9: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the BugCheck
Arg2: fffff80482c936b8, Address of the instruction which caused the BugCheck
Arg3: ffffdd0059bc6a40, Address of the context record for the exception that caused the BugCheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 3452
Key : Analysis.Elapsed.mSec
Value: 8372
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 358
Key : Analysis.Init.Elapsed.mSec
Value: 2280
Key : Analysis.Memory.CommitPeak.Mb
Value: 96
Key : Bugcheck.Code.LegacyAPI
Value: 0x3b
Key : Failure.Bucket
Value: AV_Npfs!NpFsdWrite
Key : Failure.Hash
Value: {c7a8f3eb-1b12-da96-eca7-b8ff2fe98a86}
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 3b
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff80482c936b8
BUGCHECK_P3: ffffdd0059bc6a40
BUGCHECK_P4: 0
FILE_IN_CAB: 062723-8281-01.dmp
CONTEXT: ffffdd0059bc6a40 -- (.cxr 0xffffdd0059bc6a40)
rax=0000000000000000 rbx=c400000000000000 rcx=c400000000000000
rdx=00000000ffffffff rsi=ffffffffffffffff rdi=ffffa30c1b0ba730
rip=fffff80482c936b8 rsp=ffffdd0059bc7440 rbp=ffffdd0059bc75a9
r8=0000000000000001 r9=0000000000000000 r10=fffff80482c92560
r11=ffffdd0059bc7608 r12=0000000000000000 r13=0000000000000002
r14=ffffffff5ffffffd r15=0000000000400201
iopl=0 nv up ei ng nz na pe nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050282
nt!MmUnlockPages+0x18:
fffff804`82c936b8 0fb7690a movzx ebp,word ptr [rcx+0Ah] ds:002b:c4000000`0000000a=????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: chrome.exe
STACK_TEXT:
ffffdd00`59bc7440 fffff804`82c92ad8 : c4000000`00000000 ffffdd00`59bc75a9 ffffffff`ffffffff fffff804`82c20973 : nt!MmUnlockPages+0x18
ffffdd00`59bc7530 fffff804`82c92577 : ffffa30c`1b0ba730 ffffa30c`0bb7c502 00000000`00000000 ffffa30c`1beb08b8 : nt!IopfCompleteRequest+0x548
ffffdd00`59bc7610 fffff804`97c6d834 : 00000000`00000000 00001628`047a56f0 ffffa30c`1beb07a0 ffffa30b`fccd2600 : nt!IofCompleteRequest+0x17
ffffdd00`59bc7640 fffff804`82c11385 : ffffa30b`f096cca0 00000000`00000000 ffffa30c`0bcfe5f0 00000000`00000000 : Npfs!NpFsdWrite+0x94
ffffdd00`59bc76b0 fffff804`80e74a76 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!IofCallDriver+0x55
ffffdd00`59bc76f0 fffff804`82c11385 : 00000000`00000001 00000000`00000000 00000000`00000010 00000000`00000019 : FLTMGR!FltpDispatch+0xd6
ffffdd00`59bc7750 fffff804`83010b1c : 00000000`00000001 00000000`00000000 00000000`00000000 ffffa30c`0bb7c580 : nt!IofCallDriver+0x55
ffffdd00`59bc7790 fffff804`82fcccb9 : ffffdd00`59bc7890 ffffdd00`59bc7940 ffffa30c`1beb07a0 00000000`00000000 : nt!IopSynchronousServiceTail+0x34c
ffffdd00`59bc7830 fffff804`82ff8e56 : ffffa30c`0bb7c580 00001628`00db6290 ffffa30c`1beb07a0 00001628`00db6290 : nt!IopWriteFile+0x23d
ffffdd00`59bc7930 fffff804`82e0f4f8 : 00ffffff`ffffffff 00000000`00000000 00000000`00000000 00001628`00db6290 : nt!NtWriteFile+0x996
ffffdd00`59bc7a50 00007ffc`3bc6d164 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000015`19bfc668 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`3bc6d164
SYMBOL_NAME: Npfs!NpFsdWrite+94
MODULE_NAME: Npfs
IMAGE_NAME: Npfs.SYS
IMAGE_VERSION: 10.0.19041.1526
STACK_COMMAND: .cxr 0xffffdd0059bc6a40 ; kb
BUCKET_ID_FUNC_OFFSET: 94
FAILURE_BUCKET_ID: AV_Npfs!NpFsdWrite
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {c7a8f3eb-1b12-da96-eca7-b8ff2fe98a86}
Followup: MachineOwner
---------
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
SYSTEM_SERVICE_EXCEPTION (3b)
An exception happened while executing a system service routine.
Arguments:
Arg1: 00000000c0000005, Exception code that caused the BugCheck
Arg2: fffff80412463e0b, Address of the instruction which caused the BugCheck
Arg3: ffff84066c038520, Address of the context record for the exception that caused the BugCheck
Arg4: 0000000000000000, zero.
Debugging Details:
------------------
KEY_VALUES_STRING: 1
Key : Analysis.CPU.mSec
Value: 2655
Key : Analysis.Elapsed.mSec
Value: 4840
Key : Analysis.IO.Other.Mb
Value: 0
Key : Analysis.IO.Read.Mb
Value: 0
Key : Analysis.IO.Write.Mb
Value: 0
Key : Analysis.Init.CPU.mSec
Value: 374
Key : Analysis.Init.Elapsed.mSec
Value: 1499
Key : Analysis.Memory.CommitPeak.Mb
Value: 97
Key : Bugcheck.Code.LegacyAPI
Value: 0x3b
Key : Failure.Bucket
Value: AV_WdFilter!MpAmPostCreate
Key : Failure.Hash
Value: {73fed430-1b9a-360c-971b-b47c8de3b9ae}
Key : WER.OS.Branch
Value: vb_release
Key : WER.OS.Version
Value: 10.0.19041.1
BUGCHECK_CODE: 3b
BUGCHECK_P1: c0000005
BUGCHECK_P2: fffff80412463e0b
BUGCHECK_P3: ffff84066c038520
BUGCHECK_P4: 0
FILE_IN_CAB: 062623-9343-01.dmp
CONTEXT: ffff84066c038520 -- (.cxr 0xffff84066c038520)
rax=0400000000000000 rbx=ffff91888f67d010 rcx=0400000000000000
rdx=0000000000000001 rsi=ffff91888a42ad20 rdi=0000000000000000
rip=fffff80412463e0b rsp=ffff84066c038f20 rbp=0000000000000000
r8=ffff84066c038f30 r9=7fffa30ce6f6b788 r10=fffff80416020c00
r11=ffff84066c038f50 r12=0000000000000000 r13=ffffa30cf542c210
r14=ffff84066c038fd8 r15=ffff91888a42ad68
iopl=0 nv up ei pl nz na po nc
cs=0010 ss=0018 ds=002b es=002b fs=0053 gs=002b efl=00050206
FLTMGR!FltGetStreamContext+0x7b:
fffff804`12463e0b 488b4920 mov rcx,qword ptr [rcx+20h] ds:002b:04000000`00000020=????????????????
Resetting default scope
BLACKBOXBSD: 1 (!blackboxbsd)
BLACKBOXNTFS: 1 (!blackboxntfs)
BLACKBOXPNP: 1 (!blackboxpnp)
BLACKBOXWINLOGON: 1
CUSTOMER_CRASH_COUNT: 1
PROCESS_NAME: explorer.exe
STACK_TEXT:
ffff8406`6c038f20 fffff804`a758b30c : ffff9188`8a42ad20 ffff8406`6c039130 ffff9188`8eee9c08 ffff8406`6c0391b8 : FLTMGR!FltGetStreamContext+0x7b
ffff8406`6c038f70 fffff804`a758f64e : ffff9188`8eee9c08 ffff9188`8eee9c08 ffffa30c`e182ac60 ffff9188`00000000 : WdFilter!MpAmPostCreate+0x2d4
ffff8406`6c0390e0 fffff804`12465b86 : ffff9188`8eee9b20 fffff804`1602667b ffff9188`00000000 ffffa30c`00000000 : WdFilter!MpPostCreate+0x3ce
ffff8406`6c039170 fffff804`1246545b : ffff9188`8eee9b00 fffff804`12497e00 00000000`00000000 00000000`00000000 : FLTMGR!FltpPerformPostCallbacksWorker+0x346
ffff8406`6c039240 fffff804`124671a2 : ffff8406`6c033000 ffff8406`6c03a000 00000000`00000000 fffff804`1247c490 : FLTMGR!FltpPassThroughCompletionWorker+0xfb
ffff8406`6c0392e0 fffff804`12499f54 : ffff8406`6c039390 ffff9188`888ac568 ffff9188`7bbdbd90 00000000`00000000 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x322
ffff8406`6c039350 fffff804`16011385 : 00000000`00000000 ffff9188`7bbc48f0 00000000`00000000 00000000`00000000 : FLTMGR!FltpCreate+0x324
ffff8406`6c039400 fffff804`1600d944 : 00000000`00000003 ffff9188`90d99a20 ffff9188`6d4e6f49 fffff804`1600d8b3 : nt!IofCallDriver+0x55
ffff8406`6c039440 fffff804`163ff58b : ffff8406`6c039700 ffff9188`7bbc48f0 ffff9188`888ac5a8 00000000`00000000 : nt!IoCallDriverWithTracing+0x34
ffff8406`6c039490 fffff804`1641501e : ffff9188`7bbc48f0 00000000`00000048 ffff9188`897a9010 ffff9188`897a9001 : nt!IopParseDevice+0x11bb
ffff8406`6c039600 fffff804`1640ccea : ffff9188`897a9000 ffff8406`6c039868 00000000`00000040 ffff9188`78ac1560 : nt!ObpLookupObjectName+0x3fe
ffff8406`6c0397d0 fffff804`163fd0ac : ffff9188`00000000 00000000`26aae2d0 00000000`00000001 00000000`00000000 : nt!ObOpenObjectByNameEx+0x1fa
ffff8406`6c039900 fffff804`163fbd69 : 00000000`26aae270 00000000`00130080 00000000`26aae2d0 00000000`26aae278 : nt!IopCreateFile+0x132c
ffff8406`6c0399c0 fffff804`1620f4f8 : 00000000`00005524 00000000`26aad1a0 00000000`26aad250 00000000`00000074 : nt!NtCreateFile+0x79
ffff8406`6c039a50 00007ffd`1a60db04 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x28
00000000`26aae1e8 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffd`1a60db04
SYMBOL_NAME: WdFilter!MpAmPostCreate+2d4
MODULE_NAME: WdFilter
IMAGE_NAME: WdFilter.sys
IMAGE_VERSION: 4.18.23050.5
STACK_COMMAND: .cxr 0xffff84066c038520 ; kb
BUCKET_ID_FUNC_OFFSET: 2d4
FAILURE_BUCKET_ID: AV_WdFilter!MpAmPostCreate
OS_VERSION: 10.0.19041.1
BUILDLAB_STR: vb_release
OSPLATFORM_TYPE: x64
OSNAME: Windows 10
FAILURE_ID_HASH: {73fed430-1b9a-360c-971b-b47c8de3b9ae}
Followup: MachineOwner
---------
