Çözüldü KERNEL_SECURITY_CHECK_FAILURE mavi ekran hatası

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffff48c17a473b0, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffff48c17a47308, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for athurx.sys
*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1


PROCESSES_ANALYSIS: 1

SERVICE_ANALYSIS: 1

STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING:  18362.1.amd64fre.19h1_release.190318-1202

DUMP_TYPE:  2

BUGCHECK_P1: 3

BUGCHECK_P2: fffff48c17a473b0

BUGCHECK_P3: fffff48c17a47308

BUGCHECK_P4: 0

TRAP_FRAME:  fffff48c17a473b0 -- (.trap 0xfffff48c17a473b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffab8f5493f249 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffab8f54989c48 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80779707adb rsp=fffff48c17a47540 rbp=0000000000000001
 r8=0000000000000014  r9=0000000000000000 r10=0000000000000000
r11=fffff48c17a47550 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di ng nz ac pe cy
nt!ExInterlockedRemoveHeadList+0x8b:
fffff807`79707adb cd29            int     29h
Resetting default scope

EXCEPTION_RECORD:  fffff48c17a47308 -- (.exr 0xfffff48c17a47308)
ExceptionAddress: fffff80779707adb (nt!ExInterlockedRemoveHeadList+0x000000000000008b)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

CPU_COUNT: c

CPU_MHZ: c78

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 9e

CPU_STEPPING: a

CUSTOMER_CRASH_COUNT:  1

BUGCHECK_STR:  0x139

PROCESS_NAME:  System

CURRENT_IRQL:  0

DEFAULT_BUCKET_ID:  FAIL_FAST_CORRUPT_LIST_ENTRY

ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  0000000000000003

ANALYSIS_SESSION_HOST:  DESKTOP-18V31A3

ANALYSIS_SESSION_TIME:  10-31-2019 20:34:57.0699

ANALYSIS_VERSION: 10.0.18362.1 x86fre

LAST_CONTROL_TRANSFER:  from fffff807797d30e9 to fffff807797c1220

STACK_TEXT: 
fffff48c`17a47088 fffff807`797d30e9 : 00000000`00000139 00000000`00000003 fffff48c`17a473b0 fffff48c`17a47308 : nt!KeBugCheckEx
fffff48c`17a47090 fffff807`797d3510 : 00000000`00000000 00000000`00000000 fffff48c`17a47458 fffff807`797a1a96 : nt!KiBugCheckDispatch+0x69
fffff48c`17a471d0 fffff807`797d18a5 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
fffff48c`17a473b0 fffff807`79707adb : 00000000`00000000 00000000`00000000 ffffab8f`54989c58 ffffab8f`54989c48 : nt!KiRaiseSecurityCheckFailure+0x325
fffff48c`17a47540 fffff807`93e154c0 : ffffab8f`56b0b040 00000000`00000080 ffffab8f`562510ae ffffab8f`5493f515 : nt!ExInterlockedRemoveHeadList+0x8b
fffff48c`17a47570 ffffab8f`56b0b040 : 00000000`00000080 ffffab8f`562510ae ffffab8f`5493f515 00000000`00000000 : athurx+0x54c0
fffff48c`17a47578 00000000`00000080 : ffffab8f`562510ae ffffab8f`5493f515 00000000`00000000 fffff807`93e63360 : 0xffffab8f`56b0b040
fffff48c`17a47580 ffffab8f`562510ae : ffffab8f`5493f515 00000000`00000000 fffff807`93e63360 ffffab8f`5493f515 : 0x80
fffff48c`17a47588 ffffab8f`5493f515 : 00000000`00000000 fffff807`93e63360 ffffab8f`5493f515 fffff807`93e3abf4 : 0xffffab8f`562510ae
fffff48c`17a47590 00000000`00000000 : fffff807`93e63360 ffffab8f`5493f515 fffff807`93e3abf4 ffffab8f`54977030 : 0xffffab8f`5493f515


THREAD_SHA1_HASH_MOD_FUNC:  1a1c42bf8cc62cfab7b100a4c1f4b4d5cc238726

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  ae4ab235ffd0ff3dff064ddfe44959ba70e1377c

THREAD_SHA1_HASH_MOD:  9b490a8a6443cee405841f68027d5f9f45a3434c

FOLLOWUP_IP:
athurx+54c0
fffff807`93e154c0 4889442420      mov     qword ptr [rsp+20h],rax

FAULT_INSTR_CODE:  24448948

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  athurx+54c0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: athurx

IMAGE_NAME:  athurx.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4daeb071

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  54c0

FAILURE_BUCKET_ID:  0x139_3_CORRUPT_LIST_ENTRY_athurx!unknown_function

BUCKET_ID:  0x139_3_CORRUPT_LIST_ENTRY_athurx!unknown_function

PRIMARY_PROBLEM_CLASS:  0x139_3_CORRUPT_LIST_ENTRY_athurx!unknown_function

TARGET_TIME:  2019-10-24T17:06:56.000Z

OSBUILD:  18362

OSSERVICEPACK:  418

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  272

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE: 

USER_LCID:  0

OSBUILD_TIMESTAMP:  unknown_date

BUILDDATESTAMP_STR:  190318-1202

BUILDLAB_STR:  19h1_release

BUILDOSVER_STR:  10.0.18362.1.amd64fre.19h1_release.190318-1202

ANALYSIS_SESSION_ELAPSED_TIME:  147b5

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x139_3_corrupt_list_entry_athurx!unknown_function

FAILURE_ID_HASH:  {cf0b00cb-8b52-be47-e20d-865e290d55f0}

Followup:     MachineOwner
---------



KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffffe0a918dd3b0, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffffe0a918dd308, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for athurx.sys
*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1


PROCESSES_ANALYSIS: 1

SERVICE_ANALYSIS: 1

STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING:  18362.1.amd64fre.19h1_release.190318-1202

DUMP_TYPE:  2

BUGCHECK_P1: 3

BUGCHECK_P2: fffffe0a918dd3b0

BUGCHECK_P3: fffffe0a918dd308

BUGCHECK_P4: 0

TRAP_FRAME:  fffffe0a918dd3b0 -- (.trap 0xfffffe0a918dd3b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffbe8bf3d2c67b rbx=0000000000000000 rcx=0000000000000003
rdx=ffffbe8bf3d68c48 rsi=0000000000000000 rdi=0000000000000000
rip=fffff8016250743b rsp=fffffe0a918dd540 rbp=0000000000000001
 r8=0000000000000014  r9=0000000000000000 r10=0000000000000001
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di pl nz na pe nc
nt!ExInterlockedRemoveHeadList+0x8b:
fffff801`6250743b cd29            int     29h
Resetting default scope

EXCEPTION_RECORD:  fffffe0a918dd308 -- (.exr 0xfffffe0a918dd308)
ExceptionAddress: fffff8016250743b (nt!ExInterlockedRemoveHeadList+0x000000000000008b)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

CPU_COUNT: c

CPU_MHZ: c78

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 9e

CPU_STEPPING: a

CUSTOMER_CRASH_COUNT:  1

BUGCHECK_STR:  0x139

PROCESS_NAME:  System

CURRENT_IRQL:  0

DEFAULT_BUCKET_ID:  FAIL_FAST_CORRUPT_LIST_ENTRY

ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  0000000000000003

ANALYSIS_SESSION_HOST:  DESKTOP-18V31A3

ANALYSIS_SESSION_TIME:  10-31-2019 20:34:38.0212

ANALYSIS_VERSION: 10.0.18362.1 x86fre

LAST_CONTROL_TRANSFER:  from fffff801625d1ae9 to fffff801625bfcc0

STACK_TEXT: 
fffffe0a`918dd088 fffff801`625d1ae9 : 00000000`00000139 00000000`00000003 fffffe0a`918dd3b0 fffffe0a`918dd308 : nt!KeBugCheckEx
fffffe0a`918dd090 fffff801`625d1f10 : 00000000`00000000 00000000`00000000 fffffe0a`918dd458 fffff801`625a0b36 : nt!KiBugCheckDispatch+0x69
fffffe0a`918dd1d0 fffff801`625d02a5 : 00000000`00000000 ffffbe8b`f3d56030 ffffbe8b`f8614140 fffff801`bccf5903 : nt!KiFastFailDispatch+0xd0
fffffe0a`918dd3b0 fffff801`6250743b : 00000000`00000000 00000000`00000000 ffffbe8b`f3d68c58 ffffbe8b`f3d68c48 : nt!KiRaiseSecurityCheckFailure+0x325
fffffe0a`918dd540 fffff801`bcc454c0 : ffffbe8b`fba86040 00000000`00000080 ffffbe8b`fd2d50ae ffffbe8b`f3d2cedf : nt!ExInterlockedRemoveHeadList+0x8b
fffffe0a`918dd570 ffffbe8b`fba86040 : 00000000`00000080 ffffbe8b`fd2d50ae ffffbe8b`f3d2cedf 00000000`00000000 : athurx+0x54c0
fffffe0a`918dd578 00000000`00000080 : ffffbe8b`fd2d50ae ffffbe8b`f3d2cedf 00000000`00000000 fffff801`bcc93360 : 0xffffbe8b`fba86040
fffffe0a`918dd580 ffffbe8b`fd2d50ae : ffffbe8b`f3d2cedf 00000000`00000000 fffff801`bcc93360 ffffbe8b`f3d2cedf : 0x80
fffffe0a`918dd588 ffffbe8b`f3d2cedf : 00000000`00000000 fffff801`bcc93360 ffffbe8b`f3d2cedf fffff801`bcc6abf4 : 0xffffbe8b`fd2d50ae
fffffe0a`918dd590 00000000`00000000 : fffff801`bcc93360 ffffbe8b`f3d2cedf fffff801`bcc6abf4 ffffbe8b`f3d56030 : 0xffffbe8b`f3d2cedf


THREAD_SHA1_HASH_MOD_FUNC:  1a1c42bf8cc62cfab7b100a4c1f4b4d5cc238726

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  ae4ab235ffd0ff3dff064ddfe44959ba70e1377c

THREAD_SHA1_HASH_MOD:  9b490a8a6443cee405841f68027d5f9f45a3434c

FOLLOWUP_IP:
athurx+54c0
fffff801`bcc454c0 4889442420      mov     qword ptr [rsp+20h],rax

FAULT_INSTR_CODE:  24448948

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  athurx+54c0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: athurx

IMAGE_NAME:  athurx.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4daeb071

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  54c0

FAILURE_BUCKET_ID:  0x139_3_CORRUPT_LIST_ENTRY_athurx!unknown_function

BUCKET_ID:  0x139_3_CORRUPT_LIST_ENTRY_athurx!unknown_function

PRIMARY_PROBLEM_CLASS:  0x139_3_CORRUPT_LIST_ENTRY_athurx!unknown_function

TARGET_TIME:  2019-10-16T10:41:12.000Z

OSBUILD:  18362

OSSERVICEPACK:  295

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  272

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE: 

USER_LCID:  0

OSBUILD_TIMESTAMP:  1998-05-31 00:12:57

BUILDDATESTAMP_STR:  190318-1202

BUILDLAB_STR:  19h1_release

BUILDOSVER_STR:  10.0.18362.1.amd64fre.19h1_release.190318-1202

ANALYSIS_SESSION_ELAPSED_TIME:  18d73

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x139_3_corrupt_list_entry_athurx!unknown_function

FAILURE_ID_HASH:  {cf0b00cb-8b52-be47-e20d-865e290d55f0}

Followup:     MachineOwner
---------

*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: fffff5018024a3b0, Address of the trap frame for the exception that caused the bugcheck
Arg3: fffff5018024a308, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

***** Debugger could not find nt in module list, module list might be corrupt, error 0x80070057.


KEY_VALUES_STRING: 1


PROCESSES_ANALYSIS: 1

SERVICE_ANALYSIS: 1

STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

DUMP_TYPE:  2

BUGCHECK_P1: 3

BUGCHECK_P2: fffff5018024a3b0

BUGCHECK_P3: fffff5018024a308

BUGCHECK_P4: 0

TRAP_FRAME:  fffff5018024a3b0 -- (.trap 0xfffff5018024a3b0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffc78f2c1c01ab rbx=0000000000000000 rcx=0000000000000003
rdx=ffffc78f2c22dc48 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80236f07adb rsp=fffff5018024a540 rbp=0000000000000001
 r8=0000000000000014  r9=0000000000000000 r10=0000000000000001
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di pl nz ac po nc
fffff802`36f07adb ??              ???
Resetting default scope

EXCEPTION_RECORD:  fffff5018024a308 -- (.exr 0xfffff5018024a308)
ExceptionAddress: fffff80236f07adb
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

CPU_COUNT: c

CPU_MHZ: c78

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 9e

CPU_STEPPING: a

CUSTOMER_CRASH_COUNT:  1

BUGCHECK_STR:  0x139

CURRENT_IRQL:  0

ANALYSIS_SESSION_HOST:  DESKTOP-18V31A3

ANALYSIS_SESSION_TIME:  10-31-2019 20:34:55.0478

ANALYSIS_VERSION: 10.0.18362.1 x86fre

LAST_CONTROL_TRANSFER:  from fffff80236fd30e9 to fffff80236fc1220

STACK_TEXT: 
fffff501`8024a540 00000000`00000000 : 00000000`00000000 ffffc78f`2c22dc58 ffffc78f`2c22dc48 ffffc78f`2cb0ef5c : 0xfffff802`36f07adb


STACK_COMMAND:  .trap 0xfffff5018024a3b0 ; kb

SYMBOL_NAME:  ANALYSIS_INCONCLUSIVE

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: Unknown_Module

IMAGE_NAME:  Unknown_Image

DEBUG_FLR_IMAGE_TIMESTAMP:  0

BUCKET_ID:  CORRUPT_MODULELIST_0x139

DEFAULT_BUCKET_ID:  CORRUPT_MODULELIST_0x139

PRIMARY_PROBLEM_CLASS:  CORRUPT_MODULELIST_0x139

FAILURE_BUCKET_ID:  CORRUPT_MODULELIST_0x139

TARGET_TIME:  2019-10-20T14:21:14.000Z

OSBUILD:  18362

OSSERVICEPACK:  0

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  272

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE: 

USER_LCID:  0

OSBUILD_TIMESTAMP:  unknown_date

ANALYSIS_SESSION_ELAPSED_TIME:  2e

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:corrupt_modulelist_0x139

FAILURE_ID_HASH:  {bec1bc00-1c8a-a417-55b2-9f8b67cbb1c5}

Followup:     MachineOwner


*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffff900e2c862250, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffff900e2c8621a8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for athurx.sys
*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1


PROCESSES_ANALYSIS: 1

SERVICE_ANALYSIS: 1

STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING:  18362.1.amd64fre.19h1_release.190318-1202

DUMP_TYPE:  2

BUGCHECK_P1: 3

BUGCHECK_P2: ffff900e2c862250

BUGCHECK_P3: ffff900e2c8621a8

BUGCHECK_P4: 0

TRAP_FRAME:  ffff900e2c862250 -- (.trap 0xffff900e2c862250)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffe683a91a1030 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffe683a91bac48 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80322907adb rsp=ffff900e2c8623e0 rbp=0000000000000001
 r8=0000000000000010  r9=0000000000000000 r10=0000000000000001
r11=fffff780000003b0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di ng nz na pe cy
nt!ExInterlockedRemoveHeadList+0x8b:
fffff803`22907adb cd29            int     29h
Resetting default scope

EXCEPTION_RECORD:  ffff900e2c8621a8 -- (.exr 0xffff900e2c8621a8)
ExceptionAddress: fffff80322907adb (nt!ExInterlockedRemoveHeadList+0x000000000000008b)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

CPU_COUNT: c

CPU_MHZ: c78

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 9e

CPU_STEPPING: a

CUSTOMER_CRASH_COUNT:  1

BUGCHECK_STR:  0x139

PROCESS_NAME:  System

CURRENT_IRQL:  0

DEFAULT_BUCKET_ID:  FAIL_FAST_CORRUPT_LIST_ENTRY

ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  0000000000000003

ANALYSIS_SESSION_HOST:  DESKTOP-18V31A3

ANALYSIS_SESSION_TIME:  10-31-2019 20:35:00.0277

ANALYSIS_VERSION: 10.0.18362.1 x86fre

LAST_CONTROL_TRANSFER:  from fffff803229d30e9 to fffff803229c1220

STACK_TEXT: 
ffff900e`2c861f28 fffff803`229d30e9 : 00000000`00000139 00000000`00000003 ffff900e`2c862250 ffff900e`2c8621a8 : nt!KeBugCheckEx
ffff900e`2c861f30 fffff803`229d3510 : 00000000`40030008 00000000`00000002 ffff900e`2c862801 ffff900e`2c8621d8 : nt!KiBugCheckDispatch+0x69
ffff900e`2c862070 fffff803`229d18a5 : 0000002f`2ad273b4 00000000`00000000 ffffe683`a70f9ab0 fffff803`3bb6bab8 : nt!KiFastFailDispatch+0xd0
ffff900e`2c862250 fffff803`22907adb : 00000000`00000000 00000000`00000000 ffffe683`a91bac58 ffffe683`a91bac48 : nt!KiRaiseSecurityCheckFailure+0x325
ffff900e`2c8623e0 fffff803`3e0254c0 : ffffe683`aa341040 00000000`00000080 fffff803`3e026eb0 ffff900e`2c862578 : nt!ExInterlockedRemoveHeadList+0x8b
ffff900e`2c862410 ffffe683`aa341040 : 00000000`00000080 fffff803`3e026eb0 ffff900e`2c862578 00000000`00000000 : athurx+0x54c0
ffff900e`2c862418 00000000`00000080 : fffff803`3e026eb0 ffff900e`2c862578 00000000`00000000 fffff803`262b7941 : 0xffffe683`aa341040
ffff900e`2c862420 fffff803`3e026eb0 : ffff900e`2c862578 00000000`00000000 fffff803`262b7941 00000000`00000982 : 0x80
ffff900e`2c862428 ffff900e`2c862578 : 00000000`00000000 fffff803`262b7941 00000000`00000982 fffff803`3e04abf4 : athurx+0x6eb0
ffff900e`2c862430 00000000`00000000 : fffff803`262b7941 00000000`00000982 fffff803`3e04abf4 ffffe683`a91a8030 : 0xffff900e`2c862578


THREAD_SHA1_HASH_MOD_FUNC:  c075dd76ae1cb3d32cda42306df9a73c8b1bf6c7

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  691b31929db45ab9a5cfbb6e15e4d6c9f0f611cc

THREAD_SHA1_HASH_MOD:  cd7a3d611cb1d19f2239b2de5cad241acae27d4f

FOLLOWUP_IP:
athurx+54c0
fffff803`3e0254c0 4889442420      mov     qword ptr [rsp+20h],rax

FAULT_INSTR_CODE:  24448948

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  athurx+54c0

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: athurx

IMAGE_NAME:  athurx.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4daeb071

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  54c0

FAILURE_BUCKET_ID:  0x139_3_CORRUPT_LIST_ENTRY_athurx!unknown_function

BUCKET_ID:  0x139_3_CORRUPT_LIST_ENTRY_athurx!unknown_function

PRIMARY_PROBLEM_CLASS:  0x139_3_CORRUPT_LIST_ENTRY_athurx!unknown_function

TARGET_TIME:  2019-10-26T10:12:07.000Z

OSBUILD:  18362

OSSERVICEPACK:  418

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  272

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE: 

USER_LCID:  0

OSBUILD_TIMESTAMP:  unknown_date

BUILDDATESTAMP_STR:  190318-1202

BUILDLAB_STR:  19h1_release

BUILDOSVER_STR:  10.0.18362.1.amd64fre.19h1_release.190318-1202

ANALYSIS_SESSION_ELAPSED_TIME:  fd87

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x139_3_corrupt_list_entry_athurx!unknown_function

FAILURE_ID_HASH:  {cf0b00cb-8b52-be47-e20d-865e290d55f0}

Followup:     MachineOwner
---------

0: kd> lmvm athurx
Browse full module list
start             end                 module name
fffff803`3e020000 fffff803`3e1fe000   athurx   T (no symbols)           
    Loaded symbol image file: athurx.sys
    Image path: \SystemRoot\System32\drivers\athurx.sys
    Image name: athurx.sys
    Browse all global symbols  functions  data
    Timestamp:        Wed Apr 20 13:07:45 2011 (4DAEB071)
    CheckSum:         001E1C78
    ImageSize:        001DE000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables:


*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure.  The corruption
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffb788661e2080, Address of the trap frame for the exception that caused the bugcheck
Arg3: ffffb788661e1fd8, Address of the exception record for the exception that caused the bugcheck
Arg4: 0000000000000000, Reserved

Debugging Details:
------------------

*** WARNING: Unable to verify timestamp for athurx.sys
*** WARNING: Unable to verify timestamp for win32k.sys

KEY_VALUES_STRING: 1


PROCESSES_ANALYSIS: 1

SERVICE_ANALYSIS: 1

STACKHASH_ANALYSIS: 1

TIMELINE_ANALYSIS: 1


DUMP_CLASS: 1

DUMP_QUALIFIER: 400

BUILD_VERSION_STRING:  18362.1.amd64fre.19h1_release.190318-1202

DUMP_TYPE:  2

BUGCHECK_P1: 3

BUGCHECK_P2: ffffb788661e2080

BUGCHECK_P3: ffffb788661e1fd8

BUGCHECK_P4: 0

TRAP_FRAME:  ffffb788661e2080 -- (.trap 0xffffb788661e2080)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=0000000000000001 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffba86eefbf25e rsi=0000000000000000 rdi=0000000000000000
rip=fffff8064a046b77 rsp=ffffb788661e2210 rbp=ffffba86f0014c48
 r8=ffffba86f0014c48  r9=0000000000000000 r10=0000000000000200
r11=0000000000000000 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0         nv up di ng nz na pe cy
nt!ExInterlockedInsertTailList+0x13f157:
fffff806`4a046b77 cd29            int     29h
Resetting default scope

EXCEPTION_RECORD:  ffffb788661e1fd8 -- (.exr 0xffffb788661e1fd8)
ExceptionAddress: fffff8064a046b77 (nt!ExInterlockedInsertTailList+0x000000000013f157)
   ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
  ExceptionFlags: 00000001
NumberParameters: 1
   Parameter[0]: 0000000000000003
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY

CPU_COUNT: c

CPU_MHZ: c78

CPU_VENDOR:  GenuineIntel

CPU_FAMILY: 6

CPU_MODEL: 9e

CPU_STEPPING: a

CUSTOMER_CRASH_COUNT:  1

BUGCHECK_STR:  0x139

PROCESS_NAME:  System

CURRENT_IRQL:  0

DEFAULT_BUCKET_ID:  FAIL_FAST_CORRUPT_LIST_ENTRY

ERROR_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>

EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - <Unable to get error code text>

EXCEPTION_CODE_STR:  c0000409

EXCEPTION_PARAMETER1:  0000000000000003

ANALYSIS_SESSION_HOST:  DESKTOP-18V31A3

ANALYSIS_SESSION_TIME:  10-31-2019 20:34:52.0677

ANALYSIS_VERSION: 10.0.18362.1 x86fre

LAST_CONTROL_TRANSFER:  from fffff80649fd32e9 to fffff80649fc1410

STACK_TEXT: 
ffffb788`661e1d58 fffff806`49fd32e9 : 00000000`00000139 00000000`00000003 ffffb788`661e2080 ffffb788`661e1fd8 : nt!KeBugCheckEx
ffffb788`661e1d60 fffff806`49fd3710 : ffffba86`ee738140 ffffba86`f2fc4100 ffffdd00`a5f5a180 00000000`00000002 : nt!KiBugCheckDispatch+0x69
ffffb788`661e1ea0 fffff806`49fd1aa5 : 00000000`00000000 fffff806`49e00000 fffff806`46f3b180 ffffad73`966af020 : nt!KiFastFailDispatch+0xd0
ffffb788`661e2080 fffff806`4a046b77 : ffffba86`f08a6040 00000000`00000000 ffffba86`eefbf25e ffffba86`f0014c58 : nt!KiRaiseSecurityCheckFailure+0x325
ffffb788`661e2210 fffff806`62a05521 : ffffba86`f08a6040 00000000`00000080 fffff806`62a07dc0 ffffba86`f0002030 : nt!ExInterlockedInsertTailList+0x13f157
ffffb788`661e2240 ffffba86`f08a6040 : 00000000`00000080 fffff806`62a07dc0 ffffba86`f0002030 00000000`00000000 : athurx+0x5521
ffffb788`661e2248 00000000`00000080 : fffff806`62a07dc0 ffffba86`f0002030 00000000`00000000 fffff806`62a2a190 : 0xffffba86`f08a6040
ffffb788`661e2250 fffff806`62a07dc0 : ffffba86`f0002030 00000000`00000000 fffff806`62a2a190 ffffba86`f0002030 : 0x80
ffffb788`661e2258 ffffba86`f0002030 : 00000000`00000000 fffff806`62a2a190 ffffba86`f0002030 ffffba86`eefbf25e : athurx+0x7dc0
ffffb788`661e2260 00000000`00000000 : fffff806`62a2a190 ffffba86`f0002030 ffffba86`eefbf25e ffffba86`f085c060 : 0xffffba86`f0002030


THREAD_SHA1_HASH_MOD_FUNC:  63c9c8c9829f9b956b1b0fa64aa26f3e85b3b261

THREAD_SHA1_HASH_MOD_FUNC_OFFSET:  41214c61c35e1f1c4cefa57810ac776b1bc376d7

THREAD_SHA1_HASH_MOD:  cd7a3d611cb1d19f2239b2de5cad241acae27d4f

FOLLOWUP_IP:
athurx+5521
fffff806`62a05521 4883c428        add     rsp,28h

FAULT_INSTR_CODE:  28c48348

SYMBOL_STACK_INDEX:  5

SYMBOL_NAME:  athurx+5521

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: athurx

IMAGE_NAME:  athurx.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  4daeb071

STACK_COMMAND:  .thread ; .cxr ; kb

BUCKET_ID_FUNC_OFFSET:  5521

FAILURE_BUCKET_ID:  0x139_3_CORRUPT_LIST_ENTRY_athurx!unknown_function

BUCKET_ID:  0x139_3_CORRUPT_LIST_ENTRY_athurx!unknown_function

PRIMARY_PROBLEM_CLASS:  0x139_3_CORRUPT_LIST_ENTRY_athurx!unknown_function

TARGET_TIME:  2019-10-29T21:08:17.000Z

OSBUILD:  18362

OSSERVICEPACK:  449

SERVICEPACK_NUMBER: 0

OS_REVISION: 0

SUITE_MASK:  272

PRODUCT_TYPE:  1

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

OSEDITION:  Windows 10 WinNt TerminalServer SingleUserTS

OS_LOCALE: 

USER_LCID:  0

OSBUILD_TIMESTAMP:  2011-01-12 16:55:39

BUILDDATESTAMP_STR:  190318-1202

BUILDLAB_STR:  19h1_release

BUILDOSVER_STR:  10.0.18362.1.amd64fre.19h1_release.190318-1202

ANALYSIS_SESSION_ELAPSED_TIME:  30314

ANALYSIS_SOURCE:  KM

FAILURE_ID_HASH_STRING:  km:0x139_3_corrupt_list_entry_athurx!unknown_function

FAILURE_ID_HASH:  {cf0b00cb-8b52-be47-e20d-865e290d55f0}

Followup:     MachineOwner
---------

3: kd> lmvm athurx
Browse full module list
start             end                 module name
fffff806`62a00000 fffff806`62bde000   athurx   T (no symbols)           
    Loaded symbol image file: athurx.sys
    Image path: \SystemRoot\System32\drivers\athurx.sys
    Image name: athurx.sys
    Browse all global symbols  functions  data
    Timestamp:        Wed Apr 20 03:07:45 2011 (4DAEB071)
    CheckSum:         001E1C78
    ImageSize:        001DE000
    Translations:     0000.04b0 0000.04e4 0409.04b0 0409.04e4
    Information from resource tables: