Two reasons for the unexpectedly high Microsoft Corporation count: if a failure isn't known or obvious to the auto-triage system, it might by default go into the Microsoft bucket. The other reason is that drivers might corrupt data structures or cause similar problems that will only result in a crash down the line, in Microsoft code. An example of this is if you pass the wrong kind of memory to any of the kernel wait functions. You'll only find out about this down the line when the wait gets satisfied, and only in some particular circumstances... in this case it would appear to be a Microsoft component faulting to the auto-triager.