PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: ffffb781554f1000, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff804599e1ade, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for FortiShield.sys
Could not read faulting driver name
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: LENOVO
SYSTEM_PRODUCT_NAME: 20Q5001YTX
SYSTEM_SKU: LENOVO_MT_20Q5_BU_SMB_FM_ThinkPad L490
SYSTEM_VERSION: ThinkPad L490
BIOS_VENDOR: LENOVO
BIOS_VERSION: R0ZET37W (1.15 )
BIOS_DATE: 12/11/2019
BASEBOARD_MANUFACTURER: LENOVO
BASEBOARD_PRODUCT: 20Q5001YTX
BASEBOARD_VERSION: SDK0J40697 WIN
DUMP_TYPE: 2
BUGCHECK_P1: ffffb781554f1000
BUGCHECK_P2: 0
BUGCHECK_P3: fffff804599e1ade
BUGCHECK_P4: 2
READ_ADDRESS: fffff804517733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
ffffb781554f1000
FAULTING_IP:
FortiShield+1ade
fffff804`599e1ade 66f2af repne scas word ptr [rdi]
MM_INTERNAL_CODE: 2
CPU_COUNT: 8
CPU_MHZ: 708
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 8e
CPU_STEPPING: c
CPU_MICROCODE: 6,8e,c,0 (F,M,S,R) SIG: C6'00000000 (cache) C6'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: ibmpmsvc.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-7KGVC4E
ANALYSIS_SESSION_TIME: 04-01-2020 20:58:10.0187
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
TRAP_FRAME: ffffc90138517270 -- (.trap 0xffffc90138517270)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=fffffffffffff8d7
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff804599e1ade rsp=ffffc90138517400 rbp=ffffffffffffffff
r8=ffffc90138517370 r9=0000000000000000 r10=00000000826c7dde
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
FortiShield+0x1ade:
fffff804`599e1ade 66f2af repne scas word ptr [rdi]
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8045142dd34 to fffff804513c2380
STACK_TEXT:
ffffc901`38516fc8 fffff804`5142dd34 : 00000000`00000050 ffffb781`554f1000 00000000`00000000 ffffc901`38517270 : nt!KeBugCheckEx
ffffc901`38516fd0 fffff804`512c91bf : ffffc901`38517108 00000000`00000000 00000000`00000000 ffffb781`554f1000 : nt!MiSystemFault+0x195c84
ffffc901`385170d0 fffff804`513d0420 : ffffc901`38517320 00000000`00000008 00000000`00000000 fffff804`599e5985 : nt!MmAccessFault+0x34f
ffffc901`38517270 fffff804`599e1ade : ffffb781`554f01b0 00000000`00000000 ffffb781`554f01b0 ffffc901`38517440 : nt!KiPageFault+0x360
ffffc901`38517400 ffffb781`554f01b0 : 00000000`00000000 ffffb781`554f01b0 ffffc901`38517440 00000000`d7910800 : FortiShield+0x1ade
ffffc901`38517408 00000000`00000000 : ffffb781`554f01b0 ffffc901`38517440 00000000`d7910800 fffff804`00000068 : 0xffffb781`554f01b0
THREAD_SHA1_HASH_MOD_FUNC: c5dae3d2cc7e66343dcfde5f9f1433886a1590f0
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 5d008572b73674a4a3a5cbb647fc2ea08fb90579
THREAD_SHA1_HASH_MOD: 3ccbbd4513c0c0fcc583927b48c62c8983796988
FOLLOWUP_IP:
FortiShield+1ade
fffff804`599e1ade 66f2af repne scas word ptr [rdi]
FAULT_INSTR_CODE: 48aff266
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: FortiShield+1ade
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: FortiShield
IMAGE_NAME: FortiShield.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 5a9f1d5c
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1ade
FAILURE_BUCKET_ID: AV_R_INVALID_FortiShield!unknown_function
BUCKET_ID: AV_R_INVALID_FortiShield!unknown_function
PRIMARY_PROBLEM_CLASS: AV_R_INVALID_FortiShield!unknown_function
TARGET_TIME: 2020-03-24T07:48:48.000Z
OSBUILD: 18362
OSSERVICEPACK: 720
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 363d
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_r_invalid_fortishield!unknown_function
FAILURE_ID_HASH: {b4c5f6a9-e081-bdbc-01a0-f46879a1ee6a}
Followup: MachineOwner
---------
CLOCK_WATCHDOG_TIMEOUT (101)
An expected clock interrupt was not received on a secondary processor in an
MP system within the allocated interval. This indicates that the specified
processor is hung and not processing interrupts.
Arguments:
Arg1: 0000000000000018, Clock interrupt time out interval in nominal clock ticks.
Arg2: 0000000000000000, 0.
Arg3: ffffd40133440180, The PRCB address of the hung processor.
Arg4: 0000000000000007, The index of the hung processor.
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: LENOVO
SYSTEM_PRODUCT_NAME: 20Q5001YTX
SYSTEM_SKU: LENOVO_MT_20Q5_BU_SMB_FM_ThinkPad L490
SYSTEM_VERSION: ThinkPad L490
BIOS_VENDOR: LENOVO
BIOS_VERSION: R0ZET37W (1.15 )
BIOS_DATE: 12/11/2019
BASEBOARD_MANUFACTURER: LENOVO
BASEBOARD_PRODUCT: 20Q5001YTX
BASEBOARD_VERSION: SDK0J40697 WIN
DUMP_TYPE: 2
BUGCHECK_P1: 18
BUGCHECK_P2: 0
BUGCHECK_P3: ffffd40133440180
BUGCHECK_P4: 7
FAULTING_PROCESSOR: 7
BUGCHECK_STR: CLOCK_WATCHDOG_TIMEOUT_IDLE_THREAD
FAULTING_THREAD: ffffd40133451240
CPU_COUNT: 8
CPU_MHZ: 708
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 8e
CPU_STEPPING: c
CPU_MICROCODE: 6,8e,c,0 (F,M,S,R) SIG: C6'00000000 (cache) C6'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: d
ANALYSIS_SESSION_HOST: DESKTOP-7KGVC4E
ANALYSIS_SESSION_TIME: 04-01-2020 20:58:12.0743
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff80537e3d7a0 to fffff80537dc2380
STACK_TEXT:
ffffd401`33298b08 fffff805`37e3d7a0 : 00000000`00000101 00000000`00000018 00000000`00000000 ffffd401`33440180 : nt!KeBugCheckEx
ffffd401`33298b10 fffff805`37cb8e3c : fffff780`00000320 ffffd401`33240180 00000000`00664704 00000000`00664704 : nt!KeAccumulateTicks+0x181520
ffffd401`33298b70 fffff805`37b5e4b7 : ffff8581`c30e01b0 ffff998d`1525f3c0 ffff998d`1525f440 00000000`0000000c : nt!KeClockInterruptNotify+0x98c
ffffd401`33298f30 fffff805`37c2cc75 : 000000f3`d945da19 ffff8581`c10d1600 ffff8581`c10d16b0 ffffe755`f811cead : hal!HalpTimerClockInterrupt+0xf7
ffffd401`33298f60 fffff805`37dc3e1a : ffff998d`1525f440 ffff8581`c10d1600 00000000`0000000c ffff8581`c10d1600 : nt!KiCallInterruptServiceRoutine+0xa5
ffffd401`33298fb0 fffff805`37dc4387 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
ffff998d`1525f3c0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInterruptDispatchNoLockNoEtw+0x37
STACK_COMMAND: .thread 0xffffd40133451240 ; kb
THREAD_SHA1_HASH_MOD_FUNC: 5e958d63ed6cce864bfe4c595207e0e484aa7e7c
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: ff37374c50e05148261a8205377fb6d397a79d80
THREAD_SHA1_HASH_MOD: e2266a530ca7fbace00cfa9add8dc0ac4504d759
FOLLOWUP_IP:
nt!KeAccumulateTicks+181520
fffff805`37e3d7a0 cc int 3
FAULT_INSTR_CODE: cb8b48cc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!KeAccumulateTicks+181520
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.720
BUCKET_ID_FUNC_OFFSET: 181520
FAILURE_BUCKET_ID: CLOCK_WATCHDOG_TIMEOUT_IDLE_THREAD_nt!KeAccumulateTicks
BUCKET_ID: CLOCK_WATCHDOG_TIMEOUT_IDLE_THREAD_nt!KeAccumulateTicks
PRIMARY_PROBLEM_CLASS: CLOCK_WATCHDOG_TIMEOUT_IDLE_THREAD_nt!KeAccumulateTicks
TARGET_TIME: 2020-03-25T12:55:06.000Z
OSBUILD: 18362
OSSERVICEPACK: 720
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 3509
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:clock_watchdog_timeout_idle_thread_nt!keaccumulateticks
FAILURE_ID_HASH: {258f356e-b219-deec-be32-7461c52c1aae}
Followup: MachineOwner
---------
DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000001, The system cumulatively spent an extended period of time at
DISPATCH_LEVEL or above. The offending component can usually be
identified with a stack trace.
Arg2: 0000000000001e00, The watchdog period.
Arg3: fffff80550373358, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
additional information regarding the cumulative timeout
Arg4: 0000000000000000
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: TickPeriods ***
*** ***
*************************************************************************
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: LENOVO
SYSTEM_PRODUCT_NAME: 20Q5001YTX
SYSTEM_SKU: LENOVO_MT_20Q5_BU_SMB_FM_ThinkPad L490
SYSTEM_VERSION: ThinkPad L490
BIOS_VENDOR: LENOVO
BIOS_VERSION: R0ZET37W (1.15 )
BIOS_DATE: 12/11/2019
BASEBOARD_MANUFACTURER: LENOVO
BASEBOARD_PRODUCT: 20Q5001YTX
BASEBOARD_VERSION: SDK0J40697 WIN
DUMP_TYPE: 2
BUGCHECK_P1: 1
BUGCHECK_P2: 1e00
BUGCHECK_P3: fffff80550373358
BUGCHECK_P4: 0
DPC_TIMEOUT_TYPE: DPC_QUEUE_EXECUTION_TIMEOUT_EXCEEDED
CPU_COUNT: 8
CPU_MHZ: 708
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 8e
CPU_STEPPING: c
CPU_MICROCODE: 6,8e,c,0 (F,M,S,R) SIG: C6'00000000 (cache) C6'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x133
PROCESS_NAME: Dropbox.exe
CURRENT_IRQL: d
ANALYSIS_SESSION_HOST: DESKTOP-7KGVC4E
ANALYSIS_SESSION_TIME: 04-01-2020 20:58:16.0800
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff8055003d8b1 to fffff8054ffc2380
STACK_TEXT:
ffffbf80`db676b08 fffff805`5003d8b1 : 00000000`00000133 00000000`00000001 00000000`00001e00 fffff805`50373358 : nt!KeBugCheckEx
ffffbf80`db676b10 fffff805`4feb90b7 : 0000ea50`b015d64a ffffbf80`db6f9180 00000000`00000286 ffffaa8a`cdf9f980 : nt!KeAccumulateTicks+0x181631
ffffbf80`db676b70 fffff805`4fd601e1 : 00000000`00000000 ffffd684`722cff00 ffffaa8a`cdf9fa00 ffffd684`722cffb0 : nt!KeClockInterruptNotify+0xc07
ffffbf80`db676f30 fffff805`4fe2cc75 : ffffd684`722cff00 00000000`00000000 00000000`00000000 ffff9399`f8c36bb8 : hal!HalpTimerClockIpiRoutine+0x21
ffffbf80`db676f60 fffff805`4ffc3e1a : ffffaa8a`cdf9fa00 ffffd684`722cff00 ffffd684`7d15f1c0 ffffd684`722cff00 : nt!KiCallInterruptServiceRoutine+0xa5
ffffbf80`db676fb0 fffff805`4ffc4387 : ffffd684`7d15f080 ffffaa8a`cdf9fa00 ffffd684`722cff00 00dcd4e0`00000038 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
ffffaa8a`cdf9f980 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInterruptDispatchNoLockNoEtw+0x37
THREAD_SHA1_HASH_MOD_FUNC: ed3f27138a9aaa2bc88d0e831cba93958b0d5f60
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 42287d910447f85780c92ce5ffdf05a9f01a7ac0
THREAD_SHA1_HASH_MOD: e2266a530ca7fbace00cfa9add8dc0ac4504d759
FOLLOWUP_IP:
nt!KeAccumulateTicks+181631
fffff805`5003d8b1 cc int 3
FAULT_INSTR_CODE: ab3944cc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!KeAccumulateTicks+181631
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.720
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 181631
FAILURE_BUCKET_ID: 0x133_ISR_nt!KeAccumulateTicks
BUCKET_ID: 0x133_ISR_nt!KeAccumulateTicks
PRIMARY_PROBLEM_CLASS: 0x133_ISR_nt!KeAccumulateTicks
TARGET_TIME: 2020-03-28T17:45:55.000Z
OSBUILD: 18362
OSSERVICEPACK: 720
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 870d
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x133_isr_nt!keaccumulateticks
FAILURE_ID_HASH: {65350307-c3b9-f4b5-8829-4d27e9ff9b06}
Followup: MachineOwner
---------
CLOCK_WATCHDOG_TIMEOUT (101)
An expected clock interrupt was not received on a secondary processor in an
MP system within the allocated interval. This indicates that the specified
processor is hung and not processing interrupts.
Arguments:
Arg1: 0000000000000018, Clock interrupt time out interval in nominal clock ticks.
Arg2: 0000000000000000, 0.
Arg3: ffffc6816d040180, The PRCB address of the hung processor.
Arg4: 0000000000000004, The index of the hung processor.
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: LENOVO
SYSTEM_PRODUCT_NAME: 20Q5001YTX
SYSTEM_SKU: LENOVO_MT_20Q5_BU_SMB_FM_ThinkPad L490
SYSTEM_VERSION: ThinkPad L490
BIOS_VENDOR: LENOVO
BIOS_VERSION: R0ZET37W (1.15 )
BIOS_DATE: 12/11/2019
BASEBOARD_MANUFACTURER: LENOVO
BASEBOARD_PRODUCT: 20Q5001YTX
BASEBOARD_VERSION: SDK0J40697 WIN
DUMP_TYPE: 2
BUGCHECK_P1: 18
BUGCHECK_P2: 0
BUGCHECK_P3: ffffc6816d040180
BUGCHECK_P4: 4
FAULTING_PROCESSOR: 4
BUGCHECK_STR: CLOCK_WATCHDOG_TIMEOUT_IDLE_THREAD
FAULTING_THREAD: ffffc6816d051240
CPU_COUNT: 8
CPU_MHZ: 708
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 8e
CPU_STEPPING: c
CPU_MICROCODE: 6,8e,c,0 (F,M,S,R) SIG: C6'00000000 (cache) C6'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: d
ANALYSIS_SESSION_HOST: DESKTOP-7KGVC4E
ANALYSIS_SESSION_TIME: 04-01-2020 20:58:20.0298
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
EXCEPTION_RECORD: ffff828038f0a210 -- (.exr 0xffff828038f0a210)
ExceptionAddress: 0000000000000001
ExceptionCode: 00000001
ExceptionFlags: 00000000
NumberParameters: 7
Parameter[0]: 0000000000000000
Parameter[1]: 0000000000000008
Parameter[2]: 0000000000000008
Parameter[3]: ffff8e0198443538
Parameter[4]: 0000000400000001
Parameter[5]: 0000000000000014
Parameter[6]: 0000000000000000
TRAP_FRAME: ffff828038f0a310 -- (.trap 0xffff828038f0a310)
Unable to read trap frame at ffff8280`38f0a310
LAST_CONTROL_TRANSFER: from fffff8042d43d7a0 to fffff8042d3c2380
STACK_TEXT:
ffffc681`6cc76b08 fffff804`2d43d7a0 : 00000000`00000101 00000000`00000018 00000000`00000000 ffffc681`6d040180 : nt!KeBugCheckEx
ffffc681`6cc76b10 fffff804`2d2b8e3c : fffff780`00000320 ffffc681`6ccf9180 00000000`00a18157 00000000`00a18157 : nt!KeAccumulateTicks+0x181520
ffffc681`6cc76b70 fffff804`2dcb84b7 : ffffc681`6ccf9180 ffff8280`38f09a80 ffff8280`38f09b00 00000000`0000000c : nt!KeClockInterruptNotify+0x98c
ffffc681`6cc76f30 fffff804`2d22cc75 : 00000181`108f1d41 ffff8e01`984d1000 ffff8e01`984d10b0 00000000`00000000 : hal!HalpTimerClockInterrupt+0xf7
ffffc681`6cc76f60 fffff804`2d3c3e1a : ffff8280`38f09b00 ffff8e01`984d1000 00000000`00000002 ffff8e01`984d1000 : nt!KiCallInterruptServiceRoutine+0xa5
ffffc681`6cc76fb0 fffff804`2d3c4387 : ffff8280`38f0a210 ffff8280`38f09b00 ffff8e01`984d1000 00000000`00000000 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
ffff8280`38f09a80 fffff804`2d215912 : ffff8280`38f0a210 00000000`00000002 ffff8280`38f0a310 ffff7b99`d59b07ed : nt!KiInterruptDispatchNoLockNoEtw+0x37
ffff8280`38f09c10 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiAgeWorkingSetTail+0x402
STACK_COMMAND: .thread 0xffffc6816d051240 ; kb
THREAD_SHA1_HASH_MOD_FUNC: 5001835cd530381ccf072ffa10c36754ed8ad11b
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 0dc65ef31c99579f14f4ccee7846606815796bd1
THREAD_SHA1_HASH_MOD: 77b99fd8d0bba6459fea0474c255a54ffe46d91a
FOLLOWUP_IP:
nt!KeAccumulateTicks+181520
fffff804`2d43d7a0 cc int 3
FAULT_INSTR_CODE: cb8b48cc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!KeAccumulateTicks+181520
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.720
BUCKET_ID_FUNC_OFFSET: 181520
FAILURE_BUCKET_ID: CLOCK_WATCHDOG_TIMEOUT_IDLE_THREAD_INTERRUPTS_DISABLED_nt!KeAccumulateTicks
BUCKET_ID: CLOCK_WATCHDOG_TIMEOUT_IDLE_THREAD_INTERRUPTS_DISABLED_nt!KeAccumulateTicks
PRIMARY_PROBLEM_CLASS: CLOCK_WATCHDOG_TIMEOUT_IDLE_THREAD_INTERRUPTS_DISABLED_nt!KeAccumulateTicks
TARGET_TIME: 2020-03-30T15:43:53.000Z
OSBUILD: 18362
OSSERVICEPACK: 720
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 2469
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:clock_watchdog_timeout_idle_thread_interrupts_disabled_nt!keaccumulateticks
FAILURE_ID_HASH: {a5edf3bd-db2d-cc93-4a2c-fb9c511c6f0e}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff8288b487f5b0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff8288b487f508, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32kfull.sys
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
SYSTEM_MANUFACTURER: LENOVO
SYSTEM_PRODUCT_NAME: 20Q5001YTX
SYSTEM_SKU: LENOVO_MT_20Q5_BU_SMB_FM_ThinkPad L490
SYSTEM_VERSION: ThinkPad L490
BIOS_VENDOR: LENOVO
BIOS_VERSION: R0ZET37W (1.15 )
BIOS_DATE: 12/11/2019
BASEBOARD_MANUFACTURER: LENOVO
BASEBOARD_PRODUCT: 20Q5001YTX
BASEBOARD_VERSION: SDK0J40697 WIN
DUMP_TYPE: 2
BUGCHECK_P1: 3
BUGCHECK_P2: ffff8288b487f5b0
BUGCHECK_P3: ffff8288b487f508
BUGCHECK_P4: 0
TRAP_FRAME: ffff8288b487f5b0 -- (.trap 0xffff8288b487f5b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff8288b1bb7800 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffde8a93d141c0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff803617113d6 rsp=ffff8288b487f740 rbp=0000000000000001
r8=0000000000000002 r9=fffff14348b42a80 r10=fffff8036163b8c0
r11=ffff8288b487f850 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po cy
nt!ExpReleaseResourceExclusiveForThreadLite+0x276:
fffff803`617113d6 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffff8288b487f508 -- (.exr 0xffff8288b487f508)
ExceptionAddress: fffff803617113d6 (nt!ExpReleaseResourceExclusiveForThreadLite+0x0000000000000276)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
CPU_COUNT: 8
CPU_MHZ: 708
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 8e
CPU_STEPPING: c
CPU_MICROCODE: 6,8e,c,0 (F,M,S,R) SIG: C6'00000000 (cache) C6'00000000 (init)
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x139
PROCESS_NAME: EXCEL.EXE
CURRENT_IRQL: 2
DEFAULT_BUCKET_ID: FAIL_FAST_CORRUPT_LIST_ENTRY
ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
ANALYSIS_SESSION_HOST: DESKTOP-7KGVC4E
ANALYSIS_SESSION_TIME: 04-01-2020 20:58:23.0617
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff803617d41e9 to fffff803617c2380
STACK_TEXT:
ffff8288`b487f288 fffff803`617d41e9 : 00000000`00000139 00000000`00000003 ffff8288`b487f5b0 ffff8288`b487f508 : nt!KeBugCheckEx
ffff8288`b487f290 fffff803`617d4610 : ffff8288`00000000 00000000`00000000 00000000`00000000 00000000`000f0000 : nt!KiBugCheckDispatch+0x69
ffff8288`b487f3d0 fffff803`617d29a5 : ffff8288`b487f7b0 00000000`00000000 00000000`00000000 fffff803`61c096d0 : nt!KiFastFailDispatch+0xd0
ffff8288`b487f5b0 fffff803`617113d6 : ffffde8a`94089080 fffff143`4801c010 ffffde8a`8c588910 fffff803`6155e848 : nt!KiRaiseSecurityCheckFailure+0x325
ffff8288`b487f740 fffff803`6171109a : ffffde8a`00000000 ffff8288`b487fa80 00000000`000009c4 00000000`0078225f : nt!ExpReleaseResourceExclusiveForThreadLite+0x276
ffff8288`b487f800 fffff107`b6d7194d : 00000000`00000000 0000009d`689ff1f8 00000000`00000000 fffff803`617110c9 : nt!ExReleaseResourceAndLeaveCriticalRegion+0x8a
ffff8288`b487f860 fffff107`b65212ed : ffff8288`b487f920 00000000`00000000 0000009d`00000000 0000009d`689ff450 : win32kbase!UserSessionSwitchLeaveCrit+0x5d
ffff8288`b487f8e0 ffff8288`b487f920 : 00000000`00000000 0000009d`00000000 0000009d`689ff450 00000000`00000002 : win32kfull+0x1212ed
ffff8288`b487f8e8 00000000`00000000 : 0000009d`00000000 0000009d`689ff450 00000000`00000002 00000000`00000000 : 0xffff8288`b487f920
THREAD_SHA1_HASH_MOD_FUNC: 7c2b0af0705ab1745c9268bfc5acfdccc1d6ca3b
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 5cf23b53b58436219d3a57200f2b0cf62222f780
THREAD_SHA1_HASH_MOD: 6713db47099f72f5cc67bbd63a135e77efbc7e45
FOLLOWUP_IP:
win32kbase!UserSessionSwitchLeaveCrit+5d
fffff107`b6d7194d 0f1f440000 nop dword ptr [rax+rax]
FAULT_INSTR_CODE: 441f0f
SYMBOL_STACK_INDEX: 6
SYMBOL_NAME: win32kbase!UserSessionSwitchLeaveCrit+5d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32kbase
IMAGE_NAME: win32kbase.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.719
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 5d
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_win32kbase!UserSessionSwitchLeaveCrit
BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_win32kbase!UserSessionSwitchLeaveCrit
PRIMARY_PROBLEM_CLASS: 0x139_3_CORRUPT_LIST_ENTRY_win32kbase!UserSessionSwitchLeaveCrit
TARGET_TIME: 2020-03-31T11:53:15.000Z
OSBUILD: 18362
OSSERVICEPACK: 720
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 4ed5
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_3_corrupt_list_entry_win32kbase!usersessionswitchleavecrit
FAILURE_ID_HASH: {0a5d7812-de29-e317-2ea0-92b5d30889e6}
Followup: MachineOwner
---------
