1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
KERNEL_SECURITY_CHECK_FAILURE (139)
A kernel component has corrupted a critical data structure. The corruption.
could potentially allow a malicious user to gain control of this machine.
Arguments:
Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
Arg2: ffffc10dc8f415f0, Address of the trap frame for the exception that caused the BugCheck.
Arg3: ffffc10dc8f41548, Address of the exception record for the exception that caused the BugCheck.
Arg4: 0000000000000000, Reserved.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2452.
Key : Analysis.DebugAnalysisManager
Value: Create.
Key : Analysis.Elapsed.mSec
Value: 4368.
Key : Analysis.Init.CPU.mSec
Value: 359.
Key : Analysis.Init.Elapsed.mSec
Value: 1829.
Key : Analysis.Memory.CommitPeak.Mb
Value: 73.
Key : FailFast.Name
Value: CORRUPT_LIST_ENTRY.
Key : FailFast.Type
Value: 3
Key : WER.OS.Branch
Value: vb_release.
Key : WER.OS.Timestamp
Value: 2019-12-06T14:06:00Z
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 139.
BUGCHECK_P1: 3
BUGCHECK_P2: ffffc10dc8f415f0.
BUGCHECK_P3: ffffc10dc8f41548.
BUGCHECK_P4: 0
TRAP_FRAME: ffffc10dc8f415f0 -- (.trap 0xffffc10dc8f415f0)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffffcb0cc04c09c0 rbx=0000000000000000 rcx=0000000000000003
rdx=ffffcb0cc04ba530 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80349486ad9 rsp=ffffc10dc8f41780 rbp=ffffc10dc8f418c0
r8=0000000000000001 r9=0000000000000000 r10=ffffcb0cc04ba080
r11=ffffcb0cc300b1d0 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei pl nz na po cy.
nt!IopCompleteRequest+0xae9:
fffff803`49486ad9 cd29 int 29h.
Resetting default scope.
EXCEPTION_RECORD: ffffc10dc8f41548 -- (.exr 0xffffc10dc8f41548)
ExceptionAddress: fffff80349486ad9 (nt!IopCompleteRequest+0x0000000000000ae9)
ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
ExceptionFlags: 00000001.
NumberParameters: 1
Parameter[0]: 0000000000000003.
Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: dwm.exe
ERROR_CODE: (NTSTATUS) 0xc0000409 - Sistem, bu uygulamada y n tabanl bir arabelle in ta t n alg lad . Bu ta ma, k t niyetli bir kullan c n n bu uygulaman n denetimini ele ge irmesine olanak verebilir.
EXCEPTION_CODE_STR: c0000409.
EXCEPTION_PARAMETER1: 0000000000000003.
IRP_ADDRESS: ffffffffffffff88.
EXCEPTION_STR: 0xc0000409.
STACK_TEXT:
ffffc10d`c8f412c8 fffff803`49608e69 : 00000000`00000139 00000000`00000003 ffffc10d`c8f415f0 ffffc10d`c8f41548 : nt!KeBugCheckEx
ffffc10d`c8f412d0 fffff803`49609290 : 00000246`002b0000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
ffffc10d`c8f41410 fffff803`49607623 : ffff8001`010eb730 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiFastFailDispatch+0xd0
ffffc10d`c8f415f0 fffff803`49486ad9 : 00000000`00000001 ffffc10d`c8f418c0 00000000`00000040 ffffcb0c`c0352800 : nt!KiRaiseSecurityCheckFailure+0x323
ffffc10d`c8f41780 fffff803`4940ee00 : 00000000`00000000 00000000`00000000 00000000`00000000 ffffcb0c`c04ba080 : nt!IopCompleteRequest+0xae9
ffffc10d`c8f41840 fffff803`4940cc97 : 00000000`00000002 00000000`00000000 ffffcb0c`00000000 00000000`00000000 : nt!KiDeliverApc+0x1b0
ffffc10d`c8f418f0 fffff803`4940be9f : ffffcb0c`00000001 fffff803`00000002 00000000`00000000 00000000`00000000 : nt!KiSwapThread+0x827
ffffc10d`c8f419a0 fffff803`494bc272 : 00000000`000000a1 00000000`00000000 ffffcb0c`00000001 000001d7`e23d5ca8 : nt!KiCommitThreadWait+0x14f
ffffc10d`c8f41a40 fffff803`49896edf : 00000000`00000000 000001d7`e09e1e80 000001d7`e5524800 00000000`00000002 : nt!KeDelayExecutionThread+0x122
ffffc10d`c8f41ad0 fffff803`496088b8 : ffffcb0c`c04ba080 ffffcb0c`c019d080 80000000`00000000 ffffcb0c`00000000 : nt!NtDelayExecution+0x5f
ffffc10d`c8f41b00 00007ffe`27dad4a4 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000077`8e2ff478 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`27dad4a4
SYMBOL_NAME: nt!KiSwapThread+827
MODULE_NAME: nt.
IMAGE_NAME: ntkrnlmp.exe
IMAGE_VERSION: 10.0.19041.1110
STACK_COMMAND: .thread ; .cxr ; kb.
BUCKET_ID_FUNC_OFFSET: 827.
FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiSwapThread
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release.
OSPLATFORM_TYPE: x64.
OSNAME: Windows 10.
FAILURE_ID_HASH: {364d2a10-fb5b-e8e9-9b5b-39c85a1b5a41}
Followup: MachineOwner.
---------
