KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffa98be89c7480, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffa98be89c73d8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for 360Hvm64.sys
KEY_VALUES_STRING: 1
PROCESSES_ANALYSIS: 1
SERVICE_ANALYSIS: 1
STACKHASH_ANALYSIS: 1
TIMELINE_ANALYSIS: 1
DUMP_CLASS: 1
DUMP_QUALIFIER: 400
BUILD_VERSION_STRING: 18362.1.amd64fre.19h1_release.190318-1202
DUMP_TYPE: 2
BUGCHECK_P1: 3
BUGCHECK_P2: ffffa98be89c7480
BUGCHECK_P3: ffffa98be89c73d8
BUGCHECK_P4: 0
TRAP_FRAME: ffffa98be89c7480 -- (.trap 0xffffa98be89c7480)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000000 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffd489fae62310 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80453def5bd rsp=ffffa98be89c7610 rbp=ffffa98be89c77f9
r8=ffffa98be89c7618 r9=000000000000000c r10=00000000ffffffff
r11=0000000000000094 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po cy
nt!AlpcpDestroyPort+0x17705d:
fffff804`53def5bd cd29 int 29h
Resetting default scope
EXCEPTION_RECORD: ffffa98be89c73d8 -- (.exr 0xffffa98be89c73d8)
ExceptionAddress: fffff80453def5bd (nt!AlpcpDestroyPort+0x000000000017705d)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001
NumberParameters: 1
Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
CPU_COUNT: 6
CPU_MHZ: af8
CPU_VENDOR: GenuineIntel
CPU_FAMILY: 6
CPU_MODEL: 9e
CPU_STEPPING: a
CUSTOMER_CRASH_COUNT: 1
BUGCHECK_STR: 0x139
PROCESS_NAME: svchost.exe
CURRENT_IRQL: 0
DEFAULT_BUCKET_ID: FAIL_FAST_CORRUPT_LIST_ENTRY
ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>
EXCEPTION_CODE_STR: c0000409
EXCEPTION_PARAMETER1: 0000000000000003
ANALYSIS_SESSION_HOST: DESKTOP-7KGVC4E
ANALYSIS_SESSION_TIME: 03-20-2020 20:03:02.0141
ANALYSIS_VERSION: 10.0.18362.1 amd64fre
LAST_CONTROL_TRANSFER: from fffff804537d41e9 to fffff804537c2380
STACK_TEXT:
ffffa98b`e89c7158 fffff804`537d41e9 : 00000000`00000139 00000000`00000003 ffffa98b`e89c7480 ffffa98b`e89c73d8 : nt!KeBugCheckEx
ffffa98b`e89c7160 fffff804`537d4610 : 00000000`01800080 ffffae89`00000000 00000000`00000003 00000000`00000700 : nt!KiBugCheckDispatch+0x69
ffffa98b`e89c72a0 fffff804`537d29a5 : ffffae88`f8a00340 ffffae89`03d714ff 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffffa98b`e89c7480 fffff804`53def5bd : ffffd489`fac3d070 fffff804`00000000 ffffd489`00000000 ffffae88`ffa80600 : nt!KiRaiseSecurityCheckFailure+0x325
ffffa98b`e89c7610 fffff804`53c7870e : ffffae88`ffa80600 ffffd489`fac3d070 ffffae88`ffa80600 00000000`00000000 : nt!AlpcpDestroyPort+0x17705d
ffffa98b`e89c7640 fffff804`53cc36d0 : ffffd489`fac3d040 00000000`00000000 ffffd489`fac3d158 ffffd489`fac3d070 : nt!AlpcpDeletePort+0x10e
ffffa98b`e89c7670 fffff804`53713279 : 00000000`00000000 00000000`00000000 ffffa98b`e89c77f9 ffffd489`fac3d070 : nt!ObpRemoveObjectRoutine+0x80
ffffa98b`e89c76d0 fffff804`53cb5a47 : 00000000`ffff8005 ffffd489`fac3d040 ffffd489`00000000 ffffd489`fac3d040 : nt!ObfDereferenceObjectWithTag+0xc9
ffffa98b`e89c7710 fffff804`53cbad3e : 00000000`00000368 fffff804`69de7ff8 00000000`00000000 000000ee`2cd7f238 : nt!ObCloseHandleTableEntry+0x2c7
ffffa98b`e89c7850 fffff804`69df0209 : ffffd489`fa881080 fffff804`00000005 ffffa98b`e89c7a80 fffff804`53cba5ce : nt!NtClose+0xde
ffffa98b`e89c78c0 ffffd489`fa881080 : fffff804`00000005 ffffa98b`e89c7a80 fffff804`53cba5ce ffffa98b`e89c78f0 : 360Hvm64+0x10209
ffffa98b`e89c78c8 fffff804`00000005 : ffffa98b`e89c7a80 fffff804`53cba5ce ffffa98b`e89c78f0 ffffa98b`e89c7a00 : 0xffffd489`fa881080
ffffa98b`e89c78d0 ffffa98b`e89c7a80 : fffff804`53cba5ce ffffa98b`e89c78f0 ffffa98b`e89c7a00 ffffd489`f30f76c0 : 0xfffff804`00000005
ffffa98b`e89c78d8 fffff804`53cba5ce : ffffa98b`e89c78f0 ffffa98b`e89c7a00 ffffd489`f30f76c0 fffff804`69de808d : 0xffffa98b`e89c7a80
ffffa98b`e89c78e0 fffff804`69e145b4 : ffffd489`fa881080 00000000`00000000 ffff6914`827984f0 00000000`00000000 : nt!ObReferenceObjectByHandle+0x2e
ffffa98b`e89c7930 ffffd489`fa881080 : 00000000`00000000 ffff6914`827984f0 00000000`00000000 ffffa98b`e89c79a0 : 360Hvm64+0x345b4
ffffa98b`e89c7938 00000000`00000000 : ffff6914`827984f0 00000000`00000000 ffffa98b`e89c79a0 00000000`00000000 : 0xffffd489`fa881080
THREAD_SHA1_HASH_MOD_FUNC: bec947699efd0564d8523bf8bf2a390724e16eb9
THREAD_SHA1_HASH_MOD_FUNC_OFFSET: d4af06c80fca47d5748c7ad051fd2d563aceec0b
THREAD_SHA1_HASH_MOD: 9c8db8007bf7ff30709ffe2d2f3f72decda10f42
FOLLOWUP_IP:
360Hvm64+10209
fffff804`69df0209 488bd8 mov rbx,rax
FAULT_INSTR_CODE: 48d88b48
SYMBOL_STACK_INDEX: a
SYMBOL_NAME: 360Hvm64+10209
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: 360Hvm64
IMAGE_NAME: 360Hvm64.sys
DEBUG_FLR_IMAGE_TIMESTAMP: 5e042925
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 10209
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_360Hvm64!unknown_function
BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_360Hvm64!unknown_function
PRIMARY_PROBLEM_CLASS: 0x139_3_CORRUPT_LIST_ENTRY_360Hvm64!unknown_function
TARGET_TIME: 2020-03-20T16:06:10.000Z
OSBUILD: 18362
OSSERVICEPACK: 720
SERVICEPACK_NUMBER: 0
OS_REVISION: 0
SUITE_MASK: 272
PRODUCT_TYPE: 1
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
OS_LOCALE:
USER_LCID: 0
OSBUILD_TIMESTAMP: unknown_date
BUILDDATESTAMP_STR: 190318-1202
BUILDLAB_STR: 19h1_release
BUILDOSVER_STR: 10.0.18362.1.amd64fre.19h1_release.190318-1202
ANALYSIS_SESSION_ELAPSED_TIME: 3ebc
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:0x139_3_corrupt_list_entry_360hvm64!unknown_function
FAILURE_ID_HASH: {522cdf40-8775-9721-6cae-96f6385e7178}
Followup: MachineOwner
---------