Loading Dump File [C:\Users\CsHay\AppData\Local\Temp\Rar$DIa17832.49331\101420-46437-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (8 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS Personal
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff800`6fc00000 PsLoadedModuleList = 0xfffff800`7082a310
Debug session time: Wed Oct 14 22:16:30.726 2020 (UTC + 3:00)
System Uptime: 0 days 2:18:04.399
Loading Kernel Symbols
...............................................................
................................................................
................................................................
.........................
Loading User Symbols
Loading unloaded module list
........................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff800`6fff45a0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffde02`d5c16f60=0000000000000139
6: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffde02d5c17280, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffde02d5c171d8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4702
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-IPC9T25
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 32001
Key : Analysis.Memory.CommitPeak.Mb
Value: 78
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffffde02d5c17280
BUGCHECK_P3: ffffde02d5c171d8
BUGCHECK_P4: 0
TRAP_FRAME: ffffde02d5c17280 -- (.trap 0xffffde02d5c17280)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffab0ff15c6370 rbx=0000000000000000 rcx=0000000000000003
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8006fec51ad rsp=ffffde02d5c17410 rbp=ffffab0fef8c3080
r8=0000000000000001 r9=0000000000000002 r10=ffffab0fe6e03000
r11=ffff8001b2200180 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe cy
nt!KiExitDispatcher+0x1ad:
fffff800`6fec51ad cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffde02d5c171d8 -- (.exr 0xffffde02d5c171d8)
ExceptionAddress: fffff8006fec51ad (nt!KiExitDispatcher+0x00000000000001ad)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffffde02`d5c16f58 fffff800`70006569 : 00000000`00000139 00000000`00000003 ffffde02`d5c17280 ffffde02`d5c171d8 : nt!KeBugCheckEx
ffffde02`d5c16f60 fffff800`70006990 : 00000000`00000000 fffff800`6fe69e80 00000000`000000ff 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffde02`d5c170a0 fffff800`70004d23 : 00000000`000000ff 00000000`00000000 00000000`00000000 55555555`55555555 : nt!KiFastFailDispatch+0xd0
ffffde02`d5c17280 fffff800`6fec51ad : 00000000`00000000 ffffde02`d5c174c1 ffffab0f`fd518000 fffff800`00000000 : nt!KiRaiseSecurityCheckFailure+0x323
ffffde02`d5c17410 fffff800`6fe10671 : ffff8001`b2200180 00000000`00000000 ffff8001`b2200101 fffff800`705b1094 : nt!KiExitDispatcher+0x1ad
ffffde02`d5c17480 fffff800`cf9742f2 : 00000000`00000200 ffffab0f`fd1f6728 ffff958b`21fe4050 fffff800`00000002 : nt!KeInsertQueueApc+0x151
ffffde02`d5c17520 00000000`00000200 : ffffab0f`fd1f6728 ffff958b`21fe4050 fffff800`00000002 00000000`00000000 : BEDaisy+0x3042f2
ffffde02`d5c17528 ffffab0f`fd1f6728 : ffff958b`21fe4050 fffff800`00000002 00000000`00000000 00000000`00000000 : 0x200
ffffde02`d5c17530 ffff958b`21fe4050 : fffff800`00000002 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffab0f`fd1f6728
ffffde02`d5c17538 fffff800`00000002 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffff958b`21fe4050
ffffde02`d5c17540 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 ab0ffe3c`e080ff01 : 0xfffff800`00000002
SYMBOL_NAME: BEDaisy+3042f2
MODULE_NAME: BEDaisy
IMAGE_NAME: BEDaisy.sys
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 3042f2
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_BEDaisy!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {59d8eb10-b2e4-7df6-f6a5-49968226dbb8}
Followup: MachineOwner
---------