Microsoft (R) Windows Debugger Version 10.0.25200.1003 AMD64 Copyright (c) Microsoft Corporation. All rights reserved. Loading Dump File [C:\Windows\Minidumps\120522-7046-01.dmp] Mini Kernel Dump File: Only registers and stack trace are available ************* Path validation summary ************** Response Time (ms) Location Deferred srv* Symbol search path is: srv* Executable search path is: Windows 10 Kernel Version 19041 MP (12 procs) Free x64 Product: WinNt, suite: TerminalServer SingleUserTS Personal Machine Name: Kernel base = 0xfffff807`09600000 PsLoadedModuleList = 0xfffff807`0a22a2f0 Debug session time: Mon Dec 5 13:52:57.585 2022 (UTC - 8:00) System Uptime: 0 days 3:40:20.190 Loading Kernel Symbols ............................................................... ................................................................ ................................................................ .. Loading User Symbols Loading unloaded module list ........................... For analysis of this file, run !analyze -v nt!KeBugCheckEx: fffff807`099f9290 48894c2408 mov qword ptr [rsp+8],rcx ss:0018:fffff88d`5e2f6c90=000000000000001e 2: kd> !analyze -v ******************************************************************************* * * * Bugcheck Analysis * * * ******************************************************************************* KMODE_EXCEPTION_NOT_HANDLED (1e) This is a very common BugCheck. Usually the exception address pinpoints the driver/function that caused the problem. Always note this address as well as the link date of the driver/image that contains this address. Arguments: Arg1: ffffffffc0000005, The exception code that was not handled Arg2: 000000010000001e, The address that the exception occurred at Arg3: 0000000000000008, Parameter 0 of the exception Arg4: 000000010000001e, Parameter 1 of the exception Debugging Details: ------------------ ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: ExceptionRecord *** *** *** ************************************************************************* ************************************************************************* *** *** *** *** *** Either you specified an unqualified symbol, or your debugger *** *** doesn't have full symbol information. Unqualified symbol *** *** resolution is turned off by default. Please either specify a *** *** fully qualified symbol module!symbolname, or enable resolution *** *** of unqualified symbols by typing ".symopt- 100". Note that *** *** enabling unqualified symbol resolution with network symbol *** *** server shares in the symbol path may cause the debugger to *** *** appear to hang for long periods of time when an incorrect *** *** symbol name is typed or the network symbol server is down. *** *** *** *** For some commands to work properly, your symbol path *** *** must point to .pdb files that have full type information. *** *** *** *** Certain .pdb files (such as the public OS symbols) do not *** *** contain the required information. Contact the group that *** *** provided you with these symbols if you need this command to *** *** work. *** *** *** *** Type referenced: ContextRecord *** *** *** ************************************************************************* KEY_VALUES_STRING: 1 Key : Analysis.CPU.mSec Value: 3265 Key : Analysis.DebugAnalysisManager Value: Create Key : Analysis.Elapsed.mSec Value: 6344 Key : Analysis.IO.Other.Mb Value: 0 Key : Analysis.IO.Read.Mb Value: 0 Key : Analysis.IO.Write.Mb Value: 0 Key : Analysis.Init.CPU.mSec Value: 311 Key : Analysis.Init.Elapsed.mSec Value: 4073 Key : Analysis.Memory.CommitPeak.Mb Value: 83 Key : Bugcheck.Code.DumpHeader Value: 0x1e Key : Bugcheck.Code.Register Value: 0x1e Key : Dump.Attributes.AsUlong Value: 8 Key : Dump.Attributes.KernelGeneratedTriageDump Value: 1 FILE_IN_CAB: 120522-7046-01.dmp DUMP_FILE_ATTRIBUTES: 0x8 Kernel Generated Triage Dump BUGCHECK_CODE: 1e BUGCHECK_P1: ffffffffc0000005 BUGCHECK_P2: 10000001e BUGCHECK_P3: 8 BUGCHECK_P4: 10000001e EXCEPTION_PARAMETER1: 0000000000000008 EXCEPTION_PARAMETER2: 000000010000001e WRITE_ADDRESS: fffff8070a2fb390: Unable to get MiVisibleState Unable to get NonPagedPoolStart Unable to get NonPagedPoolEnd Unable to get PagedPoolStart Unable to get PagedPoolEnd unable to get nt!MmSpecialPagesInUse 000000010000001e BLACKBOXBSD: 1 (!blackboxbsd) BLACKBOXNTFS: 1 (!blackboxntfs) BLACKBOXPNP: 1 (!blackboxpnp) BLACKBOXWINLOGON: 1 CUSTOMER_CRASH_COUNT: 1 PROCESS_NAME: WmiPrvSE.exe TRAP_FRAME: ffff800000000000 -- (.trap 0xffff800000000000) Unable to read trap frame at ffff8000`00000000 STACK_TEXT: fffff88d`5e2f6c88 fffff807`09a3f495 : 00000000`0000001e ffffffff`c0000005 00000001`0000001e 00000000`00000008 : nt!KeBugCheckEx fffff88d`5e2f6c90 fffff807`09a0d46c : 00000000`00001000 fffff88d`5e2f7530 ffff8000`00000000 00000000`00000000 : nt!KiDispatchException+0x1c8f45 fffff88d`5e2f7350 fffff807`09a08ebd : 00000000`00100001 ffffde81`98b04d60 ffffde81`b76b8080 ffffde81`b82b0120 : nt!KiExceptionDispatch+0x12c fffff88d`5e2f7530 00000001`0000001e : 00000000`00000000 00000040`00000000 ffffde81`0000003f fffff807`09c2da81 : nt!KiPageFault+0x43d fffff88d`5e2f76c0 00000000`00000000 : 00000040`00000000 ffffde81`0000003f fffff807`09c2da81 00000000`00e8001e : 0x00000001`0000001e SYMBOL_NAME: nt!KiDispatchException+1c8f45 MODULE_NAME: nt IMAGE_NAME: ntkrnlmp.exe IMAGE_VERSION: 10.0.19041.2311 STACK_COMMAND: .cxr; .ecxr ; kb BUCKET_ID_FUNC_OFFSET: 1c8f45 FAILURE_BUCKET_ID: AV_nt!KiDispatchException OSPLATFORM_TYPE: x64 OSNAME: Windows 10 FAILURE_ID_HASH: {00781d15-b897-afab-75cd-f83221cbf387} Followup: MachineOwner