Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Microsoft (R) Windows Debugger Version 10.0.18362.1 AMD64
- Copyright (c) Microsoft Corporation. All rights reserved.
- Loading Dump File [C:\Windows\minidump\121719-7187-01.dmp]
- Mini Kernel Dump File: Only registers and stack trace are available
- Symbol search path is: srv*
- Executable search path is:
- Windows 10 Kernel Version 18362 MP (16 procs) Free x64
- Product: WinNt, suite: TerminalServer SingleUserTS
- Machine Name:
- Kernel base = 0xfffff803`73a00000 PsLoadedModuleList = 0xfffff803`73e48130
- Debug session time: Tue Dec 17 20:46:29.441 2019 (UTC + 1:00)
- System Uptime: 0 days 0:05:11.142
- Loading Kernel Symbols
- ...............................................................
- ................................................................
- ...................................................
- Loading User Symbols
- Loading unloaded module list
- ......
- For analysis of this file, run !analyze -v
- 10: kd> !analyze -v
- *******************************************************************************
- * *
- * Bugcheck Analysis *
- * *
- *******************************************************************************
- KERNEL_SECURITY_CHECK_FAILURE (139)
- A kernel component has corrupted a critical data structure. The corruption
- could potentially allow a malicious user to gain control of this machine.
- Arguments:
- Arg1: 0000000000000003, A LIST_ENTRY has been corrupted (i.e. double remove).
- Arg2: fffffb84dd0a77b0, Address of the trap frame for the exception that caused the bugcheck
- Arg3: fffffb84dd0a7708, Address of the exception record for the exception that caused the bugcheck
- Arg4: 0000000000000000, Reserved
- Debugging Details:
- ------------------
- KEY_VALUES_STRING: 1
- PROCESSES_ANALYSIS: 1
- SERVICE_ANALYSIS: 1
- STACKHASH_ANALYSIS: 1
- TIMELINE_ANALYSIS: 1
- DUMP_CLASS: 1
- DUMP_QUALIFIER: 400
- BUILD_VERSION_STRING: 10.0.18362.535 (WinBuild.160101.0800)
- DUMP_FILE_ATTRIBUTES: 0x8
- Kernel Generated Triage Dump
- DUMP_TYPE: 2
- BUGCHECK_P1: 3
- BUGCHECK_P2: fffffb84dd0a77b0
- BUGCHECK_P3: fffffb84dd0a7708
- BUGCHECK_P4: 0
- TRAP_FRAME: fffffb84dd0a77b0 -- (.trap 0xfffffb84dd0a77b0)
- NOTE: The trap frame does not contain all registers.
- Some register values may be zeroed or incorrect.
- rax=ffffda0939497ae8 rbx=0000000000000000 rcx=0000000000000003
- rdx=0000000000000005 rsi=0000000000000000 rdi=0000000000000000
- rip=fffff80373a6bb54 rsp=fffffb84dd0a7940 rbp=ffffda09387b56f0
- r8=0000000000000102 r9=0000000000000000 r10=fffff803700bf800
- r11=0000000000000001 r12=0000000000000000 r13=0000000000000000
- r14=0000000000000000 r15=0000000000000000
- iopl=0 nv up ei pl nz na pe nc
- nt!KiProcessExpiredTimerList+0x234:
- fffff803`73a6bb54 cd29 int 29h
- Resetting default scope
- EXCEPTION_RECORD: fffffb84dd0a7708 -- (.exr 0xfffffb84dd0a7708)
- ExceptionAddress: fffff80373a6bb54 (nt!KiProcessExpiredTimerList+0x0000000000000234)
- ExceptionCode: c0000409 (Security check failure or stack buffer overrun)
- ExceptionFlags: 00000001
- NumberParameters: 1
- Parameter[0]: 0000000000000003
- Subcode: 0x3 FAST_FAIL_CORRUPT_LIST_ENTRY
- CPU_COUNT: 10
- CPU_MHZ: e74
- CPU_VENDOR: AuthenticAMD
- CPU_FAMILY: 17
- CPU_MODEL: 8
- CPU_STEPPING: 2
- CUSTOMER_CRASH_COUNT: 1
- BUGCHECK_STR: 0x139
- PROCESS_NAME: System
- CURRENT_IRQL: 2
- DEFAULT_BUCKET_ID: FAIL_FAST_CORRUPT_LIST_ENTRY
- ERROR_CODE: (NTSTATUS) 0xc0000409 - Das System hat in dieser Anwendung den berlauf eines stapelbasierten Puffers ermittelt. Dieser berlauf k nnte einem b sartigen Benutzer erm glichen, die Steuerung der Anwendung zu bernehmen.
- EXCEPTION_CODE: (NTSTATUS) 0xc0000409 - Das System hat in dieser Anwendung den berlauf eines stapelbasierten Puffers ermittelt. Dieser berlauf k nnte einem b sartigen Benutzer erm glichen, die Steuerung der Anwendung zu bernehmen.
- EXCEPTION_CODE_STR: c0000409
- EXCEPTION_PARAMETER1: 0000000000000003
- ANALYSIS_SESSION_HOST: DESKTOP-PQ1B8N5
- ANALYSIS_SESSION_TIME: 12-17-2019 21:14:56.0708
- ANALYSIS_VERSION: 10.0.18362.1 amd64fre
- LAST_CONTROL_TRANSFER: from fffff80373bd32e9 to fffff80373bc14e0
- STACK_TEXT:
- fffffb84`dd0a7488 fffff803`73bd32e9 : 00000000`00000139 00000000`00000003 fffffb84`dd0a77b0 fffffb84`dd0a7708 : nt!KeBugCheckEx
- fffffb84`dd0a7490 fffff803`73bd3710 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiBugCheckDispatch+0x69
- fffffb84`dd0a75d0 fffff803`73bd1aa5 : 00000000`b9980648 00000000`00000000 00000000`00000000 00000000`00000003 : nt!KiFastFailDispatch+0xd0
- fffffb84`dd0a77b0 fffff803`73a6bb54 : ffffda09`387b56c0 00000000`b974724e 00000001`00000004 ffffda09`3314f010 : nt!KiRaiseSecurityCheckFailure+0x325
- fffffb84`dd0a7940 fffff803`73a6a7e9 : 00000000`00000004 00000000`00989680 00000000`00002e5d 00000000`00000075 : nt!KiProcessExpiredTimerList+0x234
- fffffb84`dd0a7a30 fffff803`73bc5024 : ffffffff`00000000 ffffad80`c59c8180 ffffad80`c59d9440 ffffda09`37157080 : nt!KiRetireDpcList+0x4e9
- fffffb84`dd0a7c60 00000000`00000000 : fffffb84`dd0a8000 fffffb84`dd0a2000 00000000`00000000 00000000`00000000 : nt!KiIdleLoop+0x84
- THREAD_SHA1_HASH_MOD_FUNC: a5119ebdc9ff71d34433e0daf4177502fc924f29
- THREAD_SHA1_HASH_MOD_FUNC_OFFSET: 060f65eb7dbeac629aaa0950c72f0d4dec6c7f1c
- THREAD_SHA1_HASH_MOD: 30a3e915496deaace47137d5b90c3ecc03746bf6
- FOLLOWUP_IP:
- nt!KiProcessExpiredTimerList+234
- fffff803`73a6bb54 cd29 int 29h
- FAULT_INSTR_CODE: 8b4829cd
- SYMBOL_STACK_INDEX: 4
- SYMBOL_NAME: nt!KiProcessExpiredTimerList+234
- FOLLOWUP_NAME: MachineOwner
- MODULE_NAME: nt
- IMAGE_NAME: ntkrnlmp.exe
- DEBUG_FLR_IMAGE_TIMESTAMP: 12dcb470
- IMAGE_VERSION: 10.0.18362.535
- STACK_COMMAND: .thread ; .cxr ; kb
- BUCKET_ID_FUNC_OFFSET: 234
- FAILURE_BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiProcessExpiredTimerList
- BUCKET_ID: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiProcessExpiredTimerList
- PRIMARY_PROBLEM_CLASS: 0x139_3_CORRUPT_LIST_ENTRY_KTIMER_LIST_CORRUPTION_nt!KiProcessExpiredTimerList
- TARGET_TIME: 2019-12-17T19:46:29.000Z
- OSBUILD: 18362
- OSSERVICEPACK: 535
- SERVICEPACK_NUMBER: 0
- OS_REVISION: 0
- SUITE_MASK: 272
- PRODUCT_TYPE: 1
- OSPLATFORM_TYPE: x64
- OSNAME: Windows 10
- OSEDITION: Windows 10 WinNt TerminalServer SingleUserTS
- OS_LOCALE:
- USER_LCID: 0
- OSBUILD_TIMESTAMP: 1980-01-11 16:53:20
- BUILDDATESTAMP_STR: 160101.0800
- BUILDLAB_STR: WinBuild
- BUILDOSVER_STR: 10.0.18362.535
- ANALYSIS_SESSION_ELAPSED_TIME: 999
- ANALYSIS_SOURCE: KM
- FAILURE_ID_HASH_STRING: km:0x139_3_corrupt_list_entry_ktimer_list_corruption_nt!kiprocessexpiredtimerlist
- FAILURE_ID_HASH: {9db7945b-255d-24a1-9f2c-82344e883ab8}
- Followup: MachineOwner
Add Comment
Please, Sign In to add comment