Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\CsHay\AppData\Local\Temp\Rar$DIa1616.27149\102620-6406-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff800`16800000 PsLoadedModuleList = 0xfffff800`1742a310
Debug session time: Mon Oct 26 15:24:58.569 2020 (UTC + 3:00)
System Uptime: 5 days 3:04:46.531
Loading Kernel Symbols
...............................................................
................................................................
.......................................................
Loading User Symbols
Loading unloaded module list
..............................................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff800`16bf45a0 48894c2408 mov qword ptr [rsp+8],rcx ss:fffff800`1a279c90=0000000000000101
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
CLOCK_WATCHDOG_TIMEOUT (101)
An expected clock interrupt was not received on a secondary processor in an
MP system within the allocated interval. This indicates that the specified
processor is hung and not processing interrupts.
Arguments:
Arg1: 0000000000000010, Clock interrupt time out interval in nominal clock ticks.
Arg2: 0000000000000000, 0.
Arg3: ffffa20136bd5180, The PRCB address of the hung processor.
Arg4: 0000000000000003, The index of the hung processor.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4483
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-IPC9T25
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 12944
Key : Analysis.Memory.CommitPeak.Mb
Value: 76
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 101
BUGCHECK_P1: 10
BUGCHECK_P2: 0
BUGCHECK_P3: ffffa20136bd5180
BUGCHECK_P4: 3
FAULTING_PROCESSOR: 3
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: steamwebhelper.exe
STACK_TEXT:
fffff800`1a279c88 fffff800`16c87988 : 00000000`00000101 00000000`00000010 00000000`00000000 ffffa201`36bd5180 : nt!KeBugCheckEx
fffff800`1a279c90 fffff800`16b2b7cd : 00000000`00000000 fffff800`12326180 00000000`00000246 00000000`01b0b3a2 : nt!KeAccumulateTicks+0x15dc98
fffff800`1a279cf0 fffff800`16b2bd71 : 00000000`01b0b100 00000000`0101e909 fffff800`12326180 00000000`00000001 : nt!KiUpdateRunTime+0x5d
fffff800`1a279d40 fffff800`16b26823 : fffff800`12326180 00000000`00000000 fffff800`17431960 00000000`00000000 : nt!KiUpdateTime+0x4a1
fffff800`1a279e80 fffff800`16b2e382 : ffff8380`5900bfc0 ffff8380`5900c040 ffff8380`5900c000 00000000`0000000c : nt!KeClockInterruptNotify+0x2e3
fffff800`1a279f30 fffff800`16a2ecd5 : 00000407`a85e6889 fffff800`174f39e0 fffff800`174f3a90 00000000`00000000 : nt!HalpTimerClockInterrupt+0xe2
fffff800`1a279f60 fffff800`16bf604a : ffff8380`5900c040 fffff800`174f39e0 00000000`00000001 00000000`00000000 : nt!KiCallInterruptServiceRoutine+0xa5
fffff800`1a279fb0 fffff800`16bf65b7 : ffff8380`5900c1b0 fffff800`17523080 00000000`00000086 fffff800`16bf6644 : nt!KiInterruptSubDispatchNoLockNoEtw+0xfa
ffff8380`5900bfc0 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiInterruptDispatchNoLockNoEtw+0x37
SYMBOL_NAME: nt!KeAccumulateTicks+15dc98
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.572
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 15dc98
FAILURE_BUCKET_ID: CLOCK_WATCHDOG_TIMEOUT_INVALID_CONTEXT_nt!KeAccumulateTicks
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {95498f51-33a9-903b-59e5-d236937d8ecf}
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\CsHay\AppData\Local\Temp\Rar$DIa1616.41213\102620-5437-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff803`48800000 PsLoadedModuleList = 0xfffff803`4942a310
Debug session time: Mon Oct 26 19:17:15.296 2020 (UTC + 3:00)
System Uptime: 0 days 3:23:27.503
Loading Kernel Symbols
...............................................................
................................................................
........................................................
Loading User Symbols
Loading unloaded module list
.........
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff803`48bf45a0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff08b`c0ca74b0=0000000000000139
10: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffff08bc0ca77d0, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffff08bc0ca7728, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3546
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-IPC9T25
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 12274
Key : Analysis.Memory.CommitPeak.Mb
Value: 75
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: fffff08bc0ca77d0
BUGCHECK_P3: fffff08bc0ca7728
BUGCHECK_P4: 0
TRAP_FRAME: fffff08bc0ca77d0 -- (.trap 0xfffff08bc0ca77d0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=fffff80346102ea8 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffbe02e2a881a0 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80348c1b161 rsp=fffff08bc0ca7960 rbp=000000000000000f
r8=0000000000000000 r9=fffff08bc0ca7a50 r10=fffff80346102ac0
r11=0000001c6c3d2f5e r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po nc
nt!KiRemoveEntryTimer+0x208f31:
fffff803`48c1b161 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: fffff08bc0ca7728 -- (.exr 0xfffff08bc0ca7728)
ExceptionAddress: fffff80348c1b161 (nt!KiRemoveEntryTimer+0x0000000000208f31)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
fffff08b`c0ca74a8 fffff803`48c06569 : 00000000`00000139 00000000`00000003 fffff08b`c0ca77d0 fffff08b`c0ca7728 : nt!KeBugCheckEx
fffff08b`c0ca74b0 fffff803`48c06990 : 00000000`00000000 00000000`00000800 00000000`00000000 fffff803`49423b50 : nt!KiBugCheckDispatch+0x69
fffff08b`c0ca75f0 fffff803`48c04d23 : 00000000`00000000 ffffbe02`d7d13100 00000000`00000001 00000000`00989680 : nt!KiFastFailDispatch+0xd0
fffff08b`c0ca77d0 fffff803`48c1b161 : ffffbe02`dc788010 0000001c`6c3d0851 ffffffff`00000001 ffffbe02`dc7881f8 : nt!KiRaiseSecurityCheckFailure+0x323
fffff08b`c0ca7960 fffff803`48ae4f2e : 00000000`00000000 00000000`00000000 00000000`00140001 fffff08b`c0ca7a50 : nt!KiRemoveEntryTimer+0x208f31
fffff08b`c0ca79d0 fffff803`48bf810e : ffffffff`00000000 ffffa980`88b36180 ffffa980`88b41340 ffffbe02`de842380 : nt!KiRetireDpcList+0x99e
fffff08b`c0ca7c60 00000000`00000000 : fffff08b`c0ca8000 fffff08b`c0ca2000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x9e
SYMBOL_NAME: nt!KiRemoveEntryTimer+208f31
MODULE_NAME: nt
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.572
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 208f31
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiRemoveEntryTimer
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {5cf1a79f-75db-1c81-82ec-116a11522249}
Followup: MachineOwner
---------
Microsoft (R) Windows Debugger Version 10.0.20153.1000 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.
Loading Dump File [C:\Users\CsHay\AppData\Local\Temp\Rar$DIa1616.2538\102120-6265-01.dmp]
Mini Kernel Dump File: Only registers and stack trace are available
************* Path validation summary **************
Response Time (ms) Location
Deferred srv*
Symbol search path is: srv*
Executable search path is:
Windows 10 Kernel Version 19041 MP (12 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Edition build lab: 19041.1.amd64fre.vb_release.191206-1406
Machine Name:
Kernel base = 0xfffff806`24200000 PsLoadedModuleList = 0xfffff806`24e2a310
Debug session time: Wed Oct 21 11:39:06.245 2020 (UTC + 3:00)
System Uptime: 2 days 19:54:58.845
Loading Kernel Symbols
...............................................................
................................................................
.......................................................
Loading User Symbols
Loading unloaded module list
.......................
For analysis of this file, run !analyze -v
nt!KeBugCheckEx:
fffff806`245f45a0 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:ffffd40f`8abe93c0=000000000000001a
9: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
MEMORY_MANAGEMENT (1a)
# Any other values for parameter 1 must be individually examined.
Arguments:
Arg1: 0000000000041792, A corrupt PTE has been detected. Parameter 2 contains the address of
the PTE. Parameters 3/4 contain the low/high parts of the PTE.
Arg2: ffffd8810b81b1f0
Arg3: 2000000000000000
Arg4: 0000000000000000
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3359
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-IPC9T25
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 7209
Key : Analysis.Memory.CommitPeak.Mb
Value: 76
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 1a
BUGCHECK_P1: 41792
BUGCHECK_P2: ffffd8810b81b1f0
BUGCHECK_P3: 2000000000000000
BUGCHECK_P4: 0
MEMORY_CORRUPTOR: ONE_BIT
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: csrss.exe
STACK_TEXT:
ffffd40f`8abe93b8 fffff806`2454c03a : 00000000`0000001a 00000000`00041792 ffffd881`0b81b1f0 20000000`00000000 : nt!KeBugCheckEx
ffffd40f`8abe93c0 fffff806`2454a86f : ffff8984`6e30b700 00000000`00000000 00000000`00000002 00000000`00000000 : nt!MiDeleteVa+0x153a
ffffd40f`8abe94c0 fffff806`24522ae0 : 00000000`00000001 ffffd40f`00000000 ffff8984`6e30b550 ffff8984`6f278080 : nt!MiDeletePagablePteRange+0x48f
ffffd40f`8abe97d0 fffff806`24904aa9 : 00000000`00000000 00000000`00000000 00007ffa`00000000 00000000`00000000 : nt!MiDeleteVad+0x360
ffffd40f`8abe98e0 fffff806`24904882 : ffff8984`72dbd700 00000000`00000000 ffff8984`6e30b080 00000000`00000000 : nt!MiUnmapVad+0x49
ffffd40f`8abe9910 fffff806`24904569 : ffffda04`0a0cd810 fffff806`244db31e ffff8984`6f278080 ffffda04`0a0cd810 : nt!MiUnmapViewOfSection+0x152
ffffd40f`8abe99f0 fffff806`248d502a : ffffda04`0a0cd810 ffffda04`0a0cd810 ffffd40f`8abe9b80 00000000`00000000 : nt!AlpcViewDestroyProcedure+0xf9
ffffd40f`8abe9a60 fffff806`24808cd4 : 00000000`00000000 ffffda04`0a0cd810 00000000`00000000 00000000`00000000 : nt!AlpcpDereferenceBlobEx+0x5a
ffffd40f`8abe9aa0 fffff806`24605fb8 : ffff8984`6f278080 00000000`00000000 ffffd40f`8abe9b80 ffff8984`70dd6340 : nt!NtAlpcDeleteSectionView+0xe4
ffffd40f`8abe9b00 00007ffa`f556cdc4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
0000005e`957bf3c8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffa`f556cdc4
MODULE_NAME: hardware
IMAGE_NAME: memory_corruption
STACK_COMMAND: .thread ; .cxr ; kb
FAILURE_BUCKET_ID: MEMORY_CORRUPTION_ONE_BIT
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e3faf315-c3d0-81db-819a-6c43d23c63a7}
Followup: MachineOwner
---------