: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 000000000000001d, An RTL_BALANCED_NODE RBTree entry has been corrupted.
Arg2: ffffb60d4e30f840, Address of the trap frame for the exception that caused the BugCheck
Arg3: ffffb60d4e30f798, Address of the exception record for the exception that caused the BugCheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2186
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 6192
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 405
Key : Analysis.Init.Elapsed.mSec
Value: 13355
Key : Analysis.Memory.CommitPeak.Mb
Value: 86
Key : Bugcheck.Code.DumpHeader
Value: 0x139
Key : Bugcheck.Code.Register
Value: 0x139
Key : Dump.Attributes.AsUlong
Value: 8
Key : Dump.Attributes.KernelGeneratedTriageDump
Value: 1
Key : FailFast.Name
Value: INVALID_BALANCED_TREE
Key : FailFast.Type
Value: 29
FILE_IN_CAB: 041923-35187-01.dmp
DUMP_FILE_ATTRIBUTES: 0x8
Kernel Generated Triage Dump
BUGCHECK_CODE: 139
BUGCHECK_P1: 1d
BUGCHECK_P2: ffffb60d4e30f840
BUGCHECK_P3: ffffb60d4e30f798
BUGCHECK_P4: 0
TRAP_FRAME: ffffb60d4e30f840 -- (.trap 0xffffb60d4e30f840)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff800250db4080 rbx=0000000000000000 rcx=000000000000001d
rdx=ffff800250d94200 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8047dc22259 rsp=ffffb60d4e30f9d8 rbp=0000000000000000
r8=0000000000000000 r9=0000000000000000 r10=0000000000000000
r11=ffff800250db41d8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na pe nc
nt!RtlRbRemoveNode+0x20bfc9:
fffff804`7dc22259 cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffb60d4e30f798 -- (.exr 0xffffb60d4e30f798)
ExceptionAddress: fffff8047dc22259 (nt!RtlRbRemoveNode+0x000000000020bfc9)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 000000000000001d
Subcode: 0x1d FAST_FAIL_INVALID_BALANCED_TREE
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 000000000000001d
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffffb60d`4e30f518 fffff804`7dc0fc29 : 00000000`00000139 00000000`0000001d ffffb60d`4e30f840 ffffb60d`4e30f798 : nt!KeBugCheckEx
ffffb60d`4e30f520 fffff804`7dc10190 : 00000000`00000000 fffff804`7dc03e46 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffb60d`4e30f660 fffff804`7dc0e15d : 00000000`00000000 ffffa601`a7fc4180 ffff8002`5003c040 fffff804`7da1beef : nt!KiFastFailDispatch+0xd0
ffffb60d`4e30f840 fffff804`7dc22259 : ffffb60d`4e30fb10 ffff8002`50d94200 fffff804`a279251c 00000000`00000000 : nt!KiRaiseSecurityCheckFailure+0x31d
ffffb60d`4e30f9d8 fffff804`a279251c : 00000000`00000000 00000000`00000004 00000000`00000000 fffff804`a2797190 : nt!RtlRbRemoveNode+0x20bfc9
ffffb60d`4e30f9f0 fffff804`a2792f29 : 00000000`00000010 00000000`00000016 00000000`00000003 fffff804`a2797150 : mmcss!CiSchedulerWait+0x37c
ffffb60d`4e30fac0 fffff804`7db265f5 : ffff8002`00000030 ffff8002`5003c040 00000000`00000080 fffff804`a2792d50 : mmcss!CiSchedulerThreadFunction+0x1d9
ffffb60d`4e30fb10 fffff804`7dc04848 : ffffa601`a7fc4180 ffff8002`5003c040 fffff804`7db265a0 00000000`00000000 : nt!PspSystemThreadStartup+0x55
ffffb60d`4e30fb60 00000000`00000000 : ffffb60d`4e310000 ffffb60d`4e309000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x28
SYMBOL_NAME: mmcss!CiSchedulerWait+37c
MODULE_NAME: mmcss
IMAGE_NAME: mmcss.sys
IMAGE_VERSION: 10.0.19041.546
STACK_COMMAND: .cxr; .ecxr ; kb
BUCKET_ID_FUNC_OFFSET: 37c
FAILURE_BUCKET_ID: 0x139_1d_INVALID_BALANCED_TREE_mmcss!CiSchedulerWait
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {c5875fdc-2064-6d97-04f6-3d8302607b2b}
Followup: MachineOwner
---------
3: kd> lm
start end module name
fffff58a`a0c40000 fffff58a`a0cdc000 win32k # (pdb symbols) C:\ProgramData\Dbg\sym\win32k.pdb\2C9BC858DFCEC65E3B86BA0B1035CC3E1\win32k.pdb
fffff58a`a0e00000 fffff58a`a11b5000 win32kfull (deferred)
fffff58a`a11c0000 fffff58a`a1209000 cdd (deferred)
fffff58a`a1c40000 fffff58a`a1f10000 win32kbase (deferred)
fffff804`7c7f0000 fffff804`7ca7f000 mcupdate (deferred)
fffff804`7ca80000 fffff804`7ca86000 hal (deferred)
fffff804`7ca90000 fffff804`7ca9b000 kdcom (deferred)
fffff804`7caa0000 fffff804`7cac7000 tm (deferred)
fffff804`7cad0000 fffff804`7cb3e000 CLFS (deferred)
fffff804`7cb40000 fffff804`7cb5a000 PSHED (deferred)
fffff804`7cb60000 fffff804`7cb6b000 BOOTVID (deferred)
fffff804`7cb70000 fffff804`7cbdd000 FLTMGR (deferred)
fffff804`7cbe0000 fffff804`7cbee000 cmimcext (deferred)
fffff804`7d800000 fffff804`7e846000 nt (pdb symbols) C:\ProgramData\Dbg\sym\ntkrnlmp.pdb\B8FF01C16F76A3FCD2F18B47846F48D31\ntkrnlmp.pdb
fffff804`82000000 fffff804`82116000 clipsp (deferred)
fffff804`82120000 fffff804`82149000 ksecdd (deferred)
fffff804`82150000 fffff804`821b3000 msrpc (deferred)
fffff804`821c0000 fffff804`821d1000 werkernel (deferred)
fffff804`821e0000 fffff804`821ec000 ntosext (deferred)
fffff804`821f0000 fffff804`822d8000 CI (deferred)
fffff804`822e0000 fffff804`8239b000 cng (deferred)
fffff804`823a0000 fffff804`82471000 Wdf01000 (deferred)
fffff804`82480000 fffff804`82493000 WDFLDR (deferred)
fffff804`824a0000 fffff804`824af000 SleepStudyHelper (deferred)
fffff804`824b0000 fffff804`824c1000 WppRecorder (deferred)
fffff804`824d0000 fffff804`824f6000 acpiex (deferred)
fffff804`82500000 fffff804`8251a000 SgrmAgent (deferred)
fffff804`82520000 fffff804`825ec000 ACPI (deferred)
fffff804`825f0000 fffff804`825fc000 WMILIB (deferred)
fffff804`82600000 fffff804`8266b000 intelpep (deferred)
fffff804`82670000 fffff804`82687000 WindowsTrustedRT (deferred)
fffff804`82690000 fffff804`8269b000 IntelTA (deferred)
fffff804`826a0000 fffff804`826ab000 WindowsTrustedRTProxy (deferred)
fffff804`826b0000 fffff804`826c4000 pcw (deferred)
fffff804`826d0000 fffff804`826db000 msisadrv (deferred)
fffff804`826e0000 fffff804`82757000 pci (deferred)
fffff804`82760000 fffff804`82775000 vdrvroot (deferred)
fffff804`82780000 fffff804`827af000 pdc (deferred)
fffff804`827b0000 fffff804`827c9000 CEA (deferred)
fffff804`827d0000 fffff804`82801000 partmgr (deferred)
fffff804`82810000 fffff804`828bc000 spaceport (deferred)
fffff804`828c0000 fffff804`828d9000 volmgr (deferred)
fffff804`828e0000 fffff804`82943000 volmgrx (deferred)
fffff804`82950000 fffff804`8296e000 mountmgr (deferred)
fffff804`82970000 fffff804`83508000 iaStorAC (deferred)
fffff804`83510000 fffff804`835c5000 storport (deferred)
fffff804`835d0000 fffff804`835ec000 EhStorClass (deferred)
fffff804`835f0000 fffff804`8360a000 fileinfo (deferred)
fffff804`83610000 fffff804`83650000 Wof (deferred)
fffff804`83660000 fffff804`8366d000 Fs_Rec (deferred)
fffff804`83670000 fffff804`8370c000 NETIO (deferred)
fffff804`83710000 fffff804`83742000 ksecpkg (deferred)
fffff804`83750000 fffff804`83780000 wfplwfs (deferred)
fffff804`837a0000 fffff804`83a76000 Ntfs (deferred)
fffff804`83a80000 fffff804`83bef000 ndis (deferred)
fffff804`83bf0000 fffff804`83ede000 tcpip (deferred)
fffff804`83ee0000 fffff804`83f5f000 fwpkclnt (deferred)
fffff804`83f60000 fffff804`84028000 fvevol (deferred)
fffff804`84030000 fffff804`8403b000 volume (deferred)
fffff804`84040000 fffff804`840ad000 volsnap (deferred)
fffff804`840b0000 fffff804`84100000 rdyboost (deferred)
fffff804`84110000 fffff804`84136000 mup (deferred)
fffff804`84140000 fffff804`84152000 iorate (deferred)
fffff804`84180000 fffff804`8419f000 disk (deferred)
fffff804`841a0000 fffff804`84213000 CLASSPNP (deferred)
fffff804`84800000 fffff804`8487b000 rdbss (deferred)
fffff804`84880000 fffff804`8488a000 gpuenergydrv (deferred)
fffff804`84890000 fffff804`848bc000 dfsc (deferred)
fffff804`848e0000 fffff804`848f7000 bam (deferred)
fffff804`84900000 fffff804`8494e000 ahcache (deferred)
fffff804`84950000 fffff804`84962000 CompositeBus (deferred)
fffff804`84970000 fffff804`8497d000 kdnic (deferred)
fffff804`84980000 fffff804`84995000 umbus (deferred)
fffff804`849a0000 fffff804`849b5000 CAD (deferred)
fffff804`849c0000 fffff804`84aa1000 dxgmms2 (deferred)
fffff804`84ab0000 fffff804`84b30000 cldflt (deferred)
fffff804`84b40000 fffff804`84b5a000 storqosflt (deferred)
fffff804`84b60000 fffff804`84b87000 bindflt (deferred)
fffff804`84bb0000 fffff804`84bc8000 mslldp (deferred)
fffff804`84bd0000 fffff804`84beb000 rspndr (deferred)
fffff804`84bf0000 fffff804`84c08000 lltdio (deferred)
fffff804`84c10000 fffff804`84c2d000 wanarp (deferred)
fffff804`84c30000 fffff804`84c48000 ndisuio (deferred)
fffff804`84c50000 fffff804`84d0f000 nwifi (deferred)
fffff804`84d10000 fffff804`84d66000 msquic (deferred)
fffff804`84d70000 fffff804`84ef7000 HTTP (deferred)
fffff804`84f00000 fffff804`84f12000 condrv (deferred)
fffff804`84f20000 fffff804`84f45000 bowser (deferred)
fffff804`84f50000 fffff804`84f6a000 mpsdrv (deferred)
fffff804`84f70000 fffff804`85004000 mrxsmb (deferred)
fffff804`85010000 fffff804`85055000 mrxsmb20 (deferred)
fffff804`85060000 fffff804`85137000 peauth (deferred)
fffff804`851b0000 fffff804`851ce000 crashdmp (deferred)
fffff804`87600000 fffff804`879a9000 dxgkrnl (deferred)
fffff804`879b0000 fffff804`879c4000 afunix (deferred)
fffff804`879d0000 fffff804`87a77000 afd (deferred)
fffff804`87a80000 fffff804`87a9a000 vwififlt (deferred)
fffff804`87aa0000 fffff804`87acb000 pacer (deferred)
fffff804`87ad0000 fffff804`87ae4000 ndiscap (deferred)
fffff804`87af0000 fffff804`87b04000 netbios (deferred)
fffff804`87b10000 fffff804`87bb1000 Vid (deferred)
fffff804`87bc0000 fffff804`87be1000 winhvr (deferred)
fffff804`87bf0000 fffff804`87c1a000 ViGEmBus (deferred)
fffff804`87c20000 fffff804`887b8000 dump_iaStorAC (deferred)
fffff804`887c0000 fffff804`887d2000 nsiproxy (deferred)
fffff804`887e0000 fffff804`887f0000 mssmbios (deferred)
fffff804`88800000 fffff804`88836000 wcifs (deferred)
fffff804`88840000 fffff804`88870000 cdrom (deferred)
fffff804`88880000 fffff804`88895000 filecrypt (deferred)
fffff804`888a0000 fffff804`888ae000 tbs (deferred)
fffff804`888b0000 fffff804`888ba000 Null (deferred)
fffff804`888c0000 fffff804`888ca000 Beep (deferred)
fffff804`888d0000 fffff804`888e8000 watchdog (deferred)
fffff804`888f0000 fffff804`88906000 BasicDisplay (deferred)
fffff804`88910000 fffff804`88921000 BasicRender (deferred)
fffff804`88930000 fffff804`8894c000 Npfs (deferred)
fffff804`88950000 fffff804`88961000 Msfs (deferred)
fffff804`88970000 fffff804`8898e000 CimFS (deferred)
fffff804`88990000 fffff804`889b2000 tdx (deferred)
fffff804`889c0000 fffff804`889d0000 TDI (deferred)
fffff804`889e0000 fffff804`88a3c000 netbt (deferred)
fffff804`88a40000 fffff804`88a4e000 npsvctrig (deferred)
fffff804`895f0000 fffff804`895fa000 HWiNFO64A (deferred)
fffff804`8fa00000 fffff804`8fa44000 ucx01000 (deferred)
fffff804`8fa50000 fffff804`8fa7e000 iaLPSS2_I2C (deferred)
fffff804`8fa80000 fffff804`8fa9a000 SpbCx (deferred)
fffff804`8fab0000 fffff804`91656000 igdkmd64 (deferred)
fffff804`91660000 fffff804`916ac000 TeeDriverW10x64 (deferred)
fffff804`916b0000 fffff804`91704000 WUDFRd (deferred)
fffff804`91710000 fffff804`9173b000 luafv (deferred)
fffff804`91750000 fffff804`917ee000 USBXHCI (deferred)
fffff804`a2400000 fffff804`a2454000 ibtusb (deferred)
fffff804`a2460000 fffff804`a2481000 BTHUSB (deferred)
fffff804`a2490000 fffff804`a2615000 BTHport (deferred)
fffff804`a2620000 fffff804`a2632000 hidusb (deferred)
fffff804`a2640000 fffff804`a2694000 usbvideo (deferred)
fffff804`a26c0000 fffff804`a26dd000 dump_dumpfve (deferred)
fffff804`a26e0000 fffff804`a26fb000 monitor (deferred)
fffff804`a2700000 fffff804`a2712000 dptf_cpu (deferred)
fffff804`a2720000 fffff804`a2785000 esif_lf (deferred)
fffff804`a2790000 fffff804`a27a4000 mmcss (pdb symbols) C:\ProgramData\Dbg\sym\mmcss.pdb\B94CC0ED20C9FB89FDE094C1341599E41\mmcss.pdb
fffff804`a27b0000 fffff804`a773c000 amdkmdag (deferred)
fffff804`a7740000 fffff804`a7774000 usbccgp (deferred)
fffff804`a7780000 fffff804`a77ea000 RtsUer (deferred)
fffff804`ae600000 fffff804`ae6f2000 wdiwifi (deferred)
fffff804`ae700000 fffff804`ae70e000 vwifibus (deferred)
fffff804`ae710000 fffff804`ae829000 rt640x64 (deferred)
fffff804`ae830000 fffff804`ae851000 i8042prt (deferred)
fffff804`ae860000 fffff804`ae90a000 SynTP (deferred)
fffff804`ae910000 fffff804`ae91e000 USBD (deferred)
fffff804`ae920000 fffff804`ae934000 kbdclass (deferred)
fffff804`ae940000 fffff804`ae953000 mouclass (deferred)
fffff804`ae960000 fffff804`ae987000 HDAudBus (deferred)
fffff804`ae990000 fffff804`ae9f6000 portcls (deferred)
fffff804`aea00000 fffff804`aea21000 drmk (deferred)
fffff804`aea30000 fffff804`aeaa7000 ks (deferred)
fffff804`aeab0000 fffff804`aeac8000 iaLPSS2_GPIO2 (deferred)
fffff804`aead0000 fffff804`aeb02000 msgpioclx (deferred)
fffff804`aeb10000 fffff804`aeb51000 intelppm (deferred)
fffff804`aeb60000 fffff804`aeb6b000 acpipagr (deferred)
fffff804`aeb70000 fffff804`aebb4000 tpm (deferred)
fffff804`aebc0000 fffff804`aebcc000 wmiacpi (deferred)
fffff804`aebd0000 fffff804`aebdf000 CmBatt (deferred)
fffff804`aebe0000 fffff804`aebf0000 BATTC (deferred)
fffff804`aec00000 fffff804`aec16000 HidEventFilter (deferred)
fffff804`aec20000 fffff804`aec2b000 mshidkmdf (deferred)
fffff804`aec30000 fffff804`aec73000 HIDCLASS (deferred)
fffff804`aec80000 fffff804`aec93000 HIDPARSE (deferred)
fffff804`aeca0000 fffff804`aecb3000 dptf_acpi (deferred)
fffff804`aecc0000 fffff804`aeccd000 NdisVirtualBus (deferred)
fffff804`aecd0000 fffff804`aecdc000 swenum (deferred)
fffff804`aece0000 fffff804`aecee000 ScpVBus (deferred)
fffff804`aecf0000 fffff804`aecfe000 rdpbus (deferred)
fffff804`aed00000 fffff804`aed11000 kbdhid (deferred)
fffff804`aed20000 fffff804`aed32000 buttonconverter (deferred)
fffff804`aed40000 fffff804`aede3000 UsbHub3 (deferred)
fffff804`aedf0000 fffff804`af468000 RTKVHD64 (deferred)
fffff804`af470000 fffff804`af47f000 ksthunk (deferred)
fffff804`af480000 fffff804`af490000 mouhid (deferred)
fffff804`af4a0000 fffff804`af4b2000 SynRMIHID (deferred)
fffff804`af4c0000 fffff804`af4cf000 dump_storport (deferred)
fffff804`af4d0000 fffff804`afd61000 Netwtw04 (deferred)
fffff804`afd70000 fffff804`afdc5000 IntcDAud (deferred)
fffff804`afdd0000 fffff804`afde5000 hidi2c (deferred)
fffff804`d0200000 fffff804`d02c7000 srv2 (deferred)
fffff804`d02d0000 fffff804`d02ed000 rassstp (deferred)
fffff804`d02f0000 fffff804`d030d000 NDProxy (deferred)
fffff804`d0310000 fffff804`d0323000 vwifimp (deferred)
fffff804`d0330000 fffff804`d0359000 AgileVpn (deferred)
fffff804`d0360000 fffff804`d0383000 rasl2tp (deferred)
fffff804`d0390000 fffff804`d03b1000 raspptp (deferred)
fffff804`d03c0000 fffff804`d03de000 raspppoe (deferred)
fffff804`d03e0000 fffff804`d03ef000 ndistapi (deferred)
fffff804`d03f0000 fffff804`d042a000 ndiswan (deferred)
fffff804`d0510000 fffff804`d0566000 srvnet (deferred)
fffff804`d0570000 fffff804`d0597000 Ndu (deferred)
fffff804`d05a0000 fffff804`d05b6000 tcpipreg (deferred)
Unloaded modules:
fffff804`d0430000 fffff804`d0443000 MSKSSRV.sys
fffff804`84b90000 fffff804`84ba3000 MSKSSRV.sys
fffff804`851e0000 fffff804`851f0000 dump_storpor
fffff804`88a50000 fffff804`895e9000 dump_iaStorA
fffff804`88820000 fffff804`8883e000 dump_dumpfve
fffff804`af4c0000 fffff804`af4cc000 WdmCompanion
fffff804`91680000 fffff804`916e6000 esif_lf.sys
fffff804`91660000 fffff804`91673000 dptf_cpu.sys
fffff804`916f0000 fffff804`91745000 WUDFRd.sys
fffff804`848c0000 fffff804`848dc000 dam.sys
fffff804`84160000 fffff804`84171000 hwpolicy.sys
3: kd> !sysinfo machineid
Machine ID Information [From Smbios 3.0, DMIVersion 0, Size=5644]
BiosMajorRelease = 1
BiosMinorRelease = 6
BiosVendor = Dell Inc.
BiosVersion = 01.06.00
BiosReleaseDate = 03/23/2017
SystemManufacturer = Dell Inc.
SystemProductName = Inspiron 15-3567
SystemFamily = Inspiron
SystemSKU = 078B
BaseBoardManufacturer = Dell Inc.
BaseBoardProduct = 0D53F5
BaseBoardVersion = A00
drive.google.com
