*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000002, Stack cookie instrumentation code detected a stack-based
buffer overrun.
Arg2: ffffc508103aa3b0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffc508103aa308, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 11296
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-J7A11VA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 33959
Key : Analysis.Memory.CommitPeak.Mb
Value: 82
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 139
BUGCHECK_P1: 2
BUGCHECK_P2: ffffc508103aa3b0
BUGCHECK_P3: ffffc508103aa308
BUGCHECK_P4: 0
TRAP_FRAME: ffffc508103aa3b0 -- (.trap 0xffffc508103aa3b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000103 rbx=0000000000000000 rcx=0000000000000002
rdx=ffff87893aba0b20 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80610431655 rsp=ffffc508103aa548 rbp=0000000000000004
r8=ffff87893aba0b20 r9=0000000000000000 r10=ffff878931c20cc0
r11=ffff87893b5d3c40 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz ac po cy
Ntfs!_report_gsfailure+0x5:
fffff806`10431655 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffc508103aa308 -- (.exr 0xffffc508103aa308)
ExceptionAddress: fffff80610431655 (Ntfs!_report_gsfailure+0x0000000000000005)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000002
Subcode: 0x2 FAST_FAIL_STACK_COOKIE_CHECK_FAILURE
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: MsMpEng.exe
WATSON_BKT_EVENT: BEX
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000002
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffffc508`103aa088 fffff806`0b406569 : 00000000`00000139 00000000`00000002 ffffc508`103aa3b0 ffffc508`103aa308 : nt!KeBugCheckEx
ffffc508`103aa090 fffff806`0b406990 : ffff8789`3998d080 00000000`00000004 ffffb28b`00000003 fffff806`0b2c73a2 : nt!KiBugCheckDispatch+0x69
ffffc508`103aa1d0 fffff806`0b404d23 : 00000000`00000000 ffffb28b`0ce8feb0 ffff8789`3b5d3c80 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffffc508`103aa3b0 fffff806`10431655 : fffff806`104de8e0 ffff8789`3b5d3c48 00000000`00000000 ffffc508`00000103 : nt!KiRaiseSecurityCheckFailure+0x323
ffffc508`103aa548 fffff806`104de8e0 : ffff8789`3b5d3c48 00000000`00000000 ffffc508`00000103 ffff8789`00000000 : Ntfs!_report_gsfailure+0x5
ffffc508`103aa550 fffff806`104de45d : ffff8789`3b5d3c48 00000000`00000001 00000000`00000000 00000000`00000000 : Ntfs!NtfsUserFsRequest+0x160
ffffc508`103aa5d0 fffff806`0b2cd805 : ffff8789`3b3e46e0 fffff806`0a0a4b46 ffff8789`38f22a20 ffffc508`103a5000 : Ntfs!NtfsFsdFileSystemControl+0x17d
ffffc508`103aa6f0 fffff806`0a0a6ccf : 00000000`00000000 00000000`00000000 00000000`0000009b 00000006`00000000 : nt!IofCallDriver+0x55
ffffc508`103aa730 fffff806`0a0dcaf4 : ffffc508`103aa7c0 00000000`00000000 00000000`000000e0 ffff8789`31069580 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x28f
ffffc508`103aa7a0 fffff806`0b2cd805 : 00000000`0000000a ffff8789`38f22a20 00000000`00000002 00000000`00000001 : FLTMGR!FltpFsControl+0x104
ffffc508`103aa800 fffff806`0b6c2528 : ffff8789`38f22a20 00000000`00000000 00000000`00000000 ffff8789`3998d080 : nt!IofCallDriver+0x55
ffffc508`103aa840 fffff806`0b6c1df5 : 00000000`00090240 ffffc508`103aab80 00000000`00040005 ffffc508`103aab80 : nt!IopSynchronousServiceTail+0x1a8
ffffc508`103aa8e0 fffff806`0b66c486 : 00000000`00000000 00000000`00000000 00000000`00000000 00007ffd`248245d8 : nt!IopXxxControlFile+0x5e5
ffffc508`103aaa20 fffff806`0b405fb8 : 00000000`00000000 fffff806`0b656af7 00000000`00000000 00000000`00000000 : nt!NtFsControlFile+0x56
ffffc508`103aaa90 00007ffd`3ca2c4b4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
0000001c`1857f2c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`3ca2c4b4
SYMBOL_NAME: nt!KiFastFailDispatch+d0
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.572
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: 0x139_MISSING_GSFRAME_nt!KiFastFailDispatch
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {1971a9b0-b7ec-89bf-0a51-10ac52818da5}
Followup: MachineOwner
---------
