SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the bugcheck
Arg2: fffff8076882a2f5, Address of the instruction which caused the bugcheck
Arg3: ffffdc84f3a0cb30, Address of the context record for the exception that caused the bugcheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 14
Key : Analysis.Elapsed.Sec
Value: 57
Key : Analysis.Memory.CommitPeak.Mb
Value: 73
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff8076882a2f5
BUGCHECK_P3: ffffdc84f3a0cb30
BUGCHECK_P4: 0
EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%p adresindeki y nerge 0x%p adresindeki belle e ba vurdu. Bellek u olamaz %s.
FAULTING_IP:
dxgkrnl!DxgkEscape+695
fffff807`6882a2f5 320a xor cl,byte ptr [rdx]
CONTEXT: ffffdc84f3a0cb30 -- (.cxr 0xffffdc84f3a0cb30)
rax=fffff80768930c01 rbx=ffff8f09dcea6000 rcx=ffff8f09dcea6000
rdx=0000000000000000 rsi=ffffb88a138db5a0 rdi=000000f3d17fd490
rip=fffff8076882a2f5 rsp=ffffdc84f3a0d520 rbp=ffffdc84f3a0db80
r8=00000000ffffffff r9=7fff8f09dcea6060 r10=fffff8075b638810
r11=ffffdc84f3a0d4b0 r12=ffffdc84f3a0d8c0 r13=ffffb88a0bef65b0
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl zr na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050246
dxgkrnl!DxgkEscape+0x695:
fffff807`6882a2f5 320a xor cl,byte ptr [rdx] ds:002b:00000000`00000000=??
Resetting default scope
BUGCHECK_STR: 0x3B_c0000005
CPU_COUNT: c
CPU_MHZ: e10
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 8
CPU_STEPPING: 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: RainbowSix.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-HH6FM2D
ANALYSIS_SESSION_TIME: 07-16-2019 15:13:25.0143
ANALYSIS_VERSION: 10.0.18914.1001 amd64fre
MISALIGNED_IP:
dxgkrnl!DxgkEscape+695
fffff807`6882a2f5 320a xor cl,byte ptr [rdx]
LAST_CONTROL_TRANSFER: from fffff8075b7ce118 to fffff8076882a2f5
STACK_TEXT:
ffffdc84`f3a0d520 fffff807`5b7ce118 : ffff8f09`e41ef080 ffff8f09`e41ef080 00000000`00000000 00000000`00000000 : dxgkrnl!DxgkEscape+0x695
ffffdc84`f3a0db00 00007ffc`ba0c4b24 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
000000f3`d17fd1d8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`ba0c4b24
THREAD_SHA1_HASH_MOD_FUNC: 3a2b351e0ad78e6e82cd20535aaae2489e441129
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 30b1a7b3aa0d17b9eff977bf6d9a95438fb228eb
THREAD_SHA1_HASH_MOD: 7c3f789d6a5214d404ab1bf8108e28e878a3dc28
FOLLOWUP_IP:
dxgkrnl!DxgkEscape+695
fffff807`6882a2f5 320a xor cl,byte ptr [rdx]
FAULT_INSTR_CODE: 48000a32
SYMBOL_STACK_INDEX: 0
SYMBOL_NAME: dxgkrnl!DxgkEscape+695
FOLLOWUP_NAME: MachineOwner
IMAGE_NAME: hardware
DEBUG_FLR_IMAGE_TIMESTAMP: 0
IMAGE_VERSION: 10.0.18362.239
STACK_COMMAND: .cxr 0xffffdc84f3a0cb30 ; kb
MODULE_NAME: hardware
FAILURE_BUCKET_ID: IP_MISALIGNED_dxgkrnl.sys
BUCKET_ID: IP_MISALIGNED_dxgkrnl.sys
PRIMARY_PROBLEM_CLASS: IP_MISALIGNED_dxgkrnl.sys
TARGET_TIME: 2019-07-14T11:37:37.000Z
OSBUILD: 18362
OSSERVICEPACK: 239
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1972-02-02 11:33:06
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: e18e
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:ip_misaligned_dxgkrnl.sys
FAILURE_ID_HASH: {4baef1c4-80c9-3ccc-f0ef-4c23adb576f1}
Followup: MachineOwner
---------
ATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY (fc)
An attempt was made to execute non-executable memory. The guilty driver
is on the stack trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on
the bugcheck screen and saved in KiBugCheckDriver.
Arguments:
Arg1: fffff8076443e18e, Virtual address for the attempted execute.
Arg2: 8000000132d11929, PTE contents.
Arg3: ffffcb0ecc1e2760, (reserved)
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
DBGHELP: Timeout to store: https://msdl.microsoft.com/download/symbols
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 11
Key : Analysis.Elapsed.Sec
Value: 61
Key : Analysis.Memory.CommitPeak.Mb
Value: 70
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: fffff8076443e18e
BUGCHECK_P2: 8000000132d11929
BUGCHECK_P3: ffffcb0ecc1e2760
BUGCHECK_P4: 2
CPU_COUNT: c
CPU_MHZ: e10
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 8
CPU_STEPPING: 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: 0xFC
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 2
ANALYSIS_SESSION_HOST: DESKTOP-HH6FM2D
ANALYSIS_SESSION_TIME: 07-16-2019 15:09:59.0326
ANALYSIS_VERSION: 10.0.18914.1001 amd64fre
TRAP_FRAME: ffffcb0ecc1e2760 -- (.trap 0xffffcb0ecc1e2760)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=b85b794dce490000
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8076443e18e rsp=ffffcb0ecc1e28f0 rbp=ffffcb0ecc1e2b80
r8=0000000100000047 r9=000000010000002c r10=0000fffff80764cd
r11=ffffcb0ecc1e2780 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
fffff807`6443e18e 0000 add byte ptr [rax],al ds:00000000`00000000=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80764e554bc to fffff80764dbc900
STACK_TEXT:
ffffcb0e`cc1e2478 fffff807`64e554bc : 00000000`000000fc fffff807`6443e18e 80000001`32d11929 ffffcb0e`cc1e2760 : nt!KeBugCheckEx
ffffcb0e`cc1e2480 fffff807`64c0d718 : fffff807`6443e18e ffff9e4f`2793c000 fffff807`65063900 ffffcb0e`cc1e2760 : nt!MiCheckSystemNxFault+0x125330
ffffcb0e`cc1e24c0 fffff807`64c7aaef : 00000000`00000111 00000000`00000011 00000000`00000000 fffff807`6443e18e : nt!MiSystemFault+0x728
ffffcb0e`cc1e25c0 fffff807`64dca920 : 00000000`00000000 ffffa704`da396610 ffffcb0e`cc1e29c0 00000000`00000002 : nt!MmAccessFault+0x34f
ffffcb0e`cc1e2760 fffff807`6443e18e : ffffa704`da7ead80 ffffcb0e`cc1e2b80 ffffa704`db867080 000000ab`a807f2d8 : nt!KiPageFault+0x360
ffffcb0e`cc1e28f0 ffffa704`da7ead80 : ffffcb0e`cc1e2b80 ffffa704`db867080 000000ab`a807f2d8 ffffcb0e`cc1e2934 : 0xfffff807`6443e18e
ffffcb0e`cc1e28f8 ffffcb0e`cc1e2b80 : ffffa704`db867080 000000ab`a807f2d8 ffffcb0e`cc1e2934 00000000`00000001 : 0xffffa704`da7ead80
ffffcb0e`cc1e2900 ffffa704`db867080 : 000000ab`a807f2d8 ffffcb0e`cc1e2934 00000000`00000001 00000000`00000000 : 0xffffcb0e`cc1e2b80
ffffcb0e`cc1e2908 000000ab`a807f2d8 : ffffcb0e`cc1e2934 00000000`00000001 00000000`00000000 00000000`00000001 : 0xffffa704`db867080
ffffcb0e`cc1e2910 ffffcb0e`cc1e2934 : 00000000`00000001 00000000`00000000 00000000`00000001 00000001`00000001 : 0x000000ab`a807f2d8
ffffcb0e`cc1e2918 00000000`00000001 : 00000000`00000000 00000000`00000001 00000001`00000001 ffffcb0e`cc1e29c0 : 0xffffcb0e`cc1e2934
ffffcb0e`cc1e2920 00000000`00000000 : 00000000`00000001 00000001`00000001 ffffcb0e`cc1e29c0 00000000`00000010 : 0x1
THREAD_SHA1_HASH_MOD_FUNC: 5a0c2f5d42fc0fda90aa9ca781303f4405d4eaf1
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: f7d9ba45a7c8d020713bff35bd96d200486a4a06
THREAD_SHA1_HASH_MOD: f08ac56120cad14894587db086f77ce277bfae84
FOLLOWUP_IP:
nt!MiCheckSystemNxFault+125330
fffff807`64e554bc cc int 3
FAULT_INSTR_CODE: 8b4ccccc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!MiCheckSystemNxFault+125330
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
DEBUG_FLR_IMAGE_TIMESTAMP: 3ed0f42
IMAGE_VERSION: 10.0.18362.239
STACK_COMMAND: .thread ; .cxr ; kb
IMAGE_NAME: memory_corruption
BUCKET_ID_FUNC_OFFSET: 125330
FAILURE_BUCKET_ID: 0xFC_nt!MiCheckSystemNxFault
BUCKET_ID: 0xFC_nt!MiCheckSystemNxFault
PRIMARY_PROBLEM_CLASS: 0xFC_nt!MiCheckSystemNxFault
TARGET_TIME: 2019-07-15T20:11:36.000Z
OSBUILD: 18362
OSSERVICEPACK: 239
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1972-02-02 11:33:06
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: efd3
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0xfc_nt!michecksystemnxfault
FAILURE_ID_HASH: {a6ae5288-6b71-974a-9b09-23f14d998164}
Followup: MachineOwner
---------
BAD_SYSTEM_CONFIG_INFO (74)
Can indicate that the SYSTEM hive loaded by the osloader/NTLDR
was corrupt. This is unlikely, since the osloader will check
a hive to make sure it isn't corrupt after loading it.
It can also indicate that some critical registry keys and values
are not present. (i.e. somebody used regedt32 to delete something
that they shouldn't have) Booting from LastKnownGood may fix
the problem, but if someone is persistent enough in mucking with
the registry they will need to reinstall or use the Emergency
Repair Disk.
Arguments:
Arg1: 0000000000000002, (reserved)
Arg2: ffffe70c13bdba70, (reserved)
Arg3: 0000000000000002, (reserved)
Arg4: ffffffffc000014c, usually the NT status code.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 2
Key : Analysis.Elapsed.Sec
Value: 3
Key : Analysis.Memory.CommitPeak.Mb
Value: 68
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 2
BUGCHECK_P2: ffffe70c13bdba70
BUGCHECK_P3: 2
BUGCHECK_P4: ffffffffc000014c
ERROR_CODE: (NTSTATUS) 0xc000014c - {Kay t Defteri Bozuk} Kay t Defteri verilerini i eren dosyalardan birinin yap s bozuk veya dosyan n bellekteki g r nt s bozuk veya dosya, bir di er kopyas veya g nl bulunmad ndan veya bozuk oldu undan kurtar lamad .
BUGCHECK_STR: 0x74_2_c000014c
CPU_COUNT: c
CPU_MHZ: e10
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 8
CPU_STEPPING: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: Registry
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-HH6FM2D
ANALYSIS_SESSION_TIME: 07-16-2019 15:09:56.0766
ANALYSIS_VERSION: 10.0.18914.1001 amd64fre
LAST_CONTROL_TRANSFER: from fffff8027280f082 to fffff802721bc900
STACK_TEXT:
ffffe70c`13bdb9a8 fffff802`7280f082 : 00000000`00000074 00000000`00000002 ffffe70c`13bdba70 00000000`00000002 : nt!KeBugCheckEx
ffffe70c`13bdb9b0 fffff802`7212f725 : ffffc00b`153e8080 ffffc00b`153e8080 fffff802`727490f0 00000000`00000002 : nt!CmpLoadHiveThread+0xc5f92
ffffe70c`13bdbc10 fffff802`721c3e6a : ffffad01`6298b180 ffffc00b`153e8080 fffff802`7212f6d0 ffffc00b`14f6aa70 : nt!PspSystemThreadStartup+0x55
ffffe70c`13bdbc60 00000000`00000000 : ffffe70c`13bdc000 ffffe70c`13bd6000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x2a
THREAD_SHA1_HASH_MOD_FUNC: 4ea5d1b08bfdd843cc46e9ec8edba00d0b2ed432
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: adc79264a5451ad6a29988fb780418862f2051b7
THREAD_SHA1_HASH_MOD: d084f7dfa548ce4e51810e4fd5914176ebc66791
FOLLOWUP_IP:
nt!CmpLoadHiveThread+c5f92
fffff802`7280f082 cc int 3
FAULT_INSTR_CODE: 10bfcc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!CmpLoadHiveThread+c5f92
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 3ed0f42
IMAGE_VERSION: 10.0.18362.239
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: c5f92
FAILURE_BUCKET_ID: 0x74_2_c000014c_nt!CmpLoadHiveThread
BUCKET_ID: 0x74_2_c000014c_nt!CmpLoadHiveThread
PRIMARY_PROBLEM_CLASS: 0x74_2_c000014c_nt!CmpLoadHiveThread
TARGET_TIME: 2019-07-14T08:46:05.000Z
OSBUILD: 18362
OSSERVICEPACK: 239
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1972-02-02 11:33:06
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: f4f
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x74_2_c000014c_nt!cmploadhivethread
FAILURE_ID_HASH: {635f2983-bece-5263-565c-834f3be7c2f2}
Followup: MachineOwner
---------
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except.
Typically the address is just plain bad or it is pointing at freed memory.
Arguments:
Arg1: fffffffffffffbd4, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80681460c60, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 9
Key : Analysis.Elapsed.Sec
Value: 13
Key : Analysis.Memory.CommitPeak.Mb
Value: 70
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: fffffffffffffbd4
BUGCHECK_P2: 0
BUGCHECK_P3: fffff80681460c60
BUGCHECK_P4: 2
READ_ADDRESS: fffff8068136e3b0: Unable to get MiVisibleState
Unable to get NonPagedPoolStart
Unable to get NonPagedPoolEnd
Unable to get PagedPoolStart
Unable to get PagedPoolEnd
unable to get nt!MmSpecialPagesInUse
fffffffffffffbd4
FAULTING_IP:
nt!PsQueryStatisticsProcess+d0
fffff806`81460c60 03aed4fbffff add ebp,dword ptr [rsi-42Ch]
MM_INTERNAL_CODE: 2
CPU_COUNT: c
CPU_MHZ: e10
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 8
CPU_STEPPING: 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: Steam.exe
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-HH6FM2D
ANALYSIS_SESSION_TIME: 07-16-2019 15:10:01.0675
ANALYSIS_VERSION: 10.0.18914.1001 amd64fre
TRAP_FRAME: ffffcb09cdb24fa0 -- (.trap 0xffffcb09cdb24fa0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffcd0f7595fd60 rbx=0000000000000000 rcx=ffffb98184980180
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80681460c60 rsp=ffffcb09cdb25130 rbp=000000000000000e
r8=0000000000000000 r9=00000000000001f0 r10=0000000000000184
r11=ffffe28083877e80 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz ac pe cy
nt!PsQueryStatisticsProcess+0xd0:
fffff806`81460c60 03aed4fbffff add ebp,dword ptr [rsi-42Ch] ds:ffffffff`fffffbd4=????????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80680fdfed4 to fffff80680fbc900
STACK_TEXT:
ffffcb09`cdb24cf8 fffff806`80fdfed4 : 00000000`00000050 ffffffff`fffffbd4 00000000`00000000 ffffcb09`cdb24fa0 : nt!KeBugCheckEx
ffffcb09`cdb24d00 fffff806`80e7aaef : 00000000`00000000 00000000`00000000 00000000`00000000 ffffffff`fffffbd4 : nt!MiSystemFault+0x1d2ee4
ffffcb09`cdb24e00 fffff806`80fca920 : 00000000`000000ff 00000000`0000002a ffffcd0f`79d14508 00000000`00000150 : nt!MmAccessFault+0x34f
ffffcb09`cdb24fa0 fffff806`81460c60 : ffffcb09`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiPageFault+0x360
ffffcb09`cdb25130 fffff806`81460aa4 : ffffcd0f`7b90e080 00000000`00000000 ffffe280`83877b40 00000005`00000005 : nt!PsQueryStatisticsProcess+0xd0
ffffcb09`cdb251a0 fffff806`813f215a : 00000000`00000001 00000000`1184a548 ffffcd0f`79d14080 fffff806`81233980 : nt!ExpCopyProcessInfo+0x274
ffffcb09`cdb25240 fffff806`813e40b8 : 00000000`09c0e6c0 00000000`00044400 00000000`09c0e6b0 00000000`00000000 : nt!ExpGetProcessInformation+0x9ca
ffffcb09`cdb258b0 fffff806`813e377b : 00000000`165dc901 00000000`00000000 00000000`ffffffff 00000000`00010000 : nt!ExpQuerySystemInformation+0x818
ffffcb09`cdb25ac0 fffff806`80fce118 : ffffcd0f`7b90e080 ffffcb09`cdb25b80 ffffcb09`cdb25b80 ffffffff`ff676980 : nt!NtQuerySystemInformation+0x2b
ffffcb09`cdb25b00 00007ffe`a135c724 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`09c0e2b8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`a135c724
THREAD_SHA1_HASH_MOD_FUNC: c93e45bb7ea27a58536ecd79217c1c11ac4886fb
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: e854da1ff3cb7978ac68cbf2acf889e3443aa036
THREAD_SHA1_HASH_MOD: bc100a5647b828107ac4e18055e00abcbe1ec406
FOLLOWUP_IP:
nt!PsQueryStatisticsProcess+d0
fffff806`81460c60 03aed4fbffff add ebp,dword ptr [rsi-42Ch]
FAULT_INSTR_CODE: fbd4ae03
SYMBOL_STACK_INDEX: 4
SYMBOL_NAME: nt!PsQueryStatisticsProcess+d0
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 3ed0f42
IMAGE_VERSION: 10.0.18362.239
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: d0
FAILURE_BUCKET_ID: AV_R_INVALID_nt!PsQueryStatisticsProcess
BUCKET_ID: AV_R_INVALID_nt!PsQueryStatisticsProcess
PRIMARY_PROBLEM_CLASS: AV_R_INVALID_nt!PsQueryStatisticsProcess
TARGET_TIME: 2019-07-15T16:26:16.000Z
OSBUILD: 18362
OSSERVICEPACK: 239
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1972-02-02 11:33:06
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 32f4
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:av_r_invalid_nt!psquerystatisticsprocess
FAILURE_ID_HASH: {3f41bc41-95dc-0efd-2b3e-aa8c85eb6516}
Followup: MachineOwner
---------
BAD_SYSTEM_CONFIG_INFO (74)
Can indicate that the SYSTEM hive loaded by the osloader/NTLDR
was corrupt. This is unlikely, since the osloader will check
a hive to make sure it isn't corrupt after loading it.
It can also indicate that some critical registry keys and values
are not present. (i.e. somebody used regedt32 to delete something
that they shouldn't have) Booting from LastKnownGood may fix
the problem, but if someone is persistent enough in mucking with
the registry they will need to reinstall or use the Emergency
Repair Disk.
Arguments:
Arg1: 0000000000000002, (reserved)
Arg2: fffff280a45e9a70, (reserved)
Arg3: 0000000000000002, (reserved)
Arg4: ffffffffc000014c, usually the NT status code.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.Sec
Value: 2
Key : Analysis.Elapsed.Sec
Value: 6
Key : Analysis.Memory.CommitPeak.Mb
Value: 68
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 2
BUGCHECK_P2: fffff280a45e9a70
BUGCHECK_P3: 2
BUGCHECK_P4: ffffffffc000014c
ERROR_CODE: (NTSTATUS) 0xc000014c - {Kay t Defteri Bozuk} Kay t Defteri verilerini i eren dosyalardan birinin yap s bozuk veya dosyan n bellekteki g r nt s bozuk veya dosya, bir di er kopyas veya g nl bulunmad ndan veya bozuk oldu undan kurtar lamad .
BUGCHECK_STR: 0x74_2_c000014c
CPU_COUNT: c
CPU_MHZ: e10
CPU_VENDOR: AuthenticAMD
CPU_FAMILY: 17
CPU_MODEL: 8
CPU_STEPPING: 2
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
PROCESS_NAME: Registry
CURRENT_IRQL: 0
ANALYSIS_SESSION_HOST: DESKTOP-HH6FM2D
ANALYSIS_SESSION_TIME: 07-16-2019 15:09:53.0861
ANALYSIS_VERSION: 10.0.18914.1001 amd64fre
LAST_CONTROL_TRANSFER: from fffff80440c0f082 to fffff804405bc900
STACK_TEXT:
fffff280`a45e99a8 fffff804`40c0f082 : 00000000`00000074 00000000`00000002 fffff280`a45e9a70 00000000`00000002 : nt!KeBugCheckEx
fffff280`a45e99b0 fffff804`4052f725 : ffffdc0d`b71e9080 ffffdc0d`b71e9080 fffff804`40b490f0 00000000`00000002 : nt!CmpLoadHiveThread+0xc5f92
fffff280`a45e9c10 fffff804`405c3e6a : ffff8a00`abb84180 ffffdc0d`b71e9080 fffff804`4052f6d0 ffffdc0d`b6d76790 : nt!PspSystemThreadStartup+0x55
fffff280`a45e9c60 00000000`00000000 : fffff280`a45ea000 fffff280`a45e4000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x2a
THREAD_SHA1_HASH_MOD_FUNC: 4ea5d1b08bfdd843cc46e9ec8edba00d0b2ed432
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: adc79264a5451ad6a29988fb780418862f2051b7
THREAD_SHA1_HASH_MOD: d084f7dfa548ce4e51810e4fd5914176ebc66791
FOLLOWUP_IP:
nt!CmpLoadHiveThread+c5f92
fffff804`40c0f082 cc int 3
FAULT_INSTR_CODE: 10bfcc
SYMBOL_STACK_INDEX: 1
SYMBOL_NAME: nt!CmpLoadHiveThread+c5f92
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
DEBUG_FLR_IMAGE_TIMESTAMP: 3ed0f42
IMAGE_VERSION: 10.0.18362.239
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: c5f92
FAILURE_BUCKET_ID: 0x74_2_c000014c_nt!CmpLoadHiveThread
BUCKET_ID: 0x74_2_c000014c_nt!CmpLoadHiveThread
PRIMARY_PROBLEM_CLASS: 0x74_2_c000014c_nt!CmpLoadHiveThread
TARGET_TIME: 2019-07-16T10:06:53.000Z
OSBUILD: 18362
OSSERVICEPACK: 239
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: 1972-02-02 11:33:06
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 1ab1
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x74_2_c000014c_nt!cmploadhivethread
FAILURE_ID_HASH: {635f2983-bece-5263-565c-834f3be7c2f2}
Followup: MachineOwner
---------
