*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
REGISTRY_FILTER_DRIVER_EXCEPTION (135)
This bugcheck is caused by an unhandled exception in a registry filtering driver.
This bugcheck indicates that a registry filtering driver didn't handle exception inside
its notification routine. One can identify the driver by the 3rd parameter.
Arguments:
Arg1: ffffffffc0000006, ExceptionCode
Arg2: fffffe00d30dd6b0, Address of the context record for the exception that caused the bugcheck
Arg3: fffff8035a387020, The driver's callback routine address
Arg4: ffffc18e0c2b95a0, Internal
Debugging Details:
------------------
*** WARNING: Unable to verify timestamp for win32k.sys
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 9640
Key : Analysis.DebugAnalysisProvider.CPP
Value: Create: 8007007e on DESKTOP-J7A11VA
Key : Analysis.DebugData
Value: CreateObject
Key : Analysis.DebugModel
Value: CreateObject
Key : Analysis.Elapsed.mSec
Value: 23867
Key : Analysis.Memory.CommitPeak.Mb
Value: 77
Key : Analysis.System
Value: CreateObject
Key : WER.OS.Branch
Value: 19h1_release
Key : WER.OS.Timestamp
Value: 2019-03-18T12:02:00Z
Key : WER.OS.Version
Value: 10.0.18362.1
ADDITIONAL_XML: 1
OS_BUILD_LAYERS: 1
BUGCHECK_CODE: 135
BUGCHECK_P1: ffffffffc0000006
BUGCHECK_P2: fffffe00d30dd6b0
BUGCHECK_P3: fffff8035a387020
BUGCHECK_P4: ffffc18e0c2b95a0
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: Registry
STACK_TEXT:
fffffe00`d30dce18 fffff803`58225ff4 : 00000000`00000135 ffffffff`c0000006 fffffe00`d30dd6b0 fffff803`5a387020 : nt!KeBugCheckEx
fffffe00`d30dce20 fffff803`5819c039 : fffffe00`d30de0a8 fffffe00`d30dd6b0 fffffe00`d30d9000 fffffe00`d30e0000 : nt!CmpCallbackFatalFilter+0x24
fffffe00`d30dce60 fffff803`57b9da79 : fffffe00`00000003 fffffe00`d30df090 fffffe00`d30d9000 fffffe00`d30e0000 : nt!CmpCallCallBacksEx$filt$1+0x19
fffffe00`d30dce90 fffff803`57bcbacf : fffffe00`d30df090 fffffe00`d30dd470 00000000`00000000 00000000`00000000 : nt!_C_specific_handler+0xa9
fffffe00`d30dcf00 fffff803`57a0cca5 : 00000000`000015a8 00000000`00000000 fffffe00`d30dd470 00007fff`ffff0000 : nt!RtlpExecuteHandlerForException+0xf
fffffe00`d30dcf30 fffff803`57a0b33e : fffffe00`d30dde68 fffffe00`d30ddbb0 fffffe00`d30dde68 ffffc18e`0cdd1000 : nt!RtlDispatchException+0x4a5
fffffe00`d30dd680 fffff803`57bd4c5d : ffff8b86`9d504640 fffff803`57a975a6 00000000`00001000 fffffe00`d30ddf10 : nt!KiDispatchException+0x16e
fffffe00`d30ddd30 fffff803`57bd0e43 : 00000000`00000000 00000000`00000000 ffffc18e`15fd8a50 00000000`00000000 : nt!KiExceptionDispatch+0x11d
fffffe00`d30ddf10 fffff803`58099df2 : fffff803`58071077 00000000`0f912aec 00000000`c466d1ad ffffc18e`00000001 : nt!KiPageFault+0x443
fffffe00`d30de0a8 fffff803`58071077 : 00000000`0f912aec 00000000`c466d1ad ffffc18e`00000001 ffffc18e`15fd8a50 : nt!HvpGetCellPaged+0xa2
fffffe00`d30de0b0 fffff803`57fda6da : ffffc18e`15fd8a50 00000000`00000007 fffffe00`d30de2a8 fffffe00`d30de310 : nt!CmpWalkOneLevel+0x4b7
fffffe00`d30de1c0 fffff803`57fd7744 : ffffffff`0000001c fffffe00`d30de510 fffffe00`d30de4d8 00000000`00000000 : nt!CmpDoParseKey+0x9fa
fffffe00`d30de460 fffff803`57fd562f : ffff8b86`b10c99a0 ffffc18e`10ce3c01 00000000`00000000 00000000`00000000 : nt!CmpParseKey+0x274
fffffe00`d30de680 fffff803`57fd3a91 : ffff8b86`b10c9900 fffffe00`d30de8c8 ffffc18e`00000240 ffff8b86`9d4de560 : nt!ObpLookupObjectName+0x78f
fffffe00`d30de840 fffff803`57fdcfac : 00000000`00000001 00000000`00000000 00000000`00000000 ffff8b86`9d4de560 : nt!ObOpenObjectByNameEx+0x201
fffffe00`d30de980 fffff803`57fdce2d : fffffe00`d30dee70 fffffe00`d30decf0 00000000`00000000 ffff8b86`b07d7001 : nt!ObOpenObjectByName+0x5c
fffffe00`d30de9d0 fffff803`580b9782 : 00000000`00442a7b 00000801`00000000 00020019`00000000 00000000`00020019 : nt!CmOpenKey+0x29d
fffffe00`d30dec30 fffff803`57bd4555 : 00000000`00000000 fffffe00`d30decd0 00000000`00000000 00000000`00000000 : nt!NtOpenKey+0x12
fffffe00`d30dec70 fffff803`57bc6b00 : fffff803`5a3888a1 00000000`00000000 00000000`00000001 ffffc18e`10ce3c70 : nt!KiSystemServiceCopyEnd+0x25
fffffe00`d30dee08 fffff803`5a3888a1 : 00000000`00000000 00000000`00000001 ffffc18e`10ce3c70 ffff8b86`b10d1270 : nt!KiServiceLinkage
fffffe00`d30dee10 fffff803`5a388b88 : 00000000`00000000 ffffffff`800026ac 00000000`00000000 00000000`00000000 : WdFilter!MpRegpCheckExistingKey+0x151
fffffe00`d30deef0 fffff803`5a3885c8 : 00000000`00000000 00000000`01ffed15 fffffe00`d30defb8 fffffe00`d30df0a8 : WdFilter!MpRegPreCreateKeyEx+0x90
fffffe00`d30def80 fffff803`57fd6eaf : fffffe00`d30df250 00000000`0000001a 00000000`00000000 fffff803`57e63c00 : WdFilter!MpRegCallback+0x15a8
fffffe00`d30df090 fffff803`57fd76ed : fffffe00`0000001a fffffe00`d30df250 fffffe00`d30df218 00000000`00000001 : nt!CmpCallCallBacksEx+0x39f
fffffe00`d30df1a0 fffff803`57fd562f : ffff8b86`b10d1270 ffffc18e`10ce3c00 00000000`00000000 00000000`00000001 : nt!CmpParseKey+0x21d
fffffe00`d30df3c0 fffff803`57fd3a91 : ffff8b86`b10d1200 fffffe00`d30df608 ffffc18e`00000040 ffff8b86`9d4de560 : nt!ObpLookupObjectName+0x78f
fffffe00`d30df580 fffff803`5801a235 : fffff803`00000001 ffff8b86`9d4de560 000000a7`b8ffec20 00000000`000f003f : nt!ObOpenObjectByNameEx+0x201
fffffe00`d30df6c0 fffff803`58019dae : ffffdf48`9165db98 00000000`00000000 00000000`00000000 000000a7`b8ffeb28 : nt!CmCreateKey+0x475
fffffe00`d30df940 fffff803`57bd4555 : 00000000`00000000 00000000`00000000 00000000`00000000 000000a7`b8ffef38 : nt!NtCreateKey+0x2e
fffffe00`d30df990 00007ffe`8f8bc464 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x25
000000a7`b8ffeac8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffe`8f8bc464
SYMBOL_NAME: WdFilter!MpRegpCheckExistingKey+151
MODULE_NAME: WdFilter
IMAGE_NAME: WdFilter.sys
IMAGE_VERSION: 4.18.2009.7
STACK_COMMAND: .thread ; .cxr ; kb
BUCKET_ID_FUNC_OFFSET: 151
FAILURE_BUCKET_ID: 0x135_WdFilter!MpRegpCheckExistingKey
OS_VERSION: 10.0.18362.1
BUILDLAB_STR: 19h1_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {e47a4972-b2d6-3eb2-5b55-cea37377c64f}
Followup: MachineOwner
---------
2: kd> !blackboxntfs
NTFS Blackbox Data
Record 0:
Record type: 1 (Slow I/O Timeout)
Record length: 32
Irp: ffff8b86b0fd09a0
Scb: ffff8b86a8c738a0
Thread: ffff8b86af2e0080
Record 1:
Record type: 1 (Slow I/O Timeout)
Record length: 32
Irp: ffff8b86aacf2950
Scb: ffffc18e20fb1170
Thread: ffff8b86af385040
Record 2:
Record type: 1 (Slow I/O Timeout)
Record length: 32
Irp: ffff8b86aa11ba70
Scb: ffffc18e20fc0170
Thread: ffff8b869d508080
Record 3:
Record type: 1 (Slow I/O Timeout)
Record length: 32
Irp: ffff8b86aa7d5010
Scb: ffffc18e148e4880
Thread: ffff8b86ade8b040
Record 4:
Record type: 1 (Slow I/O Timeout)
Record length: 32
Irp: ffff8b86ae1c09a0
Scb: ffffc18e20fb7170
Thread: ffff8b86a8f11040
Record 5:
Record type: 1 (Slow I/O Timeout)
Record length: 32
Irp: ffff8b86aa118a80
Scb: ffffc18e20fb2880
Thread: ffff8b86ad8a9040
Record 6:
Record type: 1 (Slow I/O Timeout)
Record length: 32
Irp: ffff8b86afac69a0
Scb: ffffc18e17257170
Thread: ffff8b86ae105080