TigeR_Bf109
Hectopat
Daha fazla
- Cinsiyet
- Erkek
DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic "buffer overrun"
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete control of it.
Do a kb to get a stack backtrace -- the last routine on the stack before the
buffer overrun handlers and bugcheck call is the one that overran its local
variable(s).
Arguments:
Arg1: 9eed0000000087d4, Actual security check cookie from the stack
Arg2: 0000b99c9eedc3ea, Expected security check cookie
Arg3: ffff466361123c15, Complement of the expected security check cookie
Arg4: 0000000000000000, zero
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 9eed0000000087d4
BUGCHECK_P2: b99c9eedc3ea
BUGCHECK_P3: ffff466361123c15
BUGCHECK_P4: 0
SECURITY_COOKIE: Expected 0000b99c9eedc3ea found 9eed0000000087d4
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: c
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0xF7
PROCESS_NAME: Origin.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 01-07-2020 17:46:42.0743
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff8040627c485 to fffff804061c14e0
STACK_TEXT:
ffffb984`49cb7818 fffff804`0627c485 : 00000000`000000f7 9eed0000`000087d4 0000b99c`9eedc3ea ffff4663`61123c15 : nt!KeBugCheckEx
ffffb984`49cb7820 fffff804`06072ec2 : 00000000`00000000 00000000`003edef8 00000000`00000001 00000000`00000000 : nt!_report_gsfailure+0x25
ffffb984`49cb7860 fffff804`061cf520 : ffffe50a`c3869080 ffffb984`49cb7a80 00000000`00544000 ffffe50a`bfec6be0 : nt!MmAccessFault+0x322
ffffb984`49cb7a00 00000000`777316ae : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x360
00000000`003ee810 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x777316ae
THREAD_SHA1_HASH_MOD_FUNC: a7dfa97d75a3d26079665ff6906966f05e95116b
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 96e6575e13f68d3c9c741a111f295a559c3bc146
THREAD_SHA1_HASH_MOD: d084f7dfa548ce4e51810e4fd5914176ebc66791
FOLLOWUP_IP:
nt!_report_gsfailure+25
fffff804`0627c485 cc int 3
FAULT_INSTR_CODE: cccccccc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!_report_gsfailure+25
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 12dcb470
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 25
FAILURE_BUCKET_ID: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
BUCKET_ID: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
PRIMARY_PROBLEM_CLASS: 0xF7_MISSING_GSFRAME_nt!_report_gsfailure
TARGET_TIME: 2020-01-07T12:46:22.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 3de5
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xf7_missing_gsframe_nt!_report_gsfailure
FAILURE_ID_HASH: {82d2c1b5-b0cb-60a5-9a5d-78c8c4284f84}
Followup: MachineOwner
---------
IRQL_NOT_LESS_OR_EQUAL (a)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If a kernel debugger is available get the stack backtrace.
Arguments:
Arg1: fffff807961d6021, memory referenced
Arg2: 0000000000000002, IRQL
Arg3: 0000000000000000, bitfield :
bit 0 : value 0 = read operation, 1 = write operation
bit 3 : value 0 = not an execute operation, 1 = execute operation (only on chips which support this level of status)
Arg4: fffff8074c43cfe0, address which referenced memory
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: fffff807961d6021
BUGCHECK_P2: 2
BUGCHECK_P3: 0
BUGCHECK_P4: fffff8074c43cfe0
READ_ADDRESS: fffff8074c9733b8: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
fffff807961d6021
CURRENT_IRQL: 2
FAULTING_IP:
nt!KiMayStealStandbyThread+0
fffff807`4c43cfe0 0fb682a15e0000 movzx eax,byte ptr [rdx+5EA1h]
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: c
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: csrss.exe
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 01-07-2020 17:46:54.0749
ANALYSIS_VERSION: 10.0.18362.1 x86fre
TRAP_FRAME: ffffa5818ed78090 -- (.trap 0xffffa5818ed78090)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000007 rbx=0000000000000000 rcx=ffffbc000d7c7180
rdx=fffff8074a1d0180 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8074c43cfe0 rsp=ffffa5818ed78228 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000003 r10=0000000000000000
r11=fffff8074a1d0180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
nt!KiMayStealStandbyThread:
fffff807`4c43cfe0 0fb682a15e0000 movzx eax,byte ptr [rdx+5EA1h] ds:fffff807`4a1d6021=00
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff8074c5d32e9 to fffff8074c5c14e0
STACK_TEXT:
ffffa581`8ed77f48 fffff807`4c5d32e9 : 00000000`0000000a fffff807`961d6021 00000000`00000002 00000000`00000000 : nt!KeBugCheckEx
ffffa581`8ed77f50 fffff807`4c5cf62b : 00000000`00000000 ffff9589`7c8f4100 fffff807`4a1d0180 00000000`00000002 : nt!KiBugCheckDispatch+0x69
ffffa581`8ed78090 fffff807`4c43cfe0 : fffff807`4c43c8eb 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x46b
ffffa581`8ed78228 fffff807`4c43c8eb : 00000000`00000000 00000000`00000000 00000000`00000000 fffff807`4ceb7c54 : nt!KiMayStealStandbyThread
ffffa581`8ed78230 fffff807`4c43c2ec : fffff807`4a1d0180 ffffa581`fffffffe ffff9589`ffffffff 00000000`00000001 : nt!KiSearchForNewThreadOnProcessor+0x3b
ffffa581`8ed782c0 fffff807`4c43b644 : ffff9589`77d7c080 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSwapThread+0x72c
ffffa581`8ed78360 fffff807`4c4884e7 : ffff9589`7c9a4000 fffff807`00000000 00000001`00000000 00000000`00000000 : nt!KiCommitThreadWait+0x144
ffffa581`8ed78400 fffff392`0b209c86 : ffffffff`ffff8ad0 00000000`00000000 00000000`00000003 00000000`00000002 : nt!KeWaitForMultipleObjects+0x287
ffffa581`8ed78510 fffff392`0ae0c779 : 00000000`00000003 00000000`00000003 fffff392`0b121308 00000000`00000004 : win32kbase!LegacyInputDispatcher::WaitAndDispatch+0x86
ffffa581`8ed78640 fffff392`0b24e87e : ffff9589`77d7c080 ffff9589`77d7c080 00000000`00000000 00000000`00000005 : win32kfull!RawInputThread+0x959
ffffa581`8ed788c0 fffff392`0ae2aff0 : ffff9589`77d7c080 00000000`00000000 00000000`00000005 00000000`00000000 : win32kbase!xxxCreateSystemThreads+0x9e
ffffa581`8ed789d0 fffff807`4c5d2d15 : ffff9589`77d7c080 00000000`00000005 0000023e`0e604340 00000000`00000248 : win32kfull!NtUserCallNoParam+0x70
ffffa581`8ed78a00 00007ff9`f7fd1144 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
0000006f`07c3fa88 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ff9`f7fd1144
THREAD_SHA1_HASH_MOD_FUNC: ce93dcacf5833022134aa6002a897ec05d7efdcc
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: b81e53458752b0ac346801a7e319f05e6d97b507
THREAD_SHA1_HASH_MOD: 637ba5de44a7a77d210b2c1790ddac079fb3fbb2
FOLLOWUP_IP:
win32kbase!LegacyInputDispatcher::WaitAndDispatch+86
fffff392`0b209c86 0f1f440000 nop dword ptr [rax+rax]
FAULT_INSTR_CODE: 441f0f
SYMBOL_STACK_INDEX: 8
SYMBOL_NAME: win32kbase!LegacyInputDispatcher::WaitAndDispatch+86
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: win32kbase
IMAGE_NAME: win32kbase.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 86
FAILURE_BUCKET_ID: AV_win32kbase!LegacyInputDispatcher::WaitAndDispatch
BUCKET_ID: AV_win32kbase!LegacyInputDispatcher::WaitAndDispatch
PRIMARY_PROBLEM_CLASS: AV_win32kbase!LegacyInputDispatcher::WaitAndDispatch
TARGET_TIME: 2020-01-07T12:56:32.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 2bfd
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_win32kbase!legacyinputdispatcher::waitanddispatch
FAILURE_ID_HASH: {af9493bb-0913-2c87-0cc0-f458347dea63}
Followup: MachineOwner
---------
WHEA_UNCORRECTABLE_ERROR (124)
A fatal hardware error has occurred. Parameter 1 identifies the type of error
source that reported the error. Parameter 2 holds the address of the
WHEA_ERROR_RECORD structure that describes the error conditon.
Arguments:
Arg1: 0000000000000000, Machine Check Exception
Arg2: ffffd9858bf7d028, Address of the WHEA_ERROR_RECORD structure.
Arg3: 00000000be000000, High order 32-bits of the MCi_STATUS value.
Arg4: 0000000000800400, Low order 32-bits of the MCi_STATUS value.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 0
BUGCHECK_P2: ffffd9858bf7d028
BUGCHECK_P3: be000000
BUGCHECK_P4: 800400
BUGCHECK_STR: 0x124_GenuineIntel
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: c
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: System
CURRENT_IRQL: f
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 12-30-2019 17:37:55.0071
ANALYSIS_VERSION: 10.0.18362.1 x86fre
STACK_TEXT:
ffffb100`7d1ddd58 fffff800`749a4fe8 : 00000000`00000124 00000000`00000000 ffffd985`8bf7d028 00000000`be000000 : nt!KeBugCheckEx
ffffb100`7d1ddd60 fffff800`79981920 : ffffd985`81142040 00000000`00000000 ffffd985`8bf7d028 00000000`00000000 : hal!HalBugCheckSystem+0xd8
ffffb100`7d1ddda0 fffff800`74d40952 : ffffd985`81142040 ffffb100`7d1dde29 00000000`00000000 ffffd985`8bf7d028 : PSHED!PshedBugCheckSystem+0x10
ffffb100`7d1dddd0 fffff800`749a6946 : ffffb100`7d1ddef0 00000000`00000001 ffffd985`81142090 ffffd985`81142040 : nt!WheaReportHwError+0x382
ffffb100`7d1dde90 fffff800`749a6dda : 00000000`00000010 ffffd985`81142090 ffffb100`7d1de048 ffffb100`7d1de290 : hal!HalpMcaReportError+0x72
ffffb100`7d1ddff0 fffff800`749a6cb4 : ffffd985`80ae3500 00000000`00000001 00000000`00000000 00000000`00000000 : hal!HalpMceHandlerCore+0xf2
ffffb100`7d1de040 fffff800`749a6f20 : 00000000`00000010 00000000`00000001 00000000`00000000 00000000`00000000 : hal!HalpMceHandler+0xe0
ffffb100`7d1de080 fffff800`749a5fc8 : 00000000`00000000 ffffb100`7d1de310 00000000`00000000 00000000`00000000 : hal!HalpMceHandlerWithRendezvous+0xd4
ffffb100`7d1de0b0 fffff800`749a71a7 : ffffd985`80ae3500 00000000`00000000 00000000`00000000 00000000`00000000 : hal!HalpHandleMachineCheck+0x5c
ffffb100`7d1de0e0 fffff800`74ca4a20 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : hal!HalHandleMcheck+0x37
ffffb100`7d1de110 fffff800`74bd04ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiHandleMcheck+0x10
ffffb100`7d1de140 fffff800`74bd0171 : ffffb100`00000000 fffff800`74bd00ae fffff800`738fb180 00000000`00000000 : nt!KxMcheckAbort+0x7a
ffffb100`7d1de280 fffff800`910f138f : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiMcheckAbort+0x271
ffffc20b`9642f6a8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : intelppm!MWaitIdle+0x1f
THREAD_SHA1_HASH_MOD_FUNC: 74d6f842f394d0bf91f311b36b5441a27b8e18a2
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 7715d22f386f5ddac4d5fb4b9bac1cc78014801d
THREAD_SHA1_HASH_MOD: 48245875d4c5535ecbacf57c10ad759e5c3df6ae
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: GenuineIntel
IMAGE_NAME: GenuineIntel
DEBUG_FLR_IMAGE_TIMESTAMP: 0
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: 0x124_GenuineIntel_PROCESSOR_MAE_INTERNAL_TIMER
BUCKET_ID: 0x124_GenuineIntel_PROCESSOR_MAE_INTERNAL_TIMER
PRIMARY_PROBLEM_CLASS: 0x124_GenuineIntel_PROCESSOR_MAE_INTERNAL_TIMER
TARGET_TIME: 2019-12-30T12:37:34.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: b0b
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x124_genuineintel_processor_mae_internal_timer
FAILURE_ID_HASH: {dbae0c63-5a7c-cd3f-eccf-de6e68aa7cf2}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000000, A stack-based buffer has been overrun.
Arg2: 0000000000000000, Address of the trap frame for the exception that caused the bugcheck
Arg3: 0000000000000000, Address of the exception record for the exception that caused the bugcheck
Arg4: 00000000fabf6680, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 0
BUGCHECK_P2: 0
BUGCHECK_P3: 0
BUGCHECK_P4: fabf6680
TRAP_FRAME: 0000000000000000 -- (.trap 0x0)
EXCEPTION_RECORD: 0000000000000000 -- (.exr 0x0)
Cannot read Exception record @ 0000000000000000
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: c
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x139
PROCESS_NAME: iCloudPhotos.exe
CURRENT_IRQL: 2
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 12-30-2019 17:37:52.0478
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff800235c9f5b to fffff800235c14e0
STACK_TEXT:
ffffb300`84bc9d48 fffff800`235c9f5b : 00000000`00000139 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
ffffb300`84bc9d50 fffff800`234ac9e7 : 00000000`00000000 00000000`00000000 ffffb50d`f5ae0640 fffff800`23474ef6 : nt!guard_icall_bugcheck+0x1b
ffffb300`84bc9d80 ffffb300`84bca310 : ffffb50d`00000000 ffff9cce`40001e58 ffffb300`84bc9e80 00007fff`ffffffff : nt!MiWalkPageTablesRecursively+0x1e7
ffffb300`84bc9e40 ffffb50d`00000000 : ffff9cce`40001e58 ffffb300`84bc9e80 00007fff`ffffffff 00000000`00000000 : 0xffffb300`84bca310
ffffb300`84bc9e48 ffff9cce`40001e58 : ffffb300`84bc9e80 00007fff`ffffffff 00000000`00000000 ffffb50d`fb840580 : 0xffffb50d`00000000
ffffb300`84bc9e50 ffffb300`84bc9e80 : 00007fff`ffffffff 00000000`00000000 ffffb50d`fb840580 00000000`00000010 : 0xffff9cce`40001e58
ffffb300`84bc9e58 00007fff`ffffffff : 00000000`00000000 ffffb50d`fb840580 00000000`00000010 ffffb300`84bca368 : 0xffffb300`84bc9e80
ffffb300`84bc9e60 00000000`00000000 : ffffb50d`fb840580 00000000`00000010 ffffb300`84bca368 ffff9cce`40001ff8 : 0x00007fff`ffffffff
THREAD_SHA1_HASH_MOD_FUNC: 67a441eba06f2de57ce16073c13d194e99c769ad
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 4ab725918f063a3ffc707bbf8ae9a4710b386d0f
THREAD_SHA1_HASH_MOD: 2a7ca9d3ab5386d53fea7498e1d81b9c4a4c036b
FOLLOWUP_IP:
nt!guard_icall_bugcheck+1b
fffff800`235c9f5b 90 nop
FAULT_INSTR_CODE: ccccc390
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!guard_icall_bugcheck+1b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 12dcb470
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1b
FAILURE_BUCKET_ID: 0x139_0_LEGACY_GS_VIOLATION_nt!guard_icall_bugcheck
BUCKET_ID: 0x139_0_LEGACY_GS_VIOLATION_nt!guard_icall_bugcheck
PRIMARY_PROBLEM_CLASS: 0x139_0_LEGACY_GS_VIOLATION_nt!guard_icall_bugcheck
TARGET_TIME: 2019-12-30T11:54:33.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 174f
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_0_legacy_gs_violation_nt!guard_icall_bugcheck
FAILURE_ID_HASH: {9bee41a7-2ef9-07ca-7e59-7d5a0c6e2d05}
Followup: MachineOwner
---------
FAST_ERESOURCE_PRECONDITION_VIOLATION (1c6)
The current thread is performing an invalid call to a fast resource routine.
Arguments:
Arg1: 000000000000000f, The caller passed a fast resource to a legacy routine that
supports fast resources, but the fast resource was not
initialized with EX_FAST_RESOURCE_ENABLE_LEGACY_APIS.
Arg2: ffff8c83c2f53d50, Pointer to the resource.
Arg3: 0000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: f
BUGCHECK_P2: ffff8c83c2f53d50
BUGCHECK_P3: 0
BUGCHECK_P4: 0
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: c
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x1C6
PROCESS_NAME: LEDKeeper.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 12-30-2019 17:37:59.0328
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LOCK_ADDRESS: fffff80350c62960 -- (!locks fffff80350c62960)
Cannot get _ERESOURCE type
Resource @ nt!PiEngineLock (0xfffff80350c62960) Available
1 total locks
PNP_TRIAGE_DATA:
Lock address : 0xfffff80350c62960
Thread Count : 0
Thread address: 0x0000000000000000
Thread wait : 0x0
LAST_CONTROL_TRANSFER: from fffff803508375a2 to fffff803509c14e0
STACK_TEXT:
ffff8808`c9fc6978 fffff803`508375a2 : 00000000`000001c6 00000000`0000000f ffff8c83`c2f53d50 00000000`00000000 : nt!KeBugCheckEx
ffff8808`c9fc6980 fffff803`50dc005e : 00000000`00000000 ffff8c83`cc6b7d20 00000000`00000004 ffff8c83`cc6b7d20 : nt!ExAcquireResourceSharedLite+0xb2
ffff8808`c9fc69c0 fffff803`50dbff05 : ffff8808`c9fc6b60 ffff8c83`c2f53d50 00000000`00000001 ffff8c83`b995c020 : nt!PiDmGetObject+0x3e
ffff8808`c9fc69f0 fffff803`50dbfad7 : ffff8808`c9fc6b60 ffff8c83`cc6b7d20 00000000`00000003 00000000`00000001 : nt!PiDmObjectGetCachedObjectProperty+0x65
ffff8808`c9fc6a60 fffff803`50dbda45 : ffff8808`c9fc6cc0 ffff8808`c9fc6ba1 ffff8c83`b9891520 00000000`00000001 : nt!PiPnpRtlObjectActionCallback+0xe7
ffff8808`c9fc6b00 fffff803`50dbd939 : ffff8808`c9fc6cc0 00000000`47706e50 ffff8808`c9fc6e80 fffff803`00000000 : nt!_PnpGetObjectProperty+0x9d
ffff8808`c9fc6bd0 fffff803`50dbd48a : ffff8808`c9fc6e80 fffff803`00000000 ffff8808`c9fc7528 00000000`00000000 : nt!PnpGetObjectProperty+0xd1
ffff8808`c9fc6c60 fffff803`50dbd06e : 00000000`00000000 ffff8808`c9fc6e80 ffff8c83`cc6b7d20 00000000`00000000 : nt!PiPnpRtlIsDeviceEnumerableForUser+0x92
ffff8808`c9fc6cf0 fffff803`50dbcb06 : 00000000`00000000 ffff8c83`b9891520 ffff8808`c9fc7528 ffff8808`c9fc7528 : nt!PiPnpRtlApplyMandatoryDeviceFilters+0x4a
ffff8808`c9fc6d30 fffff803`50dbd211 : ffff8c83`b9891520 ffff8c83`b98e8720 ffff8c83`b9891520 ffff8808`c9fc7a00 : nt!PiPnpRtlApplyMandatoryDeviceInterfaceFilters+0x8a
ffff8808`c9fc6db0 fffff803`50ed4be1 : 00000000`00000000 ffff8c83`b9891520 ffff8c83`b98e8720 fffff803`50dc4cd1 : nt!PiPnpRtlApplyMandatoryFilters+0x8d
ffff8808`c9fc6e10 fffff803`50dc4c01 : ffff8808`c9fc7160 ffff8808`c9fc6ee9 ffff8808`c9fc6e00 00000000`00000001 : nt!IopDeviceInterfaceFilterCallback+0x71
ffff8808`c9fc6e70 fffff803`50ece1f9 : 00000000`000000d0 ffff8808`c9fc7570 00000000`00000001 fffff803`50ea4a30 : nt!PiPnpRtlInterfaceFilterCallback+0xc1
ffff8808`c9fc6f50 fffff803`50ea4a67 : ffff9d8e`00000003 00000000`00000000 00000000`00000000 00000000`00000080 : nt!PiDmCmObjectMatchCallback+0x29
ffff8808`c9fc6f90 fffff803`50dbf978 : ffff8c83`cbd039a0 00000000`00000000 00000000`00000000 ffff8c83`00000000 : nt!PiDmGetObjectListCallback+0x37
ffff8808`c9fc6fe0 fffff803`50ea30a7 : ffff8808`c9fc7500 00000000`00000000 ffff8808`c9fc7149 ffff8c83`c8c19000 : nt!PiDmListEnumObjectsWithCallback+0xe0
ffff8808`c9fc7030 fffff803`50ea2fc6 : ffff8808`c9fc7380 00000000`c0000002 ffff8c83`b9979490 00000000`00000400 : nt!PiDmGetObjectConstraintList+0xc3
ffff8808`c9fc70a0 fffff803`50ea2ed5 : ffff9d8e`270203a0 fffff803`50839c1d ffff9d8e`27020080 ffff8c83`b9200140 : nt!PiDmGetCmObjectConstraintListFromCache+0x76
ffff8808`c9fc7110 fffff803`50dbf21d : ffff8c83`b9891520 ffff8808`c9fc7380 ffff8c83`c8c19000 00000000`00000000 : nt!PiPnpRtlGetFilteredDeviceInterfaceList+0xad
ffff8808`c9fc71b0 fffff803`50ea9485 : 00000000`00000000 00000000`00000000 00000000`00000000 ffff8808`c9fc7520 : nt!PiPnpRtlCmActionCallback+0x1cd
ffff8808`c9fc7320 fffff803`50ea6c7f : 00000000`c0000023 ffff8808`c9fc7540 00000000`00000000 ffff8808`00000000 : nt!_CmGetMatchingFilteredDeviceInterfaceList+0xdd
ffff8808`c9fc7440 fffff803`50ea65af : 9d8e27a3`51500001 00000000`0740dc6c 00000000`00000000 ffff8808`c9fc7688 : nt!IopGetDeviceInterfaces+0x277
ffff8808`c9fc7610 fffff803`50dbcf15 : 9d8e2485`7cf0d75f 00000000`00120089 ffff9d8e`27020000 00000000`00000000 : nt!PiCMGetDeviceInterfaceList+0x117
ffff8808`c9fc7710 fffff803`50dbcda3 : ffff8808`c9fc7858 ffff8808`c9fc7a80 00000000`000002e8 fffff803`50df0fde : nt!PiCMHandleIoctl+0x155
ffff8808`c9fc7750 fffff803`50eca64a : 00000000`00000000 fffff803`50eca5e0 00000000`00000000 fffff803`5083aa14 : nt!PiCMFastIoDeviceDispatch+0x53
ffff8808`c9fc77a0 fffff803`50de8efb : 00000000`000002e8 00000000`00000000 00000000`00000000 ffff9d8e`24857d20 : nt!PiDaFastIoDispatch+0x6a
ffff8808`c9fc7800 fffff803`50de87c6 : 00000000`00000082 00000000`00000000 00000000`00000001 00000000`00000000 : nt!IopXxxControlFile+0x71b
ffff8808`c9fc7920 fffff803`509d2d15 : 00000000`00000000 ffff9d8e`27a35180 00000000`00000000 00000000`0730ea00 : nt!NtDeviceIoControlFile+0x56
ffff8808`c9fc7990 00000000`77e31cbc : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
00000000`0730f308 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x77e31cbc
THREAD_SHA1_HASH_MOD_FUNC: 862dbbdff79e7cd1cbea35b141f5894773c82266
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: bcec579e7b664f40092044e199d47b4cdd4d7c61
THREAD_SHA1_HASH_MOD: acbd8410556d2d99e53afebc40248f855b49ed18
FOLLOWUP_IP:
nt!ExAcquireResourceSharedLite+b2
fffff803`508375a2 cc int 3
FAULT_INSTR_CODE: 748948cc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!ExAcquireResourceSharedLite+b2
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 12dcb470
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: b2
FAILURE_BUCKET_ID: 0x1C6_nt!ExAcquireResourceSharedLite
BUCKET_ID: 0x1C6_nt!ExAcquireResourceSharedLite
PRIMARY_PROBLEM_CLASS: 0x1C6_nt!ExAcquireResourceSharedLite
TARGET_TIME: 2019-12-30T14:16:19.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 4af6
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x1c6_nt!exacquireresourcesharedlite
FAILURE_ID_HASH: {9193c5b1-84a2-91af-3a23-b584bdf73ac0}
Followup: MachineOwner
---------
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000000, A stack-based buffer has been overrun.
Arg2: 0000000000000000, Address of the trap frame for the exception that caused the bugcheck
Arg3: 0000000000000000, Address of the exception record for the exception that caused the bugcheck
Arg4: 00000000027d86c0, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 0
BUGCHECK_P2: 0
BUGCHECK_P3: 0
BUGCHECK_P4: 27d86c0
TRAP_FRAME: 0000000000000000 -- (.trap 0x0)
EXCEPTION_RECORD: 0000000000000000 -- (.exr 0x0)
Cannot read Exception record @ 0000000000000000
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: c
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x139
PROCESS_NAME: NZXT CAM.exe
CURRENT_IRQL: 2
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 12-30-2019 20:38:34.0460
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff803111c9f5b to fffff803111c14e0
STACK_TEXT:
ffff888f`edfc9d48 fffff803`111c9f5b : 00000000`00000139 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
ffff888f`edfc9d50 fffff803`110ac9e7 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!guard_icall_bugcheck+0x1b
ffff888f`edfc9d80 ffff888f`edfca310 : ffff8d0a`00000000 ffff84c2`4083d440 00000000`00000000 00000000`00000000 : nt!MiWalkPageTablesRecursively+0x1e7
ffff888f`edfc9e40 ffff8d0a`00000000 : ffff84c2`4083d440 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffff888f`edfca310
ffff888f`edfc9e48 ffff84c2`4083d440 : 00000000`00000000 00000000`00000000 00000000`00000000 ffff8d0a`027d9580 : 0xffff8d0a`00000000
ffff888f`edfc9e50 00000000`00000000 : 00000000`00000000 00000000`00000000 ffff8d0a`027d9580 00000000`00000010 : 0xffff84c2`4083d440
THREAD_SHA1_HASH_MOD_FUNC: 67a441eba06f2de57ce16073c13d194e99c769ad
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 4ab725918f063a3ffc707bbf8ae9a4710b386d0f
THREAD_SHA1_HASH_MOD: 2a7ca9d3ab5386d53fea7498e1d81b9c4a4c036b
FOLLOWUP_IP:
nt!guard_icall_bugcheck+1b
fffff803`111c9f5b 90 nop
FAULT_INSTR_CODE: ccccc390
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!guard_icall_bugcheck+1b
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 12dcb470
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1b
FAILURE_BUCKET_ID: 0x139_0_LEGACY_GS_VIOLATION_nt!guard_icall_bugcheck
BUCKET_ID: 0x139_0_LEGACY_GS_VIOLATION_nt!guard_icall_bugcheck
PRIMARY_PROBLEM_CLASS: 0x139_0_LEGACY_GS_VIOLATION_nt!guard_icall_bugcheck
TARGET_TIME: 2019-12-30T16:00:55.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
DPC_WATCHDOG_VIOLATION (133)
The DPC watchdog detected a prolonged run time at an IRQL of DISPATCH_LEVEL
or above.
Arguments:
Arg1: 0000000000000001, The system cumulatively spent an extended period of time at
DISPATCH_LEVEL or above. The offending component can usually be
identified with a stack trace.
Arg2: 0000000000001e00, The watchdog period.
Arg3: fffff8065ab73358, cast to nt!DPC_WATCHDOG_GLOBAL_TRIAGE_BLOCK, which contains
additional information regarding the cumulative timeout
Arg4: 0000000000000000
Debugging Details:
------------------
*************************************************************************
*** ***
*** ***
*** Either you specified an unqualified symbol, or your debugger ***
*** doesn't have full symbol information. Unqualified symbol ***
*** resolution is turned off by default. Please either specify a ***
*** fully qualified symbol module!symbolname, or enable resolution ***
*** of unqualified symbols by typing ".symopt- 100". Note that ***
*** enabling unqualified symbol resolution with network symbol ***
*** server shares in the symbol path may cause the debugger to ***
*** appear to hang for long periods of time when an incorrect ***
*** symbol name is typed or the network symbol server is down. ***
*** ***
*** For some commands to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: TickPeriods ***
*** ***
*************************************************************************
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 1
BUGCHECK_P2: 1e00
BUGCHECK_P3: fffff8065ab73358
BUGCHECK_P4: 0
DPC_TIMEOUT_TYPE: DPC_QUEUE_EXECUTION_TIMEOUT_EXCEEDED
CPU_COUNT: 10
CPU_MHZ: e10
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: c
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0x133
PROCESS_NAME: chrome.exe
CURRENT_IRQL: d
ANALYSIS_SESSION_HOST: DESKTOP-18V31A3
ANALYSIS_SESSION_TIME: 12-31-2019 00:03:26.0921
ANALYSIS_VERSION: 10.0.18362.1 x86fre
LAST_CONTROL_TRANSFER: from fffff8065a7eeac1 to fffff8065a7c14e0
STACK_TEXT:
ffff8381`f6cd8b08 fffff806`5a7eeac1 : 00000000`00000133 00000000`00000001 00000000`00001e00 fffff806`5ab73358 : nt!KeBugCheckEx
ffff8381`f6cd8b10 fffff806`5a61f61c : 00000f92`140a446d ffff8381`f6c80180 00000000`00049fd8 00000000`00049fd8 : nt!KeAccumulateTicks+0x1cc061
ffff8381`f6cd8b70 fffff806`5a55e4b7 : 00000000`00000001 ffff810c`59fc9970 ffff810c`59fc99f0 00000000`00000002 : nt!KeClockInterruptNotify+0x98c
ffff8381`f6cd8f30 fffff806`5a602a25 : 0000000b`0697de3d ffffd681`884d7200 ffffd681`884d72b0 00000000`00000000 : hal!HalpTimerClockInterrupt+0xf7
ffff8381`f6cd8f60 fffff806`5a7c2f7a : ffff810c`59fc99f0 ffffd681`884d7200 00000000`00000001 ffffd681`884d7200 : nt!KiCallInterruptServiceRoutine+0xa5
ffff8381`f6cd8fb0 fffff806`5a7c34e7 : 00000000`e3e315cd ffff810c`59fc99f0 ffffd681`884d7200 fffff806`5a628830 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
ffff810c`59fc9970 fffff806`5a6d16af : 00000000`00000000 00000000`00000000 fffff280`e01e9098 000001c0`3d213000 : nt!KiInterruptDispatchNoLockNoEtw+0x37
ffff810c`59fc9b00 fffff806`5a66e337 : 00000000`00000000 ffffd681`9f4ec580 00000000`00000000 00000000`00000000 : nt!KxWaitForLockChainValid+0x1f
ffff810c`59fc9b30 fffff806`5a6b0a16 : 1a000000`16f34867 1a000000`16f34867 00000000`00000000 fffff806`5a6dea0d : nt!MiSetVaAgeList+0x6a7
ffff810c`59fc9bf0 fffff806`5a6b04c3 : 00000000`00000000 fffffb80`072a2390 000001c0`3d213000 ffffd681`88444098 : nt!MiClearPteAccessed+0x296
ffff810c`59fc9c70 fffff806`5a6aff20 : 00000000`00000000 fffff280`e01e9098 00000000`00000003 00000000`00000000 : nt!MiAgePteWorker+0x1f3
ffff810c`59fc9cd0 fffff806`5a6ac9e7 : 00000000`00000000 ffff810c`59fca310 00000000`00000000 00000000`00000000 : nt!MiAgePte+0x110
ffff810c`59fc9d70 fffff806`5a6acea1 : ffff810c`59fca310 ffff810c`59fca310 00000000`00000000 fffff2f9`40700f48 : nt!MiWalkPageTablesRecursively+0x1e7
ffff810c`59fc9e30 fffff806`5a6acea1 : ffff810c`59fca310 ffff810c`59fca310 ffffd681`00000000 fffff2f9`7ca03800 : nt!MiWalkPageTablesRecursively+0x6a1
ffff810c`59fc9ef0 fffff806`5a6acea1 : ffff810c`59fca310 ffff810c`59fca310 ffffd681`00000000 fffff2f9`7cbe5018 : nt!MiWalkPageTablesRecursively+0x6a1
ffff810c`59fc9fb0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!MiWalkPageTablesRecursively+0x6a1
THREAD_SHA1_HASH_MOD_FUNC: d3dcb6925dbfc5bcef60eaf70b0de1ea9c58c811
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 03911172cbda2b024b52a37cccde53c55b2cb2db
THREAD_SHA1_HASH_MOD: 031da28f25f07b9a32f219cf48a7dc484b865556
FOLLOWUP_IP:
nt!KeAccumulateTicks+1cc061
fffff806`5a7eeac1 cc int 3
FAULT_INSTR_CODE: ab3944cc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!KeAccumulateTicks+1cc061
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 12dcb470
IMAGE_VERSION: 10.0.18362.535
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 1cc061
FAILURE_BUCKET_ID: 0x133_ISR_nt!KeAccumulateTicks
BUCKET_ID: 0x133_ISR_nt!KeAccumulateTicks
PRIMARY_PROBLEM_CLASS: 0x133_ISR_nt!KeAccumulateTicks
TARGET_TIME: 2019-12-30T20:02:08.000Z
OSBUILD: 18362
OSSERVICEPACK: 535
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1980-01-11 18:53:20
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 241d
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x133_isr_nt!keaccumulateticks
FAILURE_ID_HASH: {65350307-c3b9-f4b5-8829-4d27e9ff9b06}
Followup: MachineOwner
---------