New
#11
This is something for myself, so I don't have to look in the dump everytime.
Code:0: kd> !thread ffffe10e6429d080 e THREAD ffffe10e6429d080 Cid 0004.02c8 Teb: 0000000000000000 Win32Thread: 0000000000000000 RUNNING on processor 0 Not impersonating GetUlongFromAddress: unable to read from fffff8016e307924 Owning Process ffffe10e622216c0 Image: System Attached Process N/A Image: N/A fffff78000000000: Unable to get shared data Wait Start TickCount 1589676 Context Switch Count 3 IdealProcessor: 0 ReadMemory error: Cannot get nt!KeMaximumIncrement value. UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!CmpLoadHiveThread (0xfffff8016e559498) Stack Init ffffa980545dbc90 Current ffffa98055548790 Base ffffa980545dc000 Limit ffffa980545d6000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffa980`545db9a8 fffff801`6e60356d nt!KeBugCheckEx ffffa980`545db9b0 fffff801`6e0e4255 nt! ?? ::NNGAKEGL::`string'+0x7a4bd // nt!CmpLoadHiveThread ffffa980`545dbc10 fffff801`6e161576 nt!PspSystemThreadStartup+0x41 ffffa980`545dbc60 00000000`00000000 nt!KiStartSystemThread+0x16
Please try following:
- Open an admin command prompt
- Copy/paste "sfc /scannow" (without quotes) and press enter
- When it is finished reboot your system
- Open again an admin command prompt
- Enter sfc/scannow again
If sfc/scannow says "Windows Resource Protection found corrupt files but was unable to fix some of them" after the second SFC, please upload the cbs.log file located at %systemroot%\Logs\CBS\, if the file is too large try a 3rd party uploader like dropbox, onedrive, google drive, mediafire etc.
System File Check(SFC a.k.a. Windows Resource Protection) needs to have your system rebooted in order for sfc to try to fix the problems that it finds.
Make a photo of SFC and post it.