rbp=ffffb30536a42250
r8=0000000000000102 r9=0000000000000000 r10=fffff8006e220ac0
r11=0000002d129388f7 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 ov up ei ng nz ac po nc
nt!KiTimerWaitTest+0x19d:
fffff800`71436c6d f02107 lock and dword ptr [rdi],eax ds:00000000`00000000=????????
Resetting default scope
STACK_TEXT:
ffffec89`75237558 fffff800`715efe29 : 00000000`0000000a 00000000`00000000 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
ffffec89`75237560 fffff800`715ec129 : 00000000`00000003 00000000`0012e7a1 ffffda81`baf40180 fffff800`714cca80 : nt!KiBugCheckDispatch+0x69
ffffec89`752376a0 fffff800`71436c6d : ffffb305`36a42188 00000000`00000000 ffffb305`36a42250 00000000`00000000 : nt!KiPageFault+0x469
ffffec89`75237830 fffff800`7143685c : ffffb305`36a42180 00000000`00000000 ffffec89`75237b18 00000000`00000000 : nt!KiTimerWaitTest+0x19d
ffffec89`752378e0 fffff800`7143a189 : 00000000`00000000 00000000`00000000 00000000`00140001 00000000`000b44bc : nt!KiProcessExpiredTimerList+0xdc
ffffec89`752379d0 fffff800`715e1aae : ffffffff`00000000 ffffda81`baf40180 ffffda81`baf4b1c0 ffffb305`385e4080 : nt!KiRetireDpcList+0x9d9
ffffec89`75237c60 00000000`00000000 : ffffec89`75238000 ffffec89`75232000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e
SYMBOL_NAME: nt!KiTimerWaitTest+19d
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.450
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 19d
FAILURE_BUCKET_ID: AV_nt!KiTimerWaitTest
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {8c029a8d-9f29-4bde-2664-6010a6365158}
Followup: MachineOwner
---------
DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000000, A single DPC or ISR exceeded its time allotment. The offending
component can usually be identified with a stack trace.
Arg2: 0000000000000501, The DPC time count (in ticks).
Arg3: 0000000000000500, The DPC time allotment (in ticks).
Arg4: fffff805756fa320, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
additional information regarding this single DPC timeout
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: TickPeriods ***
*** ***
*************************************************************************
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 6593
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 127618
Key : Analysis.Init.CPU.mSec
Value: 734
Key : Analysis.Init.Elapsed.mSec
Value: 193094
Key : Analysis.Memory.CommitPeak.Mb
Value: 87
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 133
BUGCHECK_P1: 0
BUGCHECK_P2: 501
BUGCHECK_P3: 500
BUGCHECK_P4: fffff805756fa320
DPC_TIMEOUT_TYPE: SINGLE_DPC_TIMEOUT_EXCEEDED
TRAP_FRAME: fffff805790ae280 -- (.trap 0xfffff805790ae280)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000044edcb8e rbx=0000000000000000 rcx=fffff805790ae470
rdx=ffffb386673e8958 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80574c333b7 rsp=fffff805790ae410 rbp=ffffcd09005bd050
r8=0000000000000488 r9=0000000000000000 r10=fffff80574d116a0
r11=ffffd2f905a00000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!KeYieldProcessorEx+0x17:
fffff805`74c333b7 4883c420 add rsp,20h
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
STACK_TEXT:
fffff805`790bce18 fffff805`74e595ba : 00000000`00000133 00000000`00000000 00000000`00000501 00000000`00000500 : nt!KeBugCheckEx
fffff805`790bce20 fffff805`74cc98bd : 00001cc1`74f63ecc 00000000`00000000 fffff805`790ae300 fffff805`70f3f180 : nt!KeAccumulateTicks+0x18cb6a
fffff805`790bce80 fffff805`74cc973a : fffff805`756f37c0 fffff805`790ae300 fffff805`000891f2 00000000`00000000 : nt!KeClockInterruptNotify+0xbd
fffff805`790bcf30 fffff805`74c08725 : fffff805`756f37c0 fffff805`790bcf40 00000000`0000000c ffffd4bd`3b8bdc67 : nt!HalpTimerClockIpiRoutine+0x1a
fffff805`790bcf60 fffff805`74ddf9ea : fffff805`790ae300 fffff805`756f37c0 ffffcd09`02953000 00000000`00000000 : nt!KiCallInterruptServiceRoutine+0xa5
fffff805`790bcfb0 fffff805`74ddff57 : 00000000`00000010 fffff805`884e8499 fffff805`790ae4d8 fffff805`74ddff64 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
fffff805`790ae280 fffff805`74c333b7 : ffffffff`ffffffd2 fffff805`74ca7e8e 00000000`00000010 00000000`00000286 : nt!KiInterruptDispatchNoLockNoEtw+0x37
fffff805`790ae410 fffff805`74ca7e8a : 00000000`00000001 fffff805`790ae4c0 ffffcd08`fe04c300 fffff805`8825b347 : nt!KeYieldProcessorEx+0x17
fffff805`790ae440 fffff805`74d11700 : ffffcd08`44edcb8e 00000000`ffffff00 fffff805`790ae4c0 ffffcd08`fe026000 : nt!KxWaitForLockOwnerShip+0x2a
fffff805`790ae470 fffff805`87c26cef : 00000000`00000000 ffffcd08`fe04c3f0 00000000`00000001 fffff805`8825f232 : nt!KeAcquireInStackQueuedSpinLockAtDpcLevel+0x60
fffff805`790ae4a0 fffff805`834a3361 : fffff805`790ae599 00000000`00000000 fffff805`790aeb20 00001cb0`b957dd20 : dxgmms2!VidSchDdiNotifyDpc+0x1df
fffff805`790ae550 fffff805`88209bff : ffffcd08`fc50c030 00000000`00000000 ffffcd08`fc50c030 ffffcd08`fc593000 : dxgkrnl!DxgNotifyDpcCB+0x91
fffff805`790ae600 ffffcd08`fc50c030 : 00000000`00000000 ffffcd08`fc50c030 ffffcd08`fc593000 fffff805`88209b92 : nvlddmkm+0x79bff
fffff805`790ae608 00000000`00000000 : ffffcd08`fc50c030 ffffcd08`fc593000 fffff805`88209b92 ffffcd08`fc593000 : 0xffffcd08`fc50c030
SYMBOL_NAME: dxgmms2!VidSchDdiNotifyDpc+1df
MODULE_NAME: dxgmms2
IMAGE_NAME: dxgmms2.sys
IMAGE_VERSION: 10.0.19041.450
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1df
FAILURE_BUCKET_ID: 0x133_DPC_dxgmms2!VidSchDdiNotifyDpc
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {4e6d2d74-350e-3780-03d1-7dfcf1a310f1}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff8d035e0ae560, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff8d035e0ae4b8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2656
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 21112
Key : Analysis.Init.CPU.mSec
Value: 577
Key : Analysis.Init.Elapsed.mSec
Value: 195477
Key : Analysis.Memory.CommitPeak.Mb
Value: 75
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffff8d035e0ae560
BUGCHECK_P3: ffff8d035e0ae4b8
BUGCHECK_P4: 0
TRAP_FRAME: ffff8d035e0ae560 -- (.trap 0xffff8d035e0ae560)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffc08eebbbb1a0 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffc08eebbbb1a0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8026180d7e7 rsp=ffff8d035e0ae6f0 rbp=000000b19b8b0be5
r8=000000b19b8b0be5 r9=fffff80261400000 r10=fffff8025d4f9ac0
r11=ffff8d035e0ae800 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac pe cy
nt!KiInsertTimerTable+0x1e4617:
fffff802`6180d7e7 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffff8d035e0ae4b8 -- (.exr 0xffff8d035e0ae4b8)
ExceptionAddress: fffff8026180d7e7 (nt!KiInsertTimerTable+0x00000000001e4617)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: opera.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffff8d03`5e0ae238 fffff802`617efe29 : 00000000`00000139 00000000`00000003 ffff8d03`5e0ae560 ffff8d03`5e0ae4b8 : nt!KeBugCheckEx
ffff8d03`5e0ae240 fffff802`617f0250 : 00000000`0000003f 00000000`0000003f 00000000`00000008 ffffc08e`00000000 : nt!KiBugCheckDispatch+0x69
ffff8d03`5e0ae380 fffff802`617ee5e3 : ffffc08e`e3596080 ffff8d03`5e0ae500 00000000`00000000 fffff802`617e4cc6 : nt!KiFastFailDispatch+0xd0
ffff8d03`5e0ae560 fffff802`6180d7e7 : ffff8d03`5e0ae710 ffff8d03`5e0ae708 00000000`0000003f 00000000`0000003f : nt!KiRaiseSecurityCheckFailure+0x323
ffff8d03`5e0ae6f0 fffff802`6162753d : ffffc08e`ebbbb080 fffff802`6fe1d272 00000000`00000000 ffffc08e`00000000 : nt!KiInsertTimerTable+0x1e4617
ffff8d03`5e0ae770 fffff802`6162ac03 : ffffc08e`000000e2 ffffc08e`00000000 00000000`00000001 00000000`00000001 : nt!KiCommitThreadWait+0x3bd
ffff8d03`5e0ae810 fffff802`6162a638 : ffffc08e`e8b3fac0 00000000`00000001 ffffc08e`eb3bb250 fffff802`00000002 : nt!KeRemoveQueueEx+0x263
ffff8d03`5e0ae8b0 fffff802`61add26d : 00000000`00000000 00000000`00000000 ffffe700`30896180 fffff802`6163e2aa : nt!IoRemoveIoCompletion+0x98
ffff8d03`5e0ae9e0 fffff802`617ef878 : ffffc08e`ebbbb080 00000096`20fff788 ffff8d03`5e0aeaa8 000001f5`28cf1150 : nt!NtRemoveIoCompletion+0x13d
ffff8d03`5e0aea90 00007ffd`0810bee4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000096`20fff768 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`0810bee4
SYMBOL_NAME: nt!KiInsertTimerTable+1e4617
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.450
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1e4617
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiInsertTimerTable
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {f89e8bcc-9d62-a3aa-7602-6fa1ac774850}
Followup: MachineOwner
---------
DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000001, The system cumulatively spent an extended period of time at
DISPATCH_LEVEL or above. The offending component can usually be
identified with a stack trace.
Arg2: 0000000000001e00, The watchdog period.
Arg3: fffff807410fa320, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
additional information regarding the cumulative timeout
Arg4: 0000000000000000
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: TickPeriods ***
*** ***
*************************************************************************
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 6093
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 234601
Key : Analysis.Init.CPU.mSec
Value: 515
Key : Analysis.Init.Elapsed.mSec
Value: 197983
Key : Analysis.Memory.CommitPeak.Mb
Value: 83
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 133
BUGCHECK_P1: 1
BUGCHECK_P2: 1e00
BUGCHECK_P3: fffff807410fa320
BUGCHECK_P4: 0
DPC_TIMEOUT_TYPE: DPC_QUEUE_EXECUTION_TIMEOUT_EXCEEDED
TRAP_FRAME: ffffef0c93baa5b0 -- (.trap 0xffffef0c93baa5b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000a34fc5dd rbx=0000000000000000 rcx=ffffef0c93baa7a8
rdx=0000000000000001 rsi=0000000000000000 rdi=0000000000000000
rip=fffff807406333b7 rsp=ffffef0c93baa740 rbp=0000000000000000
r8=0000000000000000 r9=ffffb3802c550180 r10=0000000000000000
r11=fffff80740400000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na po nc
nt!KeYieldProcessorEx+0x17:
fffff807`406333b7 4883c420 add rsp,20h
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: nvcontainer.exe
STACK_TEXT:
ffffb380`2c569e18 fffff807`4085963e : 00000000`00000133 00000000`00000001 00000000`00001e00 fffff807`410fa320 : nt!KeBugCheckEx
ffffb380`2c569e20 fffff807`406c98bd : 00012455`e2af7e6e 00000000`00000000 ffffef0c`93baa600 ffffb380`2c550180 : nt!KeAccumulateTicks+0x18cbee
ffffb380`2c569e80 fffff807`406c973a : ffffdc8c`b5905600 ffffef0c`93baa630 00000000`006b857e 00000000`00000000 : nt!KeClockInterruptNotify+0xbd
ffffb380`2c569f30 fffff807`40608725 : ffffdc8c`b5905600 00000000`00000000 00000000`00000000 ffff21cc`2397026a : nt!HalpTimerClockIpiRoutine+0x1a
ffffb380`2c569f60 fffff807`407df9ea : ffffef0c`93baa630 ffffdc8c`b5905600 00000000`00000001 00000000`00000000 : nt!KiCallInterruptServiceRoutine+0xa5
ffffb380`2c569fb0 fffff807`407dff57 : ffffef0c`93baa7a8 ffffdc8c`be997180 ffffdc8c`b5905600 ffffdc8c`be997180 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
ffffef0c`93baa5b0 fffff807`406333b7 : ffffffff`ffffffd2 fffff807`4062981c 00000000`00000010 00000000`00040286 : nt!KiInterruptDispatchNoLockNoEtw+0x37
ffffef0c`93baa740 fffff807`4062981a : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeYieldProcessorEx+0x17
ffffef0c`93baa770 fffff807`40627f6c : ffffb380`2c340180 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiCancelTimer+0x37a
ffffef0c`93baa820 fffff807`406272cf : ffffdc8c`00000002 00000000`00000003 ffffef0c`93baa9e0 00000000`00000000 : nt!KiSwapThread+0x6cc
ffffef0c`93baa8d0 fffff807`40626b73 : 00000000`00000097 fffff807`00000000 00000000`00000001 ffffdc8c`be9971c0 : nt!KiCommitThreadWait+0x14f
ffffef0c`93baa970 fffff807`409fb6b1 : ffffdc8c`bfc9abe0 00000000`00000006 ffffdc8c`00000001 00000000`00000c00 : nt!KeWaitForSingleObject+0x233
ffffef0c`93baaa60 fffff807`409fb75a : ffffdc8c`be997080 000000c9`d51ff758 00000000`00000000 00000296`2fcea800 : nt!ObWaitForSingleObject+0x91
ffffef0c`93baaac0 fffff807`407ef878 : 00000000`00000000 00000000`00000000 ffffef0c`93baab18 ffffffff`ffb38db0 : nt!NtWaitForSingleObject+0x6a
ffffef0c`93baab00 00007ffa`d162be44 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000c9`d51ff728 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`d162be44
SYMBOL_NAME: nt!KeAccumulateTicks+18cbee
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.450
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 18cbee
FAILURE_BUCKET_ID: 0x133_ISR_nt!KeAccumulateTicks
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {65350307-c3b9-f4b5-8829-4d27e9ff9b06}
Followup: MachineOwner
---------
APC_INDEX_MISMATCH (1)
This is a kernel internal error. The most common reason to see this
bugcheck is when a filesystem or a driver has a mismatched number of
calls to disable and re-enable APCs. The key data item is the
Thread->CombinedApcDisable field. This consists of two separate 16-bit
fields, the SpecialApcDisable and the KernelApcDisable. A negative value
of either indicates that a driver has disabled special or normal APCs
(respectively) without re-enabling them; a positive value indicates that
a driver has enabled special or normal APCs (respectively) too many times.
Arguments:
Arg1: 0000000077791cfc, Address of system call function or worker routine
Arg2: 0000000000000000, Thread->ApcStateIndex
Arg3: 0000000000000001, (Thread->SpecialApcDisable << 16) | Thread->KernelApcDisable
Arg4: ffffad8993d09b80, Call type (0 - system call, 1 - worker routine)
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3218
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 6442
Key : Analysis.Init.CPU.mSec
Value: 452
Key : Analysis.Init.Elapsed.mSec
Value: 8011
Key : Analysis.Memory.CommitPeak.Mb
Value: 72
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 1
BUGCHECK_P1: 77791cfc
BUGCHECK_P2: 0
BUGCHECK_P3: 1
BUGCHECK_P4: ffffad8993d09b80
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: steam.exe
STACK_TEXT:
ffffad89`93d09948 fffff806`44c07769 : 00000000`00000001 00000000`77791cfc 00000000`00000000 00000000`00000001 : nt!KeBugCheckEx
ffffad89`93d09950 fffff806`44c07633 : 00000000`07c3fda0 00000000`77794660 00000000`07e1f7a4 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffad89`93d09a90 00000000`77791cfc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceExitPico+0x1fe
00000000`07c3ed48 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77791cfc
SYMBOL_NAME: nt!KiSystemServiceExitPico+1fe
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.685
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1fe
FAILURE_BUCKET_ID: 0x1_SysCallNum_1b0007_nt!KiSystemServiceExitPico
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {1d25e8fe-40eb-1b84-9166-c3af30bbaf7e}
SYSTEM_THREAD_EXCEPTION_NOT_HANDLED_M (1000007e)
This is a very common bugcheck. Usually the exception address pinpoints
the driver/function that caused the problem. Always note this address
as well as the link date of the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard
coded breakpoint or assertion was hit, but this system was booted
/NODEBUG. This is not supposed to happen as developers should never have
hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the
system is booted /DEBUG. This will let us see why this breakpoint is
happening.
Arguments:
Arg1: ffffffffc0000005, The exception code that was not handled
Arg2: fffff8025e530e36, The address that the exception occurred at
Arg3: fffff909f0775ef8, Exception Record Address
Arg4: fffff909f0775730, Context Record Address
Debugging Details:
------------------
*** WARNING: Unable to verify checksum for win32k.sys
KEY_VALUES_STRING: 1
Key : AV.Dereference
Value: NullClassPtr
Key : AV.Fault
Value: Read
Key : Analysis.CPU.mSec
Value: 4452
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 103447
Key : Analysis.Init.CPU.mSec
Value: 546
Key : Analysis.Init.Elapsed.mSec
Value: 10200
Key : Analysis.Memory.CommitPeak.Mb
Value: 84
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 7e
BUGCHECK_P1: ffffffffc0000005
BUGCHECK_P2: fffff8025e530e36
BUGCHECK_P3: fffff909f0775ef8
BUGCHECK_P4: fffff909f0775730
EXCEPTION_RECORD: fffff909f0775ef8 -- (.exr 0xfffff909f0775ef8)
ExceptionAddress: fffff8025e530e36 (nvlddmkm+0x00000000007c0e36)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000048
Attempt to read from address 0000000000000048
CONTEXT: fffff909f0775730 -- (.cxr 0xfffff909f0775730)
rax=0000000000000000 rbx=0000000000000000 rcx=ffffc604dfbdc1d8
rdx=0000000000000000 rsi=ffffdb00d1a48c57 rdi=ffffc604dfb46000
rip=fffff8025e530e36 rsp=fffff909f0776130 rbp=ffffc604dfb67f20
r8=0000000000000003 r9=0000000000000000 r10=0000000000000000
r11=ffffdb00d1a48cc3 r12=0000000000000000 r13=0000000000000000
r14=0000000000000002 r15=ffffc604dfb46180
iopl=0 nv up ei ng nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050286
nvlddmkm+0x7c0e36:
fffff802`5e530e36 ff5048 call qword ptr [rax+48h] ds:002b:00000000`00000048=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
READ_ADDRESS: fffff8024eafa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000048
ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p adresindeki y nerge 0x%p adresindeki belle e ba vurdu. Bellek u olamaz %s.
EXCEPTION_CODE_STR: c0000005
EXCEPTION_PARAMETER1: 0000000000000000
EXCEPTION_PARAMETER2: 0000000000000048
EXCEPTION_STR: 0xc0000005
STACK_TEXT:
fffff909`f0776130 00000000`00000000 : fffff802`5ded9543 00000000`00000001 fffff802`4e1d3608 00000000`000000ff : nvlddmkm+0x7c0e36
SYMBOL_NAME: nvlddmkm+7c0e36
MODULE_NAME: nvlddmkm
IMAGE_NAME: nvlddmkm.sys
STACK_COMMAND: .cxr 0xfffff909f0775730 ; kb
BUCKET_ID_FUNC_OFFSET: 7c0e36
FAILURE_BUCKET_ID: AV_nvlddmkm!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {7eea5677-f68d-2154-717e-887e07e55cd3}
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000011, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8041344a81c, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3218
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 4396
Key : Analysis.Init.CPU.mSec
Value: 468
Key : Analysis.Init.Elapsed.mSec
Value: 13061
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: a
BUGCHECK_P1: 11
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8041344a81c
READ_ADDRESS: fffff80413efa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000011
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: opera.exe
TRAP_FRAME: ffffa78aa6ba3800 -- (.trap 0xffffa78aa6ba3800)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=00000000000000a9 rbx=0000000000000000 rcx=0000000000000000
rdx=ffffdf81a9b28180 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8041344a81c rsp=ffffa78aa6ba3990 rbp=ffffdf81a9a87ca8
r8=00000000000008e1 r9=000000000000002f r10=0000fffff804134e
r11=ffffcf7939e00000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!KiExitDispatcher+0xcc:
fffff804`1344a81c 0fb64611 movzx eax,byte ptr [rsi+11h] ds:00000000`00000011=??
Resetting default scope
STACK_TEXT:
ffffa78a`a6ba36b8 fffff804`13607769 : 00000000`0000000a 00000000`00000011 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffa78a`a6ba36c0 fffff804`13603a69 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff804`13465a1c : nt!KiBugCheckDispatch+0x69
ffffa78a`a6ba3800 fffff804`1344a81c : ffffa78a`a6ba39e0 00000000`001f0003 ffffa887`f54f0000 fffff804`1382af81 : nt!KiPageFault+0x469
ffffa78a`a6ba3990 fffff804`1344a31a : 00000000`00000000 00000000`00000000 ffffcd87`308e9760 00000000`00000000 : nt!KiExitDispatcher+0xcc
ffffa78a`a6ba3a00 fffff804`137fae1d : 00000000`00000000 ffffa78a`a6ba3b80 ffffcd87`00000000 ffffcd87`32c4e440 : nt!KeSetEvent+0xea
ffffa78a`a6ba3a90 fffff804`136071b8 : ffffcd87`2210e080 00000000`00000000 ffffa78a`00000000 ffffcd87`00000000 : nt!NtSetEvent+0xbd
ffffa78a`a6ba3b00 00007ffa`1166c174 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000e8`6e5fe008 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`1166c174
SYMBOL_NAME: nt!KiExitDispatcher+cc
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.746
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: cc
FAILURE_BUCKET_ID: AV_nt!KiExitDispatcher
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {fa0b8b4b-4ad8-a0c3-2a8d-0bdbe49a67e8}
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: fffff803007969e8, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80177f1920b, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2889
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 4049
Key : Analysis.Init.CPU.mSec
Value: 421
Key : Analysis.Init.Elapsed.mSec
Value: 15547
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 50
BUGCHECK_P1: fffff803007969e8
BUGCHECK_P2: 0
BUGCHECK_P3: fffff80177f1920b
BUGCHECK_P4: 2
READ_ADDRESS: Unable to get nt!_MI_SYSTEM_VA_ASSIGNMENT.BaseAddress at fffff8017864f908
Unable to get nt!_MI_SYSTEM_VA_ASSIGNMENT.BaseAddress at fffff8017864f918
Unable to get nt!_MI_SYSTEM_VA_ASSIGNMENT.BaseAddress at fffff8017864f928
Unable to get nt!_MI_SYSTEM_VA_ASSIGNMENT.BaseAddress at fffff8017864f938
Unable to get nt!_MI_SYSTEM_VA_ASSIGNMENT.BaseAddress at fffff8017864f948
Unable to get nt!_MI_SYSTEM_VA_ASSIGNMENT.BaseAddress at fffff8017864f958
Unable to get nt!_MI_SYSTEM_VA_ASSIGNMENT.BaseAddress at fffff8017864f968
Unable to get nt!_MI_SYSTEM_VA_ASSIGNMENT.BaseAddress at fffff8017864f978
Unable to get nt!_MI_SYSTEM_VA_ASSIGNMENT.BaseAddress at fffff8017864f988
Unable to get nt!_MI_SYSTEM_VA_ASSIGNMENT.BaseAddress at fffff8017864f998
Unable to get nt!_MI_SYSTEM_VA_ASSIGNMENT.BaseAddress at fffff8017864f9a8
Unable to get nt!_MI_SYSTEM_VA_ASSIGNMENT.BaseAddress at fffff8017864f9b8
Unable to get nt!_MI_SYSTEM_VA_ASSIGNMENT.BaseAddress at fffff8017864f9c8
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
GetUlongFromAddress: unable to read from fffff801786168c4
fffff803007969e8
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: opera.exe
TRAP_FRAME: ffffef0a3ee30460 -- (.trap 0xffffef0a3ee30460)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff801786fa368 rbx=0000000000000000 rcx=ffff958c3122f080
rdx=00000000620271a0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80177f1920b rsp=ffffef0a3ee305f0 rbp=ffff8381de728180
r8=00000000310138d0 r9=00000000310138d0 r10=ffff958c2eb8c080
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KiConvertDynamicHeteroPolicy+0x4b:
fffff801`77f1920b 8b0490 mov eax,dword ptr [rax+rdx*4] ds:fffff803`007969e8=????????
Resetting default scope
STACK_TEXT:
ffffef0a`3ee301b8 fffff801`77e1e8bb : 00000000`00000050 fffff803`007969e8 00000000`00000000 ffffef0a`3ee30460 : nt!KeBugCheckEx
ffffef0a`3ee301c0 fffff801`77c0c960 : 00000000`00000000 00000000`00000000 ffffef0a`3ee304e0 00000000`00000000 : nt!MiSystemFault+0x1f40ab
ffffef0a`3ee302c0 fffff801`77e0395e : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MmAccessFault+0x400
ffffef0a`3ee30460 fffff801`77f1920b : ffff958c`00000002 ffffef0a`00000005 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x35e
ffffef0a`3ee305f0 fffff801`77f195c7 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiConvertDynamicHeteroPolicy+0x4b
ffffef0a`3ee30620 fffff801`77c4b0b6 : ffff958c`350c0b70 00000000`00000000 000001e8`d130a350 00000000`00000010 : nt!KiHeteroChooseTargetProcessor+0xa7
ffffef0a`3ee306f0 fffff801`77c4a891 : 000001e8`d130a350 00000000`0000038c ffff958c`3194b648 fffff801`77c43a4b : nt!KiDeferredReadySingleThread+0x566
ffffef0a`3ee308e0 00000000`00000000 : 00000000`00000000 000001e8`d130a350 0000007c`f21ffbc8 ffff958c`350c0b70 : nt!KiExitDispatcher+0x141
SYMBOL_NAME: nt!KiConvertDynamicHeteroPolicy+4b
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.746
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 4b
FAILURE_BUCKET_ID: AV_R_INVALID_nt!KiConvertDynamicHeteroPolicy
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {82612117-fdf5-7a3e-5637-9d80a974c40f}
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffffffffffffd0, memory referenced.
Arg2: 0000000000000002, value 0 = read operation, 1 = write operation.
Arg3: fffff80033e611d6, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32kfull.sys
Could not read faulting driver name
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2796
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 45610
Key : Analysis.Init.CPU.mSec
Value: 484
Key : Analysis.Init.Elapsed.mSec
Value: 19019
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 50
BUGCHECK_P1: ffffffffffffffd0
BUGCHECK_P2: 2
BUGCHECK_P3: fffff80033e611d6
BUGCHECK_P4: 2
READ_ADDRESS: fffff800348fa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
ffffffffffffffd0
MM_INTERNAL_CODE: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: XboxPcApp.exe
TRAP_FRAME: ffffe28adddda9a0 -- (.trap 0xffffe28adddda9a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000000
rdx=000000007457624f rsi=0000000000000000 rdi=0000000000000000
rip=fffff80033e611d6 rsp=ffffe28addddab30 rbp=ffffe28addddabb0
r8=ffffbf8f77374196 r9=0000000000000026 r10=00000000ffffffff
r11=000000000000016e r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!ObfDereferenceObjectWithTag+0x26:
fffff800`33e611d6 f0480fc15ed0 lock xadd qword ptr [rsi-30h],rbx ds:ffffffff`ffffffd0=????????????????
Resetting default scope
STACK_TEXT:
ffffe28a`dddda6f8 fffff800`3401e8bb : 00000000`00000050 ffffffff`ffffffd0 00000000`00000002 ffffe28a`dddda9a0 : nt!KeBugCheckEx
ffffe28a`dddda700 fffff800`33e0c960 : 00000000`00000000 00000000`00000002 ffffe28a`ddddaa20 00000000`00000000 : nt!MiSystemFault+0x1f40ab
ffffe28a`dddda800 fffff800`3400395e : 00000000`00000000 ffffa900`b3b28180 ffffbf8f`891d4340 fffff800`33e64d7f : nt!MmAccessFault+0x400
ffffe28a`dddda9a0 fffff800`33e611d6 : ffffe28a`ddddae20 fffff800`345b1019 00000000`00000000 ffffbf8f`891d4340 : nt!KiPageFault+0x35e
ffffe28a`ddddab30 fffff800`341f7786 : ffffe28a`ddddae18 00000000`ffffffff ffffbf8f`8b74fe10 00000000`00000000 : nt!ObfDereferenceObjectWithTag+0x26
ffffe28a`ddddab70 ffff8210`87c34fb2 : 00000000`000186a0 00000000`00030d40 ffff8251`472cb530 ffffbf8f`82256970 : nt!ObWaitForMultipleObjects+0x336
ffffe28a`ddddb070 00000000`000186a0 : 00000000`00030d40 ffff8251`472cb530 ffffbf8f`82256970 00000000`00000001 : win32kfull+0x154fb2
ffffe28a`ddddb078 00000000`00030d40 : ffff8251`472cb530 ffffbf8f`82256970 00000000`00000001 ffffe28a`ddddb001 : 0x186a0
ffffe28a`ddddb080 ffff8251`472cb530 : ffffbf8f`82256970 00000000`00000001 ffffe28a`ddddb001 00000000`00000000 : 0x30d40
ffffe28a`ddddb088 ffffbf8f`82256970 : 00000000`00000001 ffffe28a`ddddb001 00000000`00000000 ffff8210`8784d781 : 0xffff8251`472cb530
ffffe28a`ddddb090 00000000`00000001 : ffffe28a`ddddb001 00000000`00000000 ffff8210`8784d781 00000004`00000001 : 0xffffbf8f`82256970
ffffe28a`ddddb098 ffffe28a`ddddb001 : 00000000`00000000 ffff8210`8784d781 00000004`00000001 00000000`00000000 : 0x1
ffffe28a`ddddb0a0 00000000`00000000 : ffff8210`8784d781 00000004`00000001 00000000`00000000 00000000`00000000 : 0xffffe28a`ddddb001
SYMBOL_NAME: win32kfull+154fb2
MODULE_NAME: win32kfull
IMAGE_NAME: win32kfull.sys
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 154fb2
FAILURE_BUCKET_ID: AV_INVALID_win32kfull!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {813dd5ff-825f-5763-1a47-2fbfb9dbb6be}
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: 0000000000000102, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000001, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8021c86457e, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3093
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 10685
Key : Analysis.Init.CPU.mSec
Value: 437
Key : Analysis.Init.Elapsed.mSec
Value: 4877
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: a
BUGCHECK_P1: 102
BUGCHECK_P2: 2
BUGCHECK_P3: 1
BUGCHECK_P4: fffff8021c86457e
WRITE_ADDRESS: fffff8021d2fa390: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
0000000000000102
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: EpicGamesLauncher.exe
TRAP_FRAME: ffffe402ad1bf7e0 -- (.trap 0xffffe402ad1bf7e0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000000034d569 rbx=0000000000000000 rcx=ffffa3806e919180
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8021c86457e rsp=ffffe402ad1bf970 rbp=ffffe402ad1bfa01
r8=0000000000000001 r9=0000007df719da83 r10=0000000000000000
r11=fffff780000003b0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KeWaitForSingleObject+0x18e:
fffff802`1c86457e f00fba2f07 lock bts dword ptr [rdi],7 ds:00000000`00000000=????????
Resetting default scope
STACK_TEXT:
ffffe402`ad1bf698 fffff802`1ca07769 : 00000000`0000000a 00000000`00000102 00000000`00000002 00000000`00000001 : nt!KeBugCheckEx
ffffe402`ad1bf6a0 fffff802`1ca03a69 : ffffa380`6e728100 ffff28e6`a3ede428 00000000`00000000 ffffd104`1f7e9180 : nt!KiBugCheckDispatch+0x69
ffffe402`ad1bf7e0 fffff802`1c86457e : ffffd104`000000c6 fffff802`00000000 fffff802`1ad41101 ffffd104`1f7e91c0 : nt!KiPageFault+0x469
ffffe402`ad1bf970 fffff802`1cc2c6a1 : 00000000`00000102 00000000`00000006 00000000`00000001 00000000`00000000 : nt!KeWaitForSingleObject+0x18e
ffffe402`ad1bfa60 fffff802`1cc2c74a : ffffd104`1f7e9080 000000d0`210bf918 00000000`00000000 00000000`00040213 : nt!ObWaitForSingleObject+0x91
ffffe402`ad1bfac0 fffff802`1ca071b8 : 00000261`f0fbdae0 00000000`00000000 ffffe402`ad1bfb18 ffffffff`fffe7960 : nt!NtWaitForSingleObject+0x6a
ffffe402`ad1bfb00 00007ffb`3d4cc034 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000d0`210bf8e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffb`3d4cc034
SYMBOL_NAME: nt!KeWaitForSingleObject+18e
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.746
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 18e
FAILURE_BUCKET_ID: AV_nt!KeWaitForSingleObject
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {505415ce-6277-25db-2465-e86127b1616c}
drive.google.com
