*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff918b25ca7130, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff918b25ca7088, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for athurx.sys
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3358
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 94749
Key : Analysis.Init.CPU.mSec
Value: 406
Key : Analysis.Init.Elapsed.mSec
Value: 3693
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffff918b25ca7130
BUGCHECK_P3: ffff918b25ca7088
BUGCHECK_P4: 0
TRAP_FRAME: ffff918b25ca7130 -- (.trap 0xffff918b25ca7130)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff800a2d2f2e2c rbx=0000000000000000 rcx=0000000000000003
rdx=ffff800a2d2ecc48 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8047f6f404c rsp=ffff918b25ca72c0 rbp=0000000000000001
r8=000000000000004c r9=0000000000000000 r10=0000000000000000
r11=fffff780000003b0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di pl nz na pe nc
nt!ExInterlockedRemoveHeadList+0x8c:
fffff804`7f6f404c cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffff918b25ca7088 -- (.exr 0xffff918b25ca7088)
ExceptionAddress: fffff8047f6f404c (nt!ExInterlockedRemoveHeadList+0x000000000000008c)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffff918b`25ca6e08 fffff804`7f807b69 : 00000000`00000139 00000000`00000003 ffff918b`25ca7130 ffff918b`25ca7088 : nt!KeBugCheckEx
ffff918b`25ca6e10 fffff804`7f807f90 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffff918b`25ca6f50 fffff804`7f806323 : 00000000`03dfd240 00000000`00000000 ffffce75`0bcb6e1b fffff804`7f75469e : nt!KiFastFailDispatch+0xd0
ffff918b`25ca7130 fffff804`7f6f404c : 00000000`00000000 00000000`00000000 ffff800a`2d2ecc58 ffff800a`2d2ecc48 : nt!KiRaiseSecurityCheckFailure+0x323
ffff918b`25ca72c0 fffff804`87ab54c0 : ffff800a`2ddc0040 00000000`00000080 fffff804`87ab6eb0 00000000`00000000 : nt!ExInterlockedRemoveHeadList+0x8c
ffff918b`25ca72f0 ffff800a`2ddc0040 : 00000000`00000080 fffff804`87ab6eb0 00000000`00000000 00000000`00000000 : athurx+0x54c0
ffff918b`25ca72f8 00000000`00000080 : fffff804`87ab6eb0 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffff800a`2ddc0040
ffff918b`25ca7300 fffff804`87ab6eb0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x80
ffff918b`25ca7308 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff804`87adabf4 : athurx+0x6eb0
SYMBOL_NAME: athurx+54c0
MODULE_NAME: athurx
IMAGE_NAME: athurx.sys
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 54c0
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_athurx!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {cf0b00cb-8b52-be47-e20d-865e290d55f0}
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff8b8f0cde12a0, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff8b8f0cde11f8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3639
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 156150
Key : Analysis.Init.CPU.mSec
Value: 405
Key : Analysis.Init.Elapsed.mSec
Value: 6755
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffff8b8f0cde12a0
BUGCHECK_P3: ffff8b8f0cde11f8
BUGCHECK_P4: 0
TRAP_FRAME: ffff8b8f0cde12a0 -- (.trap 0xffff8b8f0cde12a0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffc88f89f5c045 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffc88f8d6fdc48 rsi=0000000000000000 rdi=0000000000000000
rip=fffff800416f404c rsp=ffff8b8f0cde1430 rbp=0000000000000001
r8=0000000000000014 r9=0000000000000000 r10=0000000000000000
r11=0000000000000010 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di pl nz na po nc
nt!ExInterlockedRemoveHeadList+0x8c:
fffff800`416f404c cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffff8b8f0cde11f8 -- (.exr 0xffff8b8f0cde11f8)
ExceptionAddress: fffff800416f404c (nt!ExInterlockedRemoveHeadList+0x000000000000008c)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffff8b8f`0cde0f78 fffff800`41807b69 : 00000000`00000139 00000000`00000003 ffff8b8f`0cde12a0 ffff8b8f`0cde11f8 : nt!KeBugCheckEx
ffff8b8f`0cde0f80 fffff800`41807f90 : ffffc88f`8b665a70 fffff800`42bb2f70 00000000`00000000 fffff800`417d18a8 : nt!KiBugCheckDispatch+0x69
ffff8b8f`0cde10c0 fffff800`41806323 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffff8b8f`0cde12a0 fffff800`416f404c : 00000000`00000000 fffff800`00000000 ffffc88f`8d6fdc58 ffffc88f`8d6fdc48 : nt!KiRaiseSecurityCheckFailure+0x323
ffff8b8f`0cde1430 fffff800`4c1554c0 : ffffc88f`88cc3740 ffffc88f`89839050 ffffc88f`8b534080 fffff800`4c1a3360 : nt!ExInterlockedRemoveHeadList+0x8c
ffff8b8f`0cde1460 ffffc88f`88cc3740 : ffffc88f`89839050 ffffc88f`8b534080 fffff800`4c1a3360 00000000`00000000 : athurx+0x54c0
ffff8b8f`0cde1468 ffffc88f`89839050 : ffffc88f`8b534080 fffff800`4c1a3360 00000000`00000000 ffffc88f`8d6eb030 : 0xffffc88f`88cc3740
ffff8b8f`0cde1470 ffffc88f`8b534080 : fffff800`4c1a3360 00000000`00000000 ffffc88f`8d6eb030 ffffc88f`8d6eb001 : 0xffffc88f`89839050
ffff8b8f`0cde1478 fffff800`4c1a3360 : 00000000`00000000 ffffc88f`8d6eb030 ffffc88f`8d6eb001 fffff800`4c17abf4 : 0xffffc88f`8b534080
ffff8b8f`0cde1480 00000000`00000000 : ffffc88f`8d6eb030 ffffc88f`8d6eb001 fffff800`4c17abf4 ffffc88f`8d6eb030 : athurx+0x53360
SYMBOL_NAME: athurx+54c0
MODULE_NAME: athurx
IMAGE_NAME: athurx.sys
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 54c0
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_athurx!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {cf0b00cb-8b52-be47-e20d-865e290d55f0}
Followup: MachineOwner
---------
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffdd87eed3d130, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffdd87eed3d088, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 4234
Key : Analysis.DebugAnalysisManager
Value: Create
Key : Analysis.Elapsed.mSec
Value: 74749
Key : Analysis.Init.CPU.mSec
Value: 468
Key : Analysis.Init.Elapsed.mSec
Value: 12888
Key : Analysis.Memory.CommitPeak.Mb
Value: 74
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY
Key : FailFast.Type
Value: 3
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 139
BUGCHECK_P1: 3
BUGCHECK_P2: ffffdd87eed3d130
BUGCHECK_P3: ffffdd87eed3d088
BUGCHECK_P4: 0
TRAP_FRAME: ffffdd87eed3d130 -- (.trap 0xffffdd87eed3d130)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffa80bb7031947 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffa80bb702ec48 rsi=0000000000000000 rdi=0000000000000000
rip=fffff806844f404c rsp=ffffdd87eed3d2c0 rbp=0000000000000001
r8=000000000000004c r9=0000000000000000 r10=0000000000000000
r11=fffff780000003b0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up di ng nz ac po cy
nt!ExInterlockedRemoveHeadList+0x8c:
fffff806`844f404c cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffdd87eed3d088 -- (.exr 0xffffdd87eed3d088)
ExceptionAddress: fffff806844f404c (nt!ExInterlockedRemoveHeadList+0x000000000000008c)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: System
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
EXCEPTION_STR: 0xc0000409
STACK_TEXT:
ffffdd87`eed3ce08 fffff806`84607b69 : 00000000`00000139 00000000`00000003 ffffdd87`eed3d130 ffffdd87`eed3d088 : nt!KeBugCheckEx
ffffdd87`eed3ce10 fffff806`84607f90 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffdd87`eed3cf50 fffff806`84606323 : 00000000`03dfd240 00000000`00000000 ffff276d`ea259a8f fffff806`8455469e : nt!KiFastFailDispatch+0xd0
ffffdd87`eed3d130 fffff806`844f404c : 00000000`00000000 00000000`00000000 ffffa80b`b702ec58 ffffa80b`b702ec48 : nt!KiRaiseSecurityCheckFailure+0x323
ffffdd87`eed3d2c0 fffff806`8f4b54c0 : ffffa80b`c156a040 00000000`00000080 fffff806`8f4b6eb0 00000000`00000000 : nt!ExInterlockedRemoveHeadList+0x8c
ffffdd87`eed3d2f0 ffffa80b`c156a040 : 00000000`00000080 fffff806`8f4b6eb0 00000000`00000000 00000000`00000000 : athurx+0x54c0
ffffdd87`eed3d2f8 00000000`00000080 : fffff806`8f4b6eb0 00000000`00000000 00000000`00000000 00000000`00000000 : 0xffffa80b`c156a040
ffffdd87`eed3d300 fffff806`8f4b6eb0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x80
ffffdd87`eed3d308 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 fffff806`8f4dabf4 : athurx+0x6eb0
SYMBOL_NAME: athurx+54c0
MODULE_NAME: athurx
IMAGE_NAME: athurx.sys
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 54c0
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_athurx!unknown_function
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {cf0b00cb-8b52-be47-e20d-865e290d55f0}
Followup: MachineOwner
---------