Opened log file 'c:\Windows\Memory.log' 1: kd> !vm *** Virtual Memory Usage *** Physical Memory: 1031581 ( 4126324 Kb) Page File: \??\C:\pagefile.sys Current: 4433524 Kb Free Space: 4433520 Kb Minimum: 4433524 Kb Maximum: 12378972 Kb Type information missing error for MiSystemVaTypeCount Available Pages: 817652 ( 3270608 Kb) ResAvail Pages: 965229 ( 3860916 Kb) Locked IO Pages: 0 ( 0 Kb) Free System PTEs: 33555714 ( 134222856 Kb) Modified Pages: 15794 ( 63176 Kb) Modified PF Pages: 15793 ( 63172 Kb) NonPagedPool Usage: 88079121 ( 352316484 Kb) NonPagedPoolNx Usage: 12885 ( 51540 Kb) NonPagedPool Max: 764094 ( 3056376 Kb) ********** Excessive NonPaged Pool Usage ***** PagedPool 0 Usage: 35435 ( 141740 Kb) PagedPool 1 Usage: 3620 ( 14480 Kb) PagedPool 2 Usage: 573 ( 2292 Kb) PagedPool 3 Usage: 535 ( 2140 Kb) PagedPool 4 Usage: 538 ( 2152 Kb) PagedPool Usage: 40701 ( 162804 Kb) PagedPool Maximum: 33554432 ( 134217728 Kb) Session Commit: 9309 ( 37236 Kb) Shared Commit: 6460 ( 25840 Kb) Special Pool: 0 ( 0 Kb) Shared Process: 5760 ( 23040 Kb) PagedPool Commit: 40765 ( 163060 Kb) Driver Commit: 2805 ( 11220 Kb) Committed pages: 212472 ( 849888 Kb) Commit limit: 2139487 ( 8557948 Kb) Total Private: 88705 ( 354820 Kb) 0744 svchost.exe 19725 ( 78900 Kb) 06ac explorer.exe 11444 ( 45776 Kb) 0920 iexplore.exe 8828 ( 35312 Kb) 0354 svchost.exe 5589 ( 22356 Kb) 040c audiodg.exe 4003 ( 16012 Kb) 0334 svchost.exe 3852 ( 15408 Kb) 04e4 spoolsv.exe 3230 ( 12920 Kb) 012c svchost.exe 2802 ( 11208 Kb) 0168 iexplore.exe 2106 ( 8424 Kb) 0384 svchost.exe 2090 ( 8360 Kb) 042c svchost.exe 1938 ( 7752 Kb) 081c TrustedInstall 1398 ( 5592 Kb) 0218 lsass.exe 1314 ( 5256 Kb) 03d4 svchost.exe 1128 ( 4512 Kb) 0a78 WerFault.exe 1107 ( 4428 Kb) 0210 services.exe 1106 ( 4424 Kb) 0288 svchost.exe 980 ( 3920 Kb) 02d8 svchost.exe 891 ( 3564 Kb) 0438 msdtc.exe 851 ( 3404 Kb) 071c mscorsvw.exe 821 ( 3284 Kb) 0378 taskhost.exe 795 ( 3180 Kb) 01a8 psxss.exe 685 ( 2740 Kb) 08a0 jusched.exe 667 ( 2668 Kb) 09e0 jucheck.exe 621 ( 2484 Kb) 0bbc wfcrun32.exe 602 ( 2408 Kb) 0828 mscorsvw.exe 600 ( 2400 Kb) 0538 mdm.exe 595 ( 2380 Kb) 0220 lsm.exe 595 ( 2380 Kb) 067c dwm.exe 586 ( 2344 Kb) 01a0 csrss.exe 562 ( 2248 Kb) 016c csrss.exe 482 ( 1928 Kb) 05f8 wuauclt.exe 451 ( 1804 Kb) 0730 svchost.exe 436 ( 1744 Kb) 0890 concentr.exe 414 ( 1656 Kb) 01cc winlogon.exe 413 ( 1652 Kb) 0a1c svchost.exe 392 ( 1568 Kb) 01d8 wininit.exe 366 ( 1464 Kb) 07f4 ApplicationA.e 362 ( 1448 Kb) 0868 notepad.exe 358 ( 1432 Kb) 0a6c NotMyfault.exe 351 ( 1404 Kb) 1455c ApplicationA.e 327 ( 1308 Kb) 021c conhost.exe 290 ( 1160 Kb) 0be4 conhost.exe 286 ( 1144 Kb) 0248 conhost.exe 286 ( 1144 Kb) 14564 conhost.exe 285 ( 1140 Kb) 0bb4 conhost.exe 285 ( 1140 Kb) 0a14 conhost.exe 285 ( 1140 Kb) 0584 svchost.exe 231 ( 924 Kb) 0b94 ApplicationE.e 211 ( 844 Kb) 0abc ApplicationD.e 181 ( 724 Kb) 0b34 ApplicationC.e 179 ( 716 Kb) 0798 ApplicationB.e 178 ( 712 Kb) 011c smss.exe 115 ( 460 Kb) 0004 System 30 ( 120 Kb) 08ec wlrmdr.exe 0 ( 0 Kb) 1: kd> !stacks Proc.Thread .Thread Ticks ThreadState Blocker [fffffa8003baa890 System] 4.000074 fffffa8003c0fa10 ffffffed Blocked nt!MiModifiedPageWriter+0x5a 4.00008c fffffa8003c13040 ffff6300 Blocked nt!CcQueueLazyWriteScanThread+0x85 4.00009c fffffa8003c64490 ffff6300 Blocked nt!EtwpLogger+0xf2 4.0000a0 fffffa8003c656b0 ffff62c0 Blocked nt!EtwpLogger+0xf2 4.0000a4 fffffa8003c8c560 ffff63c1 Blocked nt!EtwpLogger+0xf2 4.0000a8 fffffa8003c91b60 ffff63c1 Blocked nt!EtwpLogger+0xf2 4.0000ac fffffa8003c9a040 ffff63c1 Blocked nt!EtwpLogger+0xf2 4.0000b0 fffffa8003c9a7a0 ffff62c0 Blocked nt!EtwpLogger+0xf2 4.0000b4 fffffa8003cbbb60 ffff62c0 Blocked nt!EtwpLogger+0xf2 4.0000b8 fffffa8003ce35e0 ffff62c0 Blocked nt!EtwpLogger+0xf2 4.0000bc fffffa8003ce8b60 ffffceb4 Blocked nt!EtwpLogger+0xf2 4.0000c0 fffffa8003cfd040 ffff6996 Blocked nt!WdipSemCheckTimeout+0x12c *** ERROR: Module load completed but symbols could not be loaded for sptd.sys 4.0000c4 fffffa8003d3c6a0 fffff963 Blocked sptd+0x60d87 4.0000c8 fffffa8003d3c1c0 fffffe3a Blocked sptd+0x60d87 4.0000cc fffffa8003d3d040 ffffff6f Blocked sptd+0x60d87 4.0000d0 fffffa8003d4bb10 fffffa9c Blocked ACPI!ACPIWorkerThread+0x74 4.0000d4 fffffa8003e58040 ffffff64 Blocked ACPI!PciRootBusBiosMethodDispatcherOnResume+0x51 4.0000d8 fffffa8003f96360 fffffee7 Blocked NDIS!ndisThreadPoolTimerHandler+0x21 4.0000e0 fffffa8003f9b040 ffff6897 Blocked NDIS!ndisCmWaitThread+0x6e 4.0000e4 fffffa8004062040 fffffecf Blocked volsnap!VspWorkerThread+0x80 4.0000e8 fffffa8004062b60 fffffecf Blocked volsnap!VspWorkerThread+0x80 4.0000ec fffffa8004062590 fffffecf Blocked volsnap!VspWorkerThread+0x80 4.0000f0 fffffa800406b040 fffffe25 Blocked volsnap!VspWorkerThread+0x80 4.0000f4 fffffa800406bb60 fffffecf Blocked volsnap!VspWorkerThread+0x80 4.0000f8 fffffa800406b680 fffffecf Blocked volsnap!VspWorkerThread+0x80 4.0000fc fffffa800406c040 fffffecf Blocked volsnap!VspWorkerThread+0x80 4.000100 fffffa800406cb60 fffffecf Blocked volsnap!VspWorkerThread+0x80 4.000104 fffffa800406c680 fffffecf Blocked volsnap!VspWorkerThread+0x80 4.000114 fffffa80042698b0 fffffdf9 Blocked blbdrive!BlbIoWorkerThread+0x33 4.000184 fffffa80048f2800 fffff9d6 Blocked watchdog!SMgrGdiCalloutThread+0x4f 4.0001f0 fffffa8004926060 ffff656b Blocked nt!IoRemoveIoCompletion+0x47 4.00022c fffffa8004974b60 ffffd05a Blocked nt!EtwpLogger+0xf2 4.0002c4 fffffa80049e1040 ffff650c Blocked luafv!SynchronousFsControl+0x216 4.0003f8 fffffa8004a6ab60 ffffab5e Blocked nt!EtwpLogger+0xf2 4.00045c fffffa8004ae5b60 fffff292 Blocked mpsdrv!IP6StringToAddress+0x626 4.0004c8 fffffa8004b83680 ffff7b1c Blocked HTTP!UlpScavengerThread+0x81 4.000614 fffffa8004c47040 ffffd52f Blocked srv2!SrvProcWorkerThread+0xf1 4.000618 fffffa8004c49b60 fffff2c3 Blocked srv2!SrvProcWorkerThread+0xf1 4.000620 fffffa8004c48040 ffffd95b Blocked srv2!SrvProcWorkerThread+0xf1 4.000628 fffffa8004c48b60 fffff2c1 Blocked srv2!SrvProcWorkerThread+0xf1 4.00062c fffffa8004c50b60 fffff2c0 Blocked srv2!SrvProcWorkerThread+0xf1 4.0007fc fffffa8004adc060 ffff6300 Blocked nt!EtwpLogger+0xf2 4.000880 fffffa8004ea1060 ffffe65e Blocked nt!EtwpLogger+0xf2 4.00093c fffffa80050b8b60 ffffcf0c Blocked nt!EtwpLogger+0xf2 [fffffa8004277870 smss.exe] [fffffa80048f3950 csrss.exe] 16c.000190 fffffa8003cf8b60 ffff62cc Blocked nt!AlpcpReceiveMessagePort+0x189 16c.0001b0 fffffa800490d060 ffff62cc Blocked nt!AlpcpReceiveMessagePort+0x189 16c.00054c fffffa8004be1b60 ffff63f7 Blocked nt!AlpcpReceiveMessagePort+0x189 [fffffa8003cf60f0 csrss.exe] 1a0.0001bc fffffa800490c340 ffff6557 Blocked nt!AlpcpReceiveMessagePort+0x189 1a0.0001d4 fffffa800491fb60 ffff63ac Blocked nt!AlpcpReceiveMessagePort+0x189 1a0.000200 fffffa800493f060 ffff629e Blocked win32k!xxxMsgWaitForMultipleObjects+0x108 1a0.000684 fffffa8004d42b60 ffff66f0 Blocked nt!AlpcpReceiveMessagePort+0x189 [fffffa80048ec6c0 psxss.exe] 1a8.0009d8 fffffa8003c28060 ffff6543 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa800491d910 winlogon.exe] 1cc.000b70 fffffa8004553b60 ffff70f7 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa800491f630 wininit.exe] 1d8.0006d4 fffffa8004ffb060 ffff65f5 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa80049655f0 services.exe] 210.000254 fffffa80049b5060 ffff64ed Blocked nt!ObpWaitForMultipleObjects+0x294 210.000274 fffffa80049be6c0 ffff6e45 Blocked nt!ObpWaitForMultipleObjects+0x294 210.000834 fffffa8004fcdb60 ffff64ed Blocked nt!IoRemoveIoCompletion+0x47 210.000154 fffffa80050d4060 ffff6505 Blocked nt!IoRemoveIoCompletion+0x47 210.0008e8 fffffa8005332b60 ffff6f45 Blocked nt!IoRemoveIoCompletion+0x47 210.000494 fffffa8005186060 ffff6f45 Blocked nt!IoRemoveIoCompletion+0x47 210.0009e4 fffffa8005187060 ffff6f45 Blocked nt!IoRemoveIoCompletion+0x47 210.000320 fffffa800535fb60 ffff6f45 Blocked nt!IoRemoveIoCompletion+0x47 210.0008b4 fffffa8005360060 ffff68d8 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8004970b30 lsass.exe] 218.000238 fffffa8004998060 ffff6331 Blocked nt!ObpWaitForMultipleObjects+0x294 218.000240 fffffa8004999490 ffff6f45 Blocked nt!IoRemoveIoCompletion+0x47 218.000284 fffffa80049c4060 ffff6331 Blocked nt!IoRemoveIoCompletion+0x47 218.000148 fffffa800452c060 ffff6331 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8004972b30 lsm.exe] 220.0003f4 fffffa8004e9db60 ffff6d8c Blocked nt!IoRemoveIoCompletion+0x47 220.000a4c fffffa8004f64b60 ffff6f45 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa80049c6b30 svchost.exe] 288.000330 fffffa8004571060 ffff727e Blocked nt!IoRemoveIoCompletion+0x47 288.000814 fffffa8004581950 ffff64ed Blocked nt!IoRemoveIoCompletion+0x47 288.0008c4 fffffa80050a0960 ffff6825 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa80049dc060 svchost.exe] 2d8.0002f0 fffffa80049ed060 ffff7080 Blocked nt!ObpWaitForMultipleObjects+0x294 2d8.0002f8 fffffa80049ef850 ffff661a Blocked nt!KiSystemServiceCopyEnd+0x13 2d8.000498 fffffa8004925060 ffff6521 Blocked nt!IoRemoveIoCompletion+0x47 2d8.0006e4 fffffa8004c1e5e0 ffff6521 Blocked nt!KiSystemServiceCopyEnd+0x13 2d8.000a44 fffffa8004f36060 ffff6466 Blocked nt!IoRemoveIoCompletion+0x47 2d8.0005b0 fffffa8004523660 ffff7080 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8004a1b740 svchost.exe] 334.00033c fffffa8004a1e5c0 ffff673d Blocked nt!ObpWaitForMultipleObjects+0x294 334.000350 fffffa8004a24060 ffff702a Blocked nt!ObpWaitForMultipleObjects+0x294 334.000084 fffffa8004a79b60 ffff88d0 Blocked nt!ObpWaitForMultipleObjects+0x294 334.000174 fffffa8004a88340 ffff6b8b Blocked nt!ObpWaitForMultipleObjects+0x294 334.000548 fffffa8004be3620 ffff63c1 Blocked nt!ObpWaitForMultipleObjects+0x294 334.000554 fffffa8004b0a4f0 ffff63c1 Blocked nt!ObpWaitForMultipleObjects+0x294 334.000a70 fffffa80050e82b0 ffff68d7 Blocked nt!IoRemoveIoCompletion+0x47 334.00097c fffffa800510a990 ffff668a Blocked nt!KiSystemServiceCopyEnd+0x13 334.0005fc fffffa8004580660 ffff64ed Blocked nt!IoRemoveIoCompletion+0x47 334.0002d0 fffffa8004df6860 ffff64ed Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8004a282f0 svchost.exe] 354.00035c fffffa8004a2b060 ffff62d2 Blocked nt!ObpWaitForMultipleObjects+0x294 354.0002c8 fffffa8004abb060 ffff6889 Blocked nt!KiSystemServiceCopyEnd+0x13 354.000368 fffffa8004ac1720 ffff6889 Blocked nt!ObpWaitForMultipleObjects+0x294 354.000698 fffffa8004c82b60 ffff62d2 Blocked nt!IoRemoveIoCompletion+0x47 354.000a48 fffffa800502c390 ffff887d Blocked nt!AlpcpReceiveMessagePort+0x189 354.0009c8 fffffa8005101b60 ffff6513 Blocked nt!IoRemoveIoCompletion+0x47 354.0006b0 fffffa80049044a0 ffff62d2 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8004a444f0 svchost.exe] 384.00038c fffffa8004a465c0 ffff62a9 Blocked nt!ObpWaitForMultipleObjects+0x294 384.000394 fffffa8004a48b60 ffff6b68 Blocked nt!IoRemoveIoCompletion+0x47 384.0003cc fffffa8004a57060 ffff76fd Blocked nt!IoRemoveIoCompletion+0x47 384.0005e0 fffffa8004afeb60 ffff62c0 Blocked nt!KiSystemServiceCopyEnd+0x13 384.000be8 fffffa8004ff7b60 ffff62a9 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8004a57b30 svchost.exe] 3d4.0003ec fffffa8004a61060 ffff8761 Blocked nt!AlpcpReceiveMessagePort+0x189 [fffffa8004a7c590 svchost.exe] 12c.000130 fffffa8004a7e060 ffff62af Blocked nt!ObpWaitForMultipleObjects+0x294 12c.0004a4 fffffa8004b25060 ffff62af Blocked nt!IoRemoveIoCompletion+0x47 12c.000bd4 fffffa8005368910 ffff62af Blocked nt!IoRemoveIoCompletion+0x47 12c.000b38 fffffa80053e9b60 ffff68f1 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8004aca060 audiodg.exe] 40c.00041c fffffa8004acd740 ffff6829 Blocked nt!ObpWaitForMultipleObjects+0x294 40c.000820 fffffa8004fd8930 ffff6828 Blocked nt!IoRemoveIoCompletion+0x47 40c.000a30 fffffa800510a490 ffff688a Blocked nt!IoRemoveIoCompletion+0x47 40c.000a18 fffffa80050a0060 ffff668a Blocked nt!KiSystemServiceCopyEnd+0x13 40c.0002e0 fffffa8004f7a060 ffff6810 Blocked nt!IoRemoveIoCompletion+0x47 40c.00064c fffffa80053ee700 ffff6b3e Blocked nt!IoRemoveIoCompletion+0x47 [fffffa800495db30 svchost.exe] 42c.00043c fffffa8004ad6950 ffff6b7f Blocked nt!IoRemoveIoCompletion+0x47 42c.000910 fffffa8005073060 ffff6a83 Blocked nt!ObpWaitForMultipleObjects+0x294 42c.00a270 fffffa800608e660 ffff6b7f Blocked nt!IoRemoveIoCompletion+0x47 42c.00ad14 fffffa800616fb60 ffff6b79 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8004b9eb30 spoolsv.exe] 4e4.000520 fffffa8004bd3550 ffff6416 Blocked nt!ObpWaitForMultipleObjects+0x294 4e4.000780 fffffa8004d92910 ffff62ca Blocked nt!KiSystemServiceCopyEnd+0x13 4e4.000270 fffffa8004545b60 ffff732e Blocked nt!IoRemoveIoCompletion+0x47 4e4.0007b4 fffffa800516fb60 ffff6416 Blocked nt!IoRemoveIoCompletion+0x47 4e4.000988 fffffa800540e660 ffff6416 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8004bdeb30 mdm.exe] 538.000574 fffffa8004bfd400 ffff63f2 Blocked win32k!xxxRealSleepThread+0x257 538.00057c fffffa8004bfeb60 ffff62e1 Blocked win32k!xxxRealSleepThread+0x257 538.000710 fffffa800455a060 ffff6657 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8004c05790 svchost.exe] 584.000590 fffffa8004c081c0 ffff6d13 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8004d16060 svchost.exe] 730.000954 fffffa80050eeb60 ffff70dc Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8004ce66a0 svchost.exe] 744.0007d4 fffffa8004cdd290 ffff6db2 Blocked nt!KiSystemServiceCopyEnd+0x13 744.0007e0 fffffa8004ce38e0 ffff67e2 Blocked nt!ObpWaitForMultipleObjects+0x294 744.000398 fffffa8004ccd490 ffff6380 Blocked nt!ObpWaitForMultipleObjects+0x294 744.00094c fffffa8004f2d060 ffff67e2 Blocked nt!IoRemoveIoCompletion+0x47 744.000950 fffffa8004f2d6c0 ffff67e2 Blocked nt!IoRemoveIoCompletion+0x47 744.000414 fffffa8004545660 ffff67e2 Blocked nt!IoRemoveIoCompletion+0x47 744.01456c fffffa80050bab60 ffff6831 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8004d23b30 taskhost.exe] 378.00069c fffffa8004d3e060 ffff62a5 Blocked nt!ObpWaitForMultipleObjects+0x294 378.0006e8 fffffa8004d4d060 ffff64e6 Blocked nt!AlpcpReceiveMessagePort+0x189 378.0006e0 fffffa8004d64b60 ffff6831 Blocked win32k!xxxRealSleepThread+0x257 378.00060c fffffa800458cb60 ffff7033 Blocked nt!IoRemoveIoCompletion+0x47 378.0009fc fffffa8004539060 ffff6831 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8004d3ab30 dwm.exe] 67c.0006cc fffffa8004d2a940 ffff6f1a Blocked nt!ObpWaitForMultipleObjects+0x294 67c.0007cc fffffa800519db60 ffff6f1a Blocked nt!IoRemoveIoCompletion+0x47 67c.000bdc fffffa800519d660 ffff6dbb Blocked nt!ObpWaitForMultipleObjects+0x294 [fffffa8004d4bb30 explorer.exe] 6ac.0005c0 fffffa8004d49700 ffff6616 Blocked win32k!xxxRealSleepThread+0x257 6ac.000790 fffffa8004d6c060 ffff64e0 Blocked nt!ObpWaitForMultipleObjects+0x294 6ac.0007c0 fffffa8004d788c0 ffff64a0 Blocked nt!ObpWaitForMultipleObjects+0x294 6ac.000784 fffffa8004d88930 ffff62b0 Blocked bowser!GetBrowserServerList+0x1d1 6ac.0007a0 fffffa8004d882a0 ffff6466 Blocked nt!KiSystemServiceCopyEnd+0x13 6ac.0007f0 fffffa8004d897b0 ffff62a2 Blocked nt!ObpWaitForMultipleObjects+0x294 6ac.000754 fffffa8004d0f640 ffff647f Blocked nt!ObpWaitForMultipleObjects+0x294 6ac.0004ac fffffa8004a0db60 ffff647f Blocked win32k!xxxRealSleepThread+0x257 6ac.000124 fffffa8004e25060 ffff8467 Blocked nt!ObpWaitForMultipleObjects+0x294 6ac.000808 fffffa8004d25060 ffff6883 Blocked nt!ObpWaitForMultipleObjects+0x294 6ac.0009f4 fffffa8005065b60 ffff6f5e Blocked win32k!xxxRealSleepThread+0x257 6ac.000bfc fffffa8004a09880 ffff6839 Blocked nt!ObpWaitForMultipleObjects+0x294 6ac.000ae8 fffffa8004a5eb60 ffff64a0 Blocked nt!ObpWaitForMultipleObjects+0x294 6ac.000a94 fffffa8004fd27c0 ffff6839 Blocked nt!ObpWaitForMultipleObjects+0x294 6ac.000964 fffffa8004fec660 ffff64a0 Blocked nt!ObpWaitForMultipleObjects+0x294 6ac.000a80 fffffa8005129810 ffff68f2 Blocked nt!FsRtlCancellableWaitForMultipleObjects+0x5e 6ac.000604 fffffa8005119a00 ffff6384 Blocked nt!ObpWaitForMultipleObjects+0x294 6ac.000a24 fffffa80049c1b60 ffff646e Blocked nt!IoRemoveIoCompletion+0x47 6ac.000958 fffffa8004550620 ffff68d8 Blocked nt!KiSystemServiceCopyEnd+0x13 6ac.0001e8 fffffa800504d060 ffff6883 Blocked win32k!xxxRealSleepThread+0x257 6ac.000ac4 fffffa8004f72b60 ffff62d1 Blocked bowser!BowserGetBrowserServerList+0x1bf 6ac.000aa8 fffffa8005051060 ffff647f Blocked nt!ObpWaitForMultipleObjects+0x294 6ac.000b4c fffffa8003c2b060 ffff64c5 Blocked nt!ObpWaitForMultipleObjects+0x294 6ac.000844 fffffa80050a6b60 ffff64e0 Blocked nt!IoRemoveIoCompletion+0x47 6ac.0008ac fffffa8005404060 ffff6898 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8004e7db30 concentr.exe] 890.000894 fffffa8004e8d060 ffff62ff Blocked win32k!xxxRealSleepThread+0x257 890.000a7c fffffa800508f060 ffff6f45 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8004e97060 jusched.exe] 8a0.000aa0 fffffa8003c29060 ffff6d73 Blocked nt!IoRemoveIoCompletion+0x47 8a0.0005b8 fffffa80050b1b60 ffff6d73 Blocked nt!ObpWaitForMultipleObjects+0x294 8a0.000940 fffffa800540cb60 ffff6d73 Blocked nt!IoRemoveIoCompletion+0x47 8a0.000380 fffffa800540c660 ffff6d73 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8004ed62f0 wlrmdr.exe] [fffffa8005094060 mscorsvw.exe] 828.00020c fffffa80050d4810 ffff7150 Blocked nt!ObpWaitForMultipleObjects+0x294 828.00086c fffffa80050ff060 ffff637b Blocked nt!ObpWaitForMultipleObjects+0x294 828.000794 fffffa8004e1fb60 ffff637b Blocked nt!IoRemoveIoCompletion+0x47 828.0145ac fffffa8004f87700 ffff637b Blocked nt!IoRemoveIoCompletion+0x47 828.0145b0 fffffa8004ecc060 ffff637b Blocked nt!IoRemoveIoCompletion+0x47 [fffffa80050a2060 mscorsvw.exe] 71c.000700 fffffa8004e68790 ffff6d8c Blocked nt!ObpWaitForMultipleObjects+0x294 71c.000170 fffffa800512b060 ffff6d8c Blocked nt!ObpWaitForMultipleObjects+0x294 71c.000888 fffffa8005104240 ffff62cc Blocked nt!ObpWaitForMultipleObjects+0x294 71c.000450 fffffa800454f6d0 ffff714f Blocked nt!KiSystemServiceCopyEnd+0x13 71c.0009a8 fffffa800540eb60 ffff62cc Blocked nt!IoRemoveIoCompletion+0x47 71c.0145b4 fffffa8005108b60 ffff62cc Blocked nt!IoRemoveIoCompletion+0x47 71c.0145b8 fffffa8004f56060 ffff62cc Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8005101060 TrustedInstall] 81c.0004b0 fffffa8004fef2c0 ffff6521 Blocked nt!IoRemoveIoCompletion+0x47 81c.0006a0 fffffa800519ab60 ffff6521 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8005175a60 msdtc.exe] 438.0009b4 fffffa8004a4a120 ffff6f97 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa80044fab30 wuauclt.exe] 5f8.0006bc fffffa800517d770 ffff69c3 Blocked nt!ObpWaitForMultipleObjects+0x294 5f8.000b48 fffffa80050e0b60 ffff69c3 Blocked nt!IoRemoveIoCompletion+0x47 5f8.0144f4 fffffa8004544060 ffff69c3 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8004eceb30 wfcrun32.exe] bbc.000bc4 fffffa8003c43a60 ffff693a Blocked win32k!xxxRealSleepThread+0x257 bbc.000bcc fffffa8004feeb60 ffff62be Blocked nt!KiSystemServiceCopyEnd+0x13 bbc.000b5c fffffa8005390060 ffff70ba Blocked nt!IoRemoveIoCompletion+0x47 bbc.00068c fffffa8004f55b60 ffff6573 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa80050fcb30 jucheck.exe] 9e0.0008f8 fffffa800454d060 ffff6cd0 Blocked nt!ObpWaitForMultipleObjects+0x294 9e0.000aa4 fffffa8004f55060 ffff6cd0 Blocked nt!IoRemoveIoCompletion+0x47 9e0.000704 fffffa8005412b60 ffff6cd0 Blocked nt!IoRemoveIoCompletion+0x47 9e0.000b14 fffffa8005412660 ffff6cd0 Blocked nt!IoRemoveIoCompletion+0x47 *** ERROR: Module load completed but symbols could not be loaded for myfault.sys *** ERROR: Module load completed but symbols could not be loaded for NotMyfault.exe [fffffa8004f68370 NotMyfault.exe] a6c.000acc fffffa8004544b60 ffff629e ???? nt!KeBugCheckEx a6c.0006a8 fffffa800517fb60 ffff7d4d Blocked nt!ObpWaitForMultipleObjects+0x294 [fffffa8004f58b30 iexplore.exe] 168.0001e4 fffffa80050dd700 ffff72b5 Blocked nt!ObpWaitForMultipleObjects+0x294 168.0008bc fffffa8004f8b950 ffff72b5 Blocked nt!IoRemoveIoCompletion+0x47 168.000370 fffffa800457e550 ffff8320 Blocked nt!ObpWaitForMultipleObjects+0x294 168.000ac8 fffffa800457f660 ffff8904 Blocked nt!ObpWaitForMultipleObjects+0x294 168.000b00 fffffa8004567060 ffff88d4 Blocked nt!KiSystemServiceCopyEnd+0x13 168.000a00 fffffa800511ab60 ffff88d4 Blocked nt!IoRemoveIoCompletion+0x47 168.000ab8 fffffa800455e660 ffff72b5 Blocked nt!IoRemoveIoCompletion+0x47 168.00076c fffffa8005361660 ffff72b5 Blocked nt!IoRemoveIoCompletion+0x47 [fffffa8004585b30 iexplore.exe] 920.000b3c fffffa8004d00760 ffff8905 Blocked nt!ObpWaitForMultipleObjects+0x294 920.000bd0 fffffa8004f69b60 ffff727b Blocked nt!ObpWaitForMultipleObjects+0x294 920.000ad8 fffffa800455e060 ffff8151 Blocked nt!ObpWaitForMultipleObjects+0x294 920.000960 fffffa800455bb60 ffff75fa Blocked win32k!xxxRealSleepThread+0x257 920.0006c0 fffffa8004565b60 ffff6a8f Blocked nt!KiSystemServiceCopyEnd+0x13 920.000b24 fffffa80051a3a10 ffff8328 Blocked nt!KiSystemServiceCopyEnd+0x13 920.000644 fffffa80051a79b0 ffff727b Blocked nt!IoRemoveIoCompletion+0x47 920.000b9c fffffa8004ec0b60 ffff84f8 Blocked nt!KiSystemServiceCopyEnd+0x13 920.000a10 fffffa8004f75660 ffff84b2 Blocked nt!KiSystemServiceCopyEnd+0x13 920.00096c fffffa800455f780 ffff8319 Blocked nt!IoRemoveIoCompletion+0x47 920.0003f0 fffffa800532e860 ffff834f Blocked nt!KiSystemServiceCopyEnd+0x13 920.000b88 fffffa8005356660 ffff727b Blocked nt!IoRemoveIoCompletion+0x47 920.00082c fffffa800532e360 ffff727b Blocked nt!IoRemoveIoCompletion+0x47 [fffffa80053a8b30 notepad.exe] [fffffa8004514630 ApplicationA.e] 7f4.00056c fffffa8004f85b60 ffff7ea1 Blocked nt!KiSystemServiceCopyEnd+0x13 7f4.000af4 fffffa800451cb60 ffff6e5a Blocked nt!KiSystemServiceCopyEnd+0x13 7f4.000998 fffffa800451c660 ffff6e1a Blocked nt!KiSystemServiceCopyEnd+0x13 7f4.000278 fffffa800451d060 ffff6dda Blocked nt!KiSystemServiceCopyEnd+0x13 7f4.000b8c fffffa800451db60 ffff7bf2 Blocked win32k!xxxRealSleepThread+0x257 7f4.00083c fffffa800451d660 ffff6d59 Blocked nt!KiSystemServiceCopyEnd+0x13 7f4.000b7c fffffa800451e060 ffff6d19 Blocked nt!KiSystemServiceCopyEnd+0x13 [fffffa8004f85630 conhost.exe] 21c.0008c0 fffffa8004f84b60 ffff7ea1 Blocked nt!AlpcpReceiveMessagePort+0x189 [fffffa80053ce630 ApplicationB.e] 798.000a5c fffffa80053d0b60 ffff77a1 Blocked nt!KiSystemServiceCopyEnd+0x13 798.00072c fffffa8004acf5f0 ffff675a Blocked nt!KiSystemServiceCopyEnd+0x13 798.00065c fffffa8004523b60 ffff671a Blocked nt!KiSystemServiceCopyEnd+0x13 798.00014c fffffa8004588450 ffff66da Blocked nt!KiSystemServiceCopyEnd+0x13 798.000a40 fffffa80053e2b60 ffff669a Blocked nt!KiSystemServiceCopyEnd+0x13 798.0004a8 fffffa80053ceb60 ffff6659 Blocked nt!KiSystemServiceCopyEnd+0x13 798.000bf0 fffffa8004571b60 ffff6619 Blocked nt!KiSystemServiceCopyEnd+0x13 [fffffa80053d0060 conhost.exe] 248.000b50 fffffa8005197060 ffff77a1 Blocked nt!AlpcpReceiveMessagePort+0x189 [fffffa8005400b30 ApplicationC.e] b34.000ab0 fffffa8004f8b240 ffff71db Blocked nt!KiSystemServiceCopyEnd+0x13 b34.000b98 fffffa800455b060 ffff729b Blocked nt!KiSystemServiceCopyEnd+0x13 b34.0009b0 fffffa8005000960 ffff62d5 Blocked nt!KiSystemServiceCopyEnd+0x13 b34.000b80 fffffa8004565060 ffff735c Blocked nt!KiSystemServiceCopyEnd+0x13 b34.000a34 fffffa800457a060 ffff735c Blocked nt!KiSystemServiceCopyEnd+0x13 b34.000858 fffffa8004562b60 ffff735c Blocked nt!KiSystemServiceCopyEnd+0x13 [fffffa800451f060 conhost.exe] bb4.000b54 fffffa8004517060 ffff735c Blocked nt!AlpcpReceiveMessagePort+0x189 bb4.000918 fffffa80051aab60 ffff72cd Blocked win32k!xxxRealSleepThread+0x257 [fffffa8005369060 ApplicationD.e] abc.0008fc fffffa800535f060 ffff6f25 Blocked nt!KiSuspendThread+0x74 abc.000b04 fffffa8004548b60 ffff6f3a Blocked nt!KiSuspendThread+0x74 abc.0003a8 fffffa8004ea7b60 ffff6f3a Blocked nt!KiSuspendThread+0x74 abc.000b40 fffffa8004eeeb60 ffff6f3a Blocked nt!KiSuspendThread+0x74 abc.000664 fffffa800519e060 ffff6f3a Blocked nt!KiSuspendThread+0x74 abc.00087c fffffa8004514060 ffff6f27 Blocked nt!KiSystemServiceCopyEnd+0x13 abc.000970 fffffa8004ac3660 ffff6f3a Blocked nt!KiSuspendThread+0x74 [fffffa80053ce060 conhost.exe] a14.000580 fffffa800538ab60 ffff7031 Blocked nt!AlpcpReceiveMessagePort+0x189 a14.000a50 fffffa8004588b60 ffff6f06 Blocked win32k!xxxRealSleepThread+0x257 [fffffa800540e060 svchost.exe] a1c.000b68 fffffa8005362060 ffff6f45 Blocked nt!KiSystemServiceCopyEnd+0x13 a1c.000440 fffffa800518b060 ffff6f45 Blocked nt!IoRemoveIoCompletion+0x47 a1c.000a84 fffffa800535e060 ffff6f3f Blocked nt!IoRemoveIoCompletion+0x47 a1c.000bc8 fffffa800518bb60 ffff6f44 Blocked nt!ObpWaitForMultipleObjects+0x294 a1c.0008b8 fffffa800519eb60 ffff6f3f Blocked nt!AlpcpReceiveMessagePort+0x189 [fffffa800518fb30 WerFault.exe] a78.00090c fffffa8005360b60 ffff6f21 Blocked nt!ObpWaitForMultipleObjects+0x294 a78.0007ec fffffa8005404b60 ffff6f37 Blocked nt!ObpWaitForMultipleObjects+0x294 a78.0005e8 fffffa800519e660 ffff629e Blocked nt!ObpWaitForMultipleObjects+0x294 a78.0008b0 fffffa80053f8b60 ffff6f21 Blocked nt!ObpWaitForMultipleObjects+0x294 [fffffa800541a060 ApplicationE.e] b94.0005ac fffffa80053a1060 ffff629e ???? +0x13f236ce1 b94.000a2c fffffa80045076c0 ffff6bd5 Blocked nt!KiSystemServiceCopyEnd+0x13 b94.0009a0 fffffa8004f3c060 ffff6bd5 Blocked nt!KiSystemServiceCopyEnd+0x13 b94.000b0c fffffa8004f6c060 ffff6bd5 Blocked nt!KiSystemServiceCopyEnd+0x13 b94.0008d0 fffffa800518ab60 ffff6b38 Blocked nt!KiSystemServiceCopyEnd+0x13 b94.000460 fffffa800541ab60 ffff6bd5 Blocked nt!KiSystemServiceCopyEnd+0x13 b94.0009f8 fffffa8005406b60 ffff6bcc Blocked nt!KiSystemServiceCopyEnd+0x13 [fffffa8004522060 conhost.exe] be4.0005d4 fffffa8005370290 ffff6b34 Blocked nt!AlpcpReceiveMessagePort+0x189 be4.000204 fffffa8004a4cb60 ffff6b35 Blocked win32k!xxxRealSleepThread+0x257 [fffffa80056e2590 ApplicationA.e] 1455c.014560 fffffa8004525780 ffff682e Blocked nt!KiSystemServiceCopyEnd+0x13 1455c.014578 fffffa800541cb60 ffff682e Blocked nt!KiSystemServiceCopyEnd+0x13 1455c.01457c fffffa800541c660 ffff682c Blocked nt!KiSystemServiceCopyEnd+0x13 1455c.014580 fffffa80053a7060 ffff682e Blocked nt!KiSystemServiceCopyEnd+0x13 1455c.014584 fffffa80053a7b60 ffff6752 Blocked win32k!xxxRealSleepThread+0x257 1455c.014588 fffffa80053a7660 ffff682e Blocked nt!KiSystemServiceCopyEnd+0x13 1455c.01458c fffffa800535d060 ffff682c Blocked nt!KiSystemServiceCopyEnd+0x13 [fffffa8005416630 conhost.exe] 14564.014570 fffffa8004530060 ffff682c Blocked nt!AlpcpReceiveMessagePort+0x189 14564.014574 fffffa8005186b60 ffff67e8 Blocked win32k!xxxRealSleepThread+0x257 Threads Processed: 572 1: kd> !process 0 1f **** NT ACTIVE PROCESS DUMP **** PROCESS fffffa8003baa890 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000 DirBase: 00187000 ObjectTable: fffff8a000001a80 HandleCount: 558. Image: System VadRoot fffffa800406fc20 Vads 28 Clone 0 Private 10. Modified 23206. Locked 64. DeviceMap fffff8a000008c10 Token fffff8a000004040 ElapsedTime 00:10:20.813 UserTime 00:00:00.000 KernelTime 00:00:02.262 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (461, 0, 0) (1844KB, 0KB, 0KB) PeakWorkingSetSize 1786 VirtualSize 7 Mb PeakVirtualSize 12 Mb PageFaultCount 18725 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 30 Setting context for this process... .process /p /r fffffa8003baa890 THREAD fffffa8003bf1b60 Cid 0004.0008 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrFreePage) KernelMode Non-Alertable fffff80001c5a720 Gate Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40025 Ticks: 265 (0:00:00:04.134) Context Switch Count 34431 UserTime 00:00:00.000 KernelTime 00:00:08.221 Win32 Start Address nt!Phase1Initialization (0xfffff80001f0e8c0) Stack Init fffff880009a9db0 Current fffff880009a99b0 Base fffff880009aa000 Limit fffff880009a4000 Call 0 Priority 1 BasePriority 0 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`009a99f0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`009a9b30 fffff800`01ad3985 nt!KiCommitThreadWait+0x1d2 fffff880`009a9bc0 fffff800`01ad326a nt!KeWaitForGate+0x101 fffff880`009a9c10 fffff800`01d30c06 nt!MmZeroPageThread+0x2ed fffff880`009a9d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`009a9d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003bf9680 Cid 0004.0010 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffff80001c3bc80 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 19 Ticks: 40271 (0:00:10:28.231) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!PopIrpWorkerControl (0xfffff80001ba8190) Stack Init fffff880009b0db0 Current fffff880009b0a50 Base fffff880009b1000 Limit fffff880009ab000 Call 0 Priority 15 BasePriority 13 UnusualBoost 2 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`009b0a90 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`009b0bd0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`009b0c60 fffff800`01ba81bb nt!KeWaitForSingleObject+0x19f fffff880`009b0d00 fffff800`01d30c06 nt!PopIrpWorkerControl+0x2b fffff880`009b0d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`009b0d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003bf91a0 Cid 0004.0014 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffff80001c3c2a0 Semaphore Limit 0x7fffffff Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 1123 Ticks: 39167 (0:00:10:11.009) Context Switch Count 6 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!PopIrpWorker (0xfffff80001ba7b10) Stack Init fffff880009b7db0 Current fffff880009b79e0 Base fffff880009b8000 Limit fffff880009b2000 Call 0 Priority 15 BasePriority 13 UnusualBoost 2 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`009b7a20 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`009b7b60 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`009b7bf0 fffff800`01ba7c72 nt!KeWaitForSingleObject+0x19f fffff880`009b7c90 fffff800`01d30c06 nt!PopIrpWorker+0x162 fffff880`009b7d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`009b7d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003bfa040 Cid 0004.0018 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffff80001c3c2a0 Semaphore Limit 0x7fffffff Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 1380 Ticks: 38910 (0:00:10:06.999) Context Switch Count 6 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!PopIrpWorker (0xfffff80001ba7b10) Stack Init fffff880009bedb0 Current fffff880009be9e0 Base fffff880009bf000 Limit fffff880009b9000 Call 0 Priority 15 BasePriority 13 UnusualBoost 2 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`009bea20 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`009beb60 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`009bebf0 fffff800`01ba7c72 nt!KeWaitForSingleObject+0x19f fffff880`009bec90 fffff800`01d30c06 nt!PopIrpWorker+0x162 fffff880`009bed40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`009bed80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c0b640 Cid 0004.001c Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff80001c315a0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 10128 Ticks: 30162 (0:00:07:50.530) Context Switch Count 13 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!ExpWorkerThread (0xfffff80001a99850) Stack Init fffff88001faadb0 Current fffff88001faa9f0 Base fffff88001fab000 Limit fffff88001fa5000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`01faaa30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`01faab70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`01faac00 fffff800`01a99939 nt!KeRemoveQueueEx+0x301 fffff880`01faacb0 fffff800`01d30c06 nt!ExpWorkerThread+0xe9 fffff880`01faad40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`01faad80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c0b160 Cid 0004.0020 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff80001c315a0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 10256 Ticks: 30034 (0:00:07:48.533) Context Switch Count 401 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!ExpWorkerThread (0xfffff80001a99850) Stack Init fffff88001fb1db0 Current fffff88001fb19f0 Base fffff88001fb2000 Limit fffff88001fac000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`01fb1a30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`01fb1b70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`01fb1c00 fffff800`01a99939 nt!KeRemoveQueueEx+0x301 fffff880`01fb1cb0 fffff800`01d30c06 nt!ExpWorkerThread+0xe9 fffff880`01fb1d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`01fb1d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c01040 Cid 0004.0024 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff80001c315a0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40288 Ticks: 2 (0:00:00:00.031) Context Switch Count 1302 UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address nt!ExpWorkerThread (0xfffff80001a99850) Stack Init fffff88001fb8db0 Current fffff88001fb89f0 Base fffff88001fb9000 Limit fffff88001fb3000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`01fb8a30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`01fb8b70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`01fb8c00 fffff800`01a99939 nt!KeRemoveQueueEx+0x301 fffff880`01fb8cb0 fffff800`01d30c06 nt!ExpWorkerThread+0xe9 fffff880`01fb8d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`01fb8d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c01b60 Cid 0004.0028 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff80001c315a0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 37628 Ticks: 2662 (0:00:00:41.527) Context Switch Count 1039 UserTime 00:00:00.000 KernelTime 00:00:00.031 Win32 Start Address nt!ExpWorkerThread (0xfffff80001a99850) Stack Init fffff88001fbfdb0 Current fffff88001fbf9f0 Base fffff88001fc0000 Limit fffff88001fba000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`01fbfa30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`01fbfb70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`01fbfc00 fffff800`01a99939 nt!KeRemoveQueueEx+0x301 fffff880`01fbfcb0 fffff800`01d30c06 nt!ExpWorkerThread+0xe9 fffff880`01fbfd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`01fbfd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c01680 Cid 0004.002c Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff80001c315a0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 39935 Ticks: 355 (0:00:00:05.538) Context Switch Count 897 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!ExpWorkerThread (0xfffff80001a99850) Stack Init fffff88001fc6db0 Current fffff88001fc69f0 Base fffff88001fc7000 Limit fffff88001fc1000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`01fc6a30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`01fc6b70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`01fc6c00 fffff800`01a99939 nt!KeRemoveQueueEx+0x301 fffff880`01fc6cb0 fffff800`01d30c06 nt!ExpWorkerThread+0xe9 fffff880`01fc6d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`01fc6d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c00040 Cid 0004.0030 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff80001c315a0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 39935 Ticks: 355 (0:00:00:05.538) Context Switch Count 496 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!ExpWorkerThread (0xfffff80001a99850) Stack Init fffff88001fcddb0 Current fffff88001fcd9f0 Base fffff88001fce000 Limit fffff88001fc8000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`01fcda30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`01fcdb70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`01fcdc00 fffff800`01a99939 nt!KeRemoveQueueEx+0x301 fffff880`01fcdcb0 fffff800`01d30c06 nt!ExpWorkerThread+0xe9 fffff880`01fcdd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`01fcdd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c00b60 Cid 0004.0034 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff80001c315a0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 37628 Ticks: 2662 (0:00:00:41.527) Context Switch Count 1039 UserTime 00:00:00.000 KernelTime 00:00:00.031 Win32 Start Address nt!ExpWorkerThread (0xfffff80001a99850) Stack Init fffff88001fd4db0 Current fffff88001fd49f0 Base fffff88001fd5000 Limit fffff88001fcf000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`01fd4a30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`01fd4b70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`01fd4c00 fffff800`01a99939 nt!KeRemoveQueueEx+0x301 fffff880`01fd4cb0 fffff800`01d30c06 nt!ExpWorkerThread+0xe9 fffff880`01fd4d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`01fd4d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c00680 Cid 0004.0038 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff80001c315a0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 39166 Ticks: 1124 (0:00:00:17.534) Context Switch Count 1160 UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address nt!ExpWorkerThread (0xfffff80001a99850) Stack Init fffff88001fdbdb0 Current fffff88001fdb9f0 Base fffff88001fdc000 Limit fffff88001fd6000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`01fdba30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`01fdbb70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`01fdbc00 fffff800`01a99939 nt!KeRemoveQueueEx+0x301 fffff880`01fdbcb0 fffff800`01d30c06 nt!ExpWorkerThread+0xe9 fffff880`01fdbd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`01fdbd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003bff040 Cid 0004.003c Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff80001c315a0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 37628 Ticks: 2662 (0:00:00:41.527) Context Switch Count 2601 UserTime 00:00:00.000 KernelTime 00:00:00.280 Win32 Start Address nt!ExpWorkerThread (0xfffff80001a99850) Stack Init fffff88001fe2db0 Current fffff88001fe29f0 Base fffff88001fe3000 Limit fffff88001fdd000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`01fe2a30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`01fe2b70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`01fe2c00 fffff800`01a99939 nt!KeRemoveQueueEx+0x301 fffff880`01fe2cb0 fffff800`01d30c06 nt!ExpWorkerThread+0xe9 fffff880`01fe2d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`01fe2d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003bffb60 Cid 0004.0040 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff80001c315a0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 39935 Ticks: 355 (0:00:00:05.538) Context Switch Count 1628 UserTime 00:00:00.000 KernelTime 00:00:00.327 Win32 Start Address nt!ExpWorkerThread (0xfffff80001a99850) Stack Init fffff88001fe9db0 Current fffff88001fe99f0 Base fffff88001fea000 Limit fffff88001fe4000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`01fe9a30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`01fe9b70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`01fe9c00 fffff800`01a99939 nt!KeRemoveQueueEx+0x301 fffff880`01fe9cb0 fffff800`01d30c06 nt!ExpWorkerThread+0xe9 fffff880`01fe9d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`01fe9d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003bff680 Cid 0004.0044 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Non-Alertable fffff80001c315f8 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40256 Ticks: 34 (0:00:00:00.530) Context Switch Count 2859 UserTime 00:00:00.000 KernelTime 00:00:00.124 Win32 Start Address nt!ExpWorkerThread (0xfffff80001a99850) Stack Init fffff88001ff0db0 Current fffff88001ff09f0 Base fffff88001ff1000 Limit fffff88001feb000 Call 0 Priority 12 BasePriority 12 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`01ff0a30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`01ff0b70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`01ff0c00 fffff800`01a99939 nt!KeRemoveQueueEx+0x301 fffff880`01ff0cb0 fffff800`01d30c06 nt!ExpWorkerThread+0xe9 fffff880`01ff0d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`01ff0d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003bfe040 Cid 0004.0048 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Non-Alertable fffff80001c315f8 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 11476 Ticks: 28814 (0:00:07:29.501) Context Switch Count 2068 UserTime 00:00:00.000 KernelTime 00:00:00.530 Win32 Start Address nt!ExpWorkerThread (0xfffff80001a99850) Stack Init fffff88001ff7db0 Current fffff88001ff79f0 Base fffff88001ff8000 Limit fffff88001ff2000 Call 0 Priority 13 BasePriority 12 UnusualBoost 1 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`01ff7a30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`01ff7b70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`01ff7c00 fffff800`01a99939 nt!KeRemoveQueueEx+0x301 fffff880`01ff7cb0 fffff800`01d30c06 nt!ExpWorkerThread+0xe9 fffff880`01ff7d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`01ff7d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003bfeb60 Cid 0004.004c Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Non-Alertable fffff80001c315f8 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 11474 Ticks: 28816 (0:00:07:29.532) Context Switch Count 1408 UserTime 00:00:00.000 KernelTime 00:00:00.171 Win32 Start Address nt!ExpWorkerThread (0xfffff80001a99850) Stack Init fffff88001ffedb0 Current fffff88001ffe9f0 Base fffff88001fff000 Limit fffff88001ff9000 Call 0 Priority 12 BasePriority 12 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`01ffea30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`01ffeb70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`01ffec00 fffff800`01a99939 nt!KeRemoveQueueEx+0x301 fffff880`01ffecb0 fffff800`01d30c06 nt!ExpWorkerThread+0xe9 fffff880`01ffed40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`01ffed80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003bfe680 Cid 0004.0050 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Non-Alertable fffff80001c315f8 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40256 Ticks: 34 (0:00:00:00.530) Context Switch Count 3043 UserTime 00:00:00.000 KernelTime 00:00:00.468 Win32 Start Address nt!ExpWorkerThread (0xfffff80001a99850) Stack Init fffff88002108db0 Current fffff880021089f0 Base fffff88002109000 Limit fffff88002103000 Call 0 Priority 12 BasePriority 12 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02108a30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02108b70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`02108c00 fffff800`01a99939 nt!KeRemoveQueueEx+0x301 fffff880`02108cb0 fffff800`01d30c06 nt!ExpWorkerThread+0xe9 fffff880`02108d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`02108d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003bfd040 Cid 0004.0054 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Non-Alertable fffff80001c315f8 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 11476 Ticks: 28814 (0:00:07:29.501) Context Switch Count 375 UserTime 00:00:00.000 KernelTime 00:00:00.124 Win32 Start Address nt!ExpWorkerThread (0xfffff80001a99850) Stack Init fffff8800210fdb0 Current fffff8800210f9f0 Base fffff88002110000 Limit fffff8800210a000 Call 0 Priority 12 BasePriority 12 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0210fa30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0210fb70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0210fc00 fffff800`01a99939 nt!KeRemoveQueueEx+0x301 fffff880`0210fcb0 fffff800`01d30c06 nt!ExpWorkerThread+0xe9 fffff880`0210fd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`0210fd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003bfdb60 Cid 0004.0058 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Non-Alertable fffff80001c315f8 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40275 Ticks: 15 (0:00:00:00.234) Context Switch Count 3722 UserTime 00:00:00.000 KernelTime 00:00:00.046 Win32 Start Address nt!ExpWorkerThread (0xfffff80001a99850) Stack Init fffff88002116db0 Current fffff880021169f0 Base fffff88002117000 Limit fffff88002111000 Call 0 Priority 12 BasePriority 12 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02116a30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02116b70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`02116c00 fffff800`01a99939 nt!KeRemoveQueueEx+0x301 fffff880`02116cb0 fffff800`01d30c06 nt!ExpWorkerThread+0xe9 fffff880`02116d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`02116d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003bfd680 Cid 0004.005c Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Non-Alertable fffff80001c315f8 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40064 Ticks: 226 (0:00:00:03.525) Context Switch Count 2546 UserTime 00:00:00.000 KernelTime 00:00:00.062 Win32 Start Address nt!ExpWorkerThread (0xfffff80001a99850) Stack Init fffff8800211ddb0 Current fffff8800211d9f0 Base fffff8800211e000 Limit fffff88002118000 Call 0 Priority 12 BasePriority 12 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0211da30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0211db70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0211dc00 fffff800`01a99939 nt!KeRemoveQueueEx+0x301 fffff880`0211dcb0 fffff800`01d30c06 nt!ExpWorkerThread+0xe9 fffff880`0211dd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`0211dd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003bfc040 Cid 0004.0060 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff80001c31650 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40020 Ticks: 270 (0:00:00:04.212) Context Switch Count 22128 UserTime 00:00:00.000 KernelTime 00:00:00.046 Win32 Start Address nt!ExpWorkerThread (0xfffff80001a99850) Stack Init fffff88002124db0 Current fffff880021249f0 Base fffff88002125000 Limit fffff8800211f000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02124a30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02124b70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`02124c00 fffff800`01a99939 nt!KeRemoveQueueEx+0x301 fffff880`02124cb0 fffff800`01d30c06 nt!ExpWorkerThread+0xe9 fffff880`02124d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`02124d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003bfcb60 Cid 0004.0064 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffff8800212bcf0 NotificationTimer fffff80001c31560 SynchronizationEvent fffff80001c31540 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40244 Ticks: 46 (0:00:00:00.717) Context Switch Count 621 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!ExpWorkerThreadBalanceManager (0xfffff80001d89018) Stack Init fffff8800212bdb0 Current fffff8800212b7d0 Base fffff8800212c000 Limit fffff88002126000 Call 0 Priority 14 BasePriority 14 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0212b810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0212b950 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0212b9e0 fffff800`01d890a8 nt!KeWaitForMultipleObjects+0x271 fffff880`0212bc90 fffff800`01d30c06 nt!ExpWorkerThreadBalanceManager+0x90 fffff880`0212bd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`0212bd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c0d8c0 Cid 0004.0068 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable fffff80001c0b280 Gate Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 39453 Ticks: 837 (0:00:00:13.057) Context Switch Count 44 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!KiExecuteDpc (0xfffff80001a67310) Stack Init fffff88002132db0 Current fffff88002132a90 Base fffff88002133000 Limit fffff8800212d000 Call 0 Priority 31 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02132ad0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02132c10 fffff800`01ad3985 nt!KiCommitThreadWait+0x1d2 fffff880`02132ca0 fffff800`01a673ad nt!KeWaitForGate+0x101 fffff880`02132cf0 fffff800`01d30c06 nt!KiExecuteDpc+0x9d fffff880`02132d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`02132d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c0d3e0 Cid 0004.006c Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable fffff880009c3580 Gate Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 39463 Ticks: 827 (0:00:00:12.901) Context Switch Count 44 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!KiExecuteDpc (0xfffff80001a67310) Stack Init fffff88002139db0 Current fffff88002139a90 Base fffff8800213a000 Limit fffff88002134000 Call 0 Priority 31 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02139ad0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02139c10 fffff800`01ad3985 nt!KiCommitThreadWait+0x1d2 fffff880`02139ca0 fffff800`01a673ad nt!KeWaitForGate+0x101 fffff880`02139cf0 fffff800`01d30c06 nt!KiExecuteDpc+0x9d fffff880`02139d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`02139d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c0f040 Cid 0004.0070 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrVirtualMemory) UserMode Non-Alertable fffff80001c5a3a0 Semaphore Limit 0x7fffffff fffff80001c5a480 NotificationEvent fffff80001c5a580 NotificationEvent fffff80001c47ba0 NotificationEvent fffff80001c47bc0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 19 Ticks: 40271 (0:00:10:28.231) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!MiDereferenceSegmentThread (0xfffff80001bb45f0) Stack Init fffff88002140db0 Current fffff88002140800 Base fffff88002141000 Limit fffff8800213b000 Call 0 Priority 18 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`02140840 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02140980 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`02140a10 fffff800`01bb4683 nt!KeWaitForMultipleObjects+0x271 fffff880`02140cc0 fffff800`01d30c06 nt!MiDereferenceSegmentThread+0x93 fffff880`02140d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`02140d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c0fa10 Cid 0004.0074 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrFreePage) KernelMode Non-Alertable fffff80001c434e0 Gate Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 19 Ticks: 40271 (0:00:10:28.231) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!MiModifiedPageWriter (0xfffff80001a269f0) Stack Init fffff88002147db0 Current fffff88002147a80 Base fffff88002148000 Limit fffff88002142000 Call 0 Priority 17 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02147ac0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02147c00 fffff800`01ad3985 nt!KiCommitThreadWait+0x1d2 fffff880`02147c90 fffff800`01a26a4a nt!KeWaitForGate+0x101 fffff880`02147ce0 fffff800`01d30c06 nt!MiModifiedPageWriter+0x5a fffff880`02147d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`02147d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c10b60 Cid 0004.0078 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrFreePage) KernelMode Non-Alertable fffff80001c59f80 SynchronizationEvent fffff80001c59f98 SynchronizationEvent fffff80001c59fb0 SynchronizationEvent fffff80001c59fc8 SynchronizationEvent fffff80001c59fe0 SynchronizationEvent fffff80001c59ff8 SynchronizationEvent fffff80001c5a010 SynchronizationEvent fffff80001c5a028 SynchronizationEvent fffff80001c5a040 SynchronizationEvent fffff80001c5a058 SynchronizationEvent fffff80001c5a070 SynchronizationEvent fffff80001c5a088 SynchronizationEvent fffff80001c5a0a0 SynchronizationEvent fffff80001c5a0b8 SynchronizationEvent fffff80001c5a0d0 SynchronizationEvent fffff80001c5a0e8 SynchronizationEvent fffff80001c5a100 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 24899 Ticks: 15391 (0:00:04:00.101) Context Switch Count 980 UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address nt!MiMappedPageWriter (0xfffff80001ac38d4) Stack Init fffff8800214edb0 Current fffff8800214e790 Base fffff8800214f000 Limit fffff88002149000 Call 0 Priority 17 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0214e7d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0214e910 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0214e9a0 fffff800`01ac397f nt!KeWaitForMultipleObjects+0x271 fffff880`0214ec50 fffff800`01d30c06 nt!MiMappedPageWriter+0xab fffff880`0214ed40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`0214ed80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c10280 Cid 0004.007c Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffff88002155c78 SynchronizationEvent fffff80001c59d60 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40281 Ticks: 9 (0:00:00:00.140) Context Switch Count 698 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!KeBalanceSetManager (0xfffff80001aa0fb0) Stack Init fffff88002155db0 Current fffff88002155710 Base fffff88002156000 Limit fffff88002150000 Call 0 Priority 16 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02155750 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02155890 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`02155920 fffff800`01aa10db nt!KeWaitForMultipleObjects+0x271 fffff880`02155bd0 fffff800`01d30c06 nt!KeBalanceSetManager+0x12b fffff880`02155d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`02155d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c11040 Cid 0004.0080 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffff80001c8cac0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40235 Ticks: 55 (0:00:00:00.858) Context Switch Count 292 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!KeSwapProcessOrStack (0xfffff80001a80da8) Stack Init fffff8800215cdb0 Current fffff8800215ca50 Base fffff8800215d000 Limit fffff88002157000 Call 0 Priority 23 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0215ca90 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0215cbd0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0215cc60 fffff800`01a80ddc nt!KeWaitForSingleObject+0x19f fffff880`0215cd00 fffff800`01d30c06 nt!KeSwapProcessOrStack+0x34 fffff880`0215cd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`0215cd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c13040 Cid 0004.008c Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrFreePage) KernelMode Non-Alertable fffff80001c93100 SynchronizationEvent fffff80001c930e0 SynchronizationEvent fffff80001c930c0 SynchronizationEvent fffff80001c930a0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40192 Ticks: 98 (0:00:00:01.528) Context Switch Count 556 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!CcQueueLazyWriteScanThread (0xfffff80001a7457c) Stack Init fffff88002171db0 Current fffff880021717f0 Base fffff88002172000 Limit fffff8800216c000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02171830 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02171970 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`02171a00 fffff800`01a74601 nt!KeWaitForMultipleObjects+0x271 fffff880`02171cb0 fffff800`01d30c06 nt!CcQueueLazyWriteScanThread+0x85 fffff880`02171d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`02171d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c16040 Cid 0004.0090 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff80001c91700 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 24 Ticks: 40266 (0:00:10:28.153) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!FsRtlWorkerThread (0xfffff80001ba3af0) Stack Init fffff8800217edb0 Current fffff8800217ea40 Base fffff8800217f000 Limit fffff88002179000 Call 0 Priority 16 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0217ea80 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0217ebc0 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0217ec50 fffff800`01ba3b3d nt!KeRemoveQueueEx+0x301 fffff880`0217ed00 fffff800`01d30c06 nt!FsRtlWorkerThread+0x4d fffff880`0217ed40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`0217ed80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c16b60 Cid 0004.0094 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff80001c91740 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 24 Ticks: 40266 (0:00:10:28.153) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!FsRtlWorkerThread (0xfffff80001ba3af0) Stack Init fffff88002185db0 Current fffff88002185a40 Base fffff88002186000 Limit fffff88002180000 Call 0 Priority 17 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02185a80 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02185bc0 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`02185c50 fffff800`01ba3b3d nt!KeRemoveQueueEx+0x301 fffff880`02185d00 fffff800`01d30c06 nt!FsRtlWorkerThread+0x4d fffff880`02185d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`02185d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c1d040 Cid 0004.0098 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8003c1d400 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 6460 Ticks: 33830 (0:00:08:47.751) Context Switch Count 241 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!PopUmpoMessageThread (0xfffff80001a50c28) Stack Init fffff88002194db0 Current fffff880021945b0 Base fffff88002195000 Limit fffff8800218f000 Call 0 Priority 14 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`021945f0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02194730 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`021947c0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`02194860 fffff800`01d8cac7 nt!AlpcpReceiveMessagePort+0x189 fffff880`021948c0 fffff800`01d8e006 nt!AlpcpReceiveMessage+0x2d4 fffff880`02194960 fffff800`01a8b993 nt!NtAlpcSendWaitReceivePort+0x1e6 fffff880`02194a10 fffff800`01a87f30 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02194a80) fffff880`02194c18 fffff800`01a50cda nt!KiServiceLinkage fffff880`02194c20 fffff800`01d30c06 nt!PopUmpoMessageThread+0xb2 fffff880`02194d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`02194d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c64490 Cid 0004.009c Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa8003c78e58 SynchronizationEvent fffffa8003c78e70 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40192 Ticks: 98 (0:00:00:01.528) Context Switch Count 327 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!EtwpLogger (0xfffff80001d7e2e0) Stack Init fffff880021afdb0 Current fffff880021af800 Base fffff880021b0000 Limit fffff880021aa000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`021af840 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`021af980 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`021afa10 fffff800`01d7e3d2 nt!KeWaitForMultipleObjects+0x271 fffff880`021afcc0 fffff800`01d30c06 nt!EtwpLogger+0xf2 fffff880`021afd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`021afd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c656b0 Cid 0004.00a0 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa8003c65218 SynchronizationEvent fffffa8003c65230 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40256 Ticks: 34 (0:00:00:00.530) Context Switch Count 335 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!EtwpLogger (0xfffff80001d7e2e0) Stack Init fffff880021b6db0 Current fffff880021b6800 Base fffff880021b7000 Limit fffff880021b1000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`021b6840 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`021b6980 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`021b6a10 fffff800`01d7e3d2 nt!KeWaitForMultipleObjects+0x271 fffff880`021b6cc0 fffff800`01d30c06 nt!EtwpLogger+0xf2 fffff880`021b6d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`021b6d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c8c560 Cid 0004.00a4 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa8003c8cc18 SynchronizationEvent fffffa8003c8cc30 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 39999 Ticks: 291 (0:00:00:04.539) Context Switch Count 111 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!EtwpLogger (0xfffff80001d7e2e0) Stack Init fffff880021bddb0 Current fffff880021bd800 Base fffff880021be000 Limit fffff880021b8000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`021bd840 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`021bd980 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`021bda10 fffff800`01d7e3d2 nt!KeWaitForMultipleObjects+0x271 fffff880`021bdcc0 fffff800`01d30c06 nt!EtwpLogger+0xf2 fffff880`021bdd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`021bdd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c91b60 Cid 0004.00a8 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa8003c91218 SynchronizationEvent fffffa8003c91230 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 39999 Ticks: 291 (0:00:00:04.539) Context Switch Count 117 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!EtwpLogger (0xfffff80001d7e2e0) Stack Init fffff880021c4db0 Current fffff880021c4800 Base fffff880021c5000 Limit fffff880021bf000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`021c4840 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`021c4980 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`021c4a10 fffff800`01d7e3d2 nt!KeWaitForMultipleObjects+0x271 fffff880`021c4cc0 fffff800`01d30c06 nt!EtwpLogger+0xf2 fffff880`021c4d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`021c4d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c9a040 Cid 0004.00ac Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa8003c91918 SynchronizationEvent fffffa8003c91930 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 39999 Ticks: 291 (0:00:00:04.539) Context Switch Count 114 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!EtwpLogger (0xfffff80001d7e2e0) Stack Init fffff880021cbdb0 Current fffff880021cb800 Base fffff880021cc000 Limit fffff880021c6000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`021cb840 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`021cb980 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`021cba10 fffff800`01d7e3d2 nt!KeWaitForMultipleObjects+0x271 fffff880`021cbcc0 fffff800`01d30c06 nt!EtwpLogger+0xf2 fffff880`021cbd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`021cbd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003c9a7a0 Cid 0004.00b0 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa8003c9ae58 SynchronizationEvent fffffa8003c9ae70 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40256 Ticks: 34 (0:00:00:00.530) Context Switch Count 328 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!EtwpLogger (0xfffff80001d7e2e0) Stack Init fffff880021d2db0 Current fffff880021d2800 Base fffff880021d3000 Limit fffff880021cd000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`021d2840 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`021d2980 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`021d2a10 fffff800`01d7e3d2 nt!KeWaitForMultipleObjects+0x271 fffff880`021d2cc0 fffff800`01d30c06 nt!EtwpLogger+0xf2 fffff880`021d2d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`021d2d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003cbbb60 Cid 0004.00b4 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa8003cbb218 SynchronizationEvent fffffa8003cbb230 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40256 Ticks: 34 (0:00:00:00.530) Context Switch Count 329 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!EtwpLogger (0xfffff80001d7e2e0) Stack Init fffff880021d9db0 Current fffff880021d9800 Base fffff880021da000 Limit fffff880021d4000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`021d9840 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`021d9980 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`021d9a10 fffff800`01d7e3d2 nt!KeWaitForMultipleObjects+0x271 fffff880`021d9cc0 fffff800`01d30c06 nt!EtwpLogger+0xf2 fffff880`021d9d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`021d9d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003ce35e0 Cid 0004.00b8 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa8003ce3c98 SynchronizationEvent fffffa8003ce3cb0 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40256 Ticks: 34 (0:00:00:00.530) Context Switch Count 360 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!EtwpLogger (0xfffff80001d7e2e0) Stack Init fffff880021e0db0 Current fffff880021e0800 Base fffff880021e1000 Limit fffff880021db000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`021e0840 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`021e0980 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`021e0a10 fffff800`01d7e3d2 nt!KeWaitForMultipleObjects+0x271 fffff880`021e0cc0 fffff800`01d30c06 nt!EtwpLogger+0xf2 fffff880`021e0d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`021e0d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003ce8b60 Cid 0004.00bc Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa8003ce7c98 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 12620 Ticks: 27670 (0:00:07:11.654) Context Switch Count 24 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!EtwpLogger (0xfffff80001d7e2e0) Stack Init fffff880021e7db0 Current fffff880021e7800 Base fffff880021e8000 Limit fffff880021e2000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`021e7840 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`021e7980 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`021e7a10 fffff800`01d7e3d2 nt!KeWaitForMultipleObjects+0x271 fffff880`021e7cc0 fffff800`01d30c06 nt!EtwpLogger+0xf2 fffff880`021e7d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`021e7d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003cfd040 Cid 0004.00c0 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) KernelMode Non-Alertable 0000000000000000 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 38506 Ticks: 1784 (0:00:00:27.830) Context Switch Count 11 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!WdipSemCheckTimeout (0xfffff80001d1d7d0) Stack Init fffff880021eedb0 Current fffff880021eea90 Base fffff880021ef000 Limit fffff880021e9000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`021eead0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`021eec10 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`021eeca0 fffff800`01d1d8fc nt!KeDelayExecutionThread+0x186 fffff880`021eed10 fffff800`01d30c06 nt!WdipSemCheckTimeout+0x12c fffff880`021eed40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`021eed80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003d3c6a0 Cid 0004.00c4 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Alertable fffff880013480e8 Semaphore Limit 0x3d0900 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 1693 Ticks: 38597 (0:00:10:02.117) Context Switch Count 5 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address sptd (0xfffff88001330d58) Stack Init fffff8800216adb0 Current fffff8800216aa50 Base fffff8800216b000 Limit fffff88002165000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0216aa90 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0216abd0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0216ac60 fffff880`01330d87 nt!KeWaitForSingleObject+0x19f fffff880`0216ad00 fffff800`01d30c06 sptd+0x60d87 fffff880`0216ad40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`0216ad80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003d3c1c0 Cid 0004.00c8 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Alertable fffff880013480e8 Semaphore Limit 0x3d0900 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 454 Ticks: 39836 (0:00:10:21.445) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address sptd (0xfffff88001330d58) Stack Init fffff880021fbdb0 Current fffff880021fba50 Base fffff880021fc000 Limit fffff880021f6000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`021fba90 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`021fbbd0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`021fbc60 fffff880`01330d87 nt!KeWaitForSingleObject+0x19f fffff880`021fbd00 fffff800`01d30c06 sptd+0x60d87 fffff880`021fbd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`021fbd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003d3d040 Cid 0004.00cc Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Alertable fffff880013480e8 Semaphore Limit 0x3d0900 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 145 Ticks: 40145 (0:00:10:26.266) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address sptd (0xfffff88001330d58) Stack Init fffff88000988db0 Current fffff88000988a50 Base fffff88000989000 Limit fffff88000983000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`00988a90 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`00988bd0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`00988c60 fffff880`01330d87 nt!KeWaitForSingleObject+0x19f fffff880`00988d00 fffff800`01d30c06 sptd+0x60d87 fffff880`00988d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`00988d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003d4bb10 Cid 0004.00d0 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffff880012a2ac0 NotificationEvent fffff880012a2aa0 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 1380 Ticks: 38910 (0:00:10:06.999) Context Switch Count 36 UserTime 00:00:00.000 KernelTime 00:00:00.078 Win32 Start Address ACPI!ACPIWorkerThread (0xfffff88001289f44) Stack Init fffff8800098fdb0 Current fffff8800098f820 Base fffff88000990000 Limit fffff8800098a000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0098f860 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0098f9a0 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0098fa30 fffff880`01289fb8 nt!KeWaitForMultipleObjects+0x271 fffff880`0098fce0 fffff800`01d30c06 ACPI!ACPIWorkerThread+0x74 fffff880`0098fd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`0098fd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003e58040 Cid 0004.00d4 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa8003e64118 SynchronizationEvent fffffa8003e64100 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 156 Ticks: 40134 (0:00:10:26.094) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ACPI!PciRootBusBiosMethodDispatcherOnResume (0xfffff8800128370c) Stack Init fffff88002163db0 Current fffff88002163820 Base fffff88002164000 Limit fffff8800215e000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02163860 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`021639a0 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`02163a30 fffff880`0128375d nt!KeWaitForMultipleObjects+0x271 fffff880`02163ce0 fffff800`01d30c06 ACPI!PciRootBusBiosMethodDispatcherOnResume+0x51 fffff880`02163d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`02163d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003f96360 Cid 0004.00d8 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffff88000ed6b60 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 281 Ticks: 40009 (0:00:10:24.144) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address NDIS!ndisThreadPoolTimerHandler (0xfffff88000ea2d30) Stack Init fffff88002438db0 Current fffff88002438a50 Base fffff88002439000 Limit fffff88002433000 Call 0 Priority 7 BasePriority 7 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02438a90 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02438bd0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`02438c60 fffff880`00ea2d51 nt!KeWaitForSingleObject+0x19f fffff880`02438d00 fffff800`01d30c06 NDIS!ndisThreadPoolTimerHandler+0x21 fffff880`02438d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`02438d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003f97040 Cid 0004.00dc Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff88000ed6bc0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 12620 Ticks: 27670 (0:00:07:11.654) Context Switch Count 90 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address NDIS!ndisWorkerThread (0xfffff88000e84aa0) Stack Init fffff8800243fdb0 Current fffff8800243fa10 Base fffff88002440000 Limit fffff8800243a000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0243fa50 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0243fb90 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0243fc20 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`0243fcd0 fffff880`00e84ac8 nt!KeRemoveQueue+0x21 fffff880`0243fd10 fffff800`01d30c06 NDIS!ndisWorkerThread+0x28 fffff880`0243fd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`0243fd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8003f9b040 Cid 0004.00e0 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffff88000ed5820 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 38761 Ticks: 1529 (0:00:00:23.852) Context Switch Count 21 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address NDIS!ndisCmWaitThread (0xfffff88000e72630) Stack Init fffff88002446db0 Current fffff88002446a50 Base fffff88002447000 Limit fffff88002441000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02446a90 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02446bd0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`02446c60 fffff880`00e7269e nt!KeWaitForSingleObject+0x19f fffff880`02446d00 fffff800`01d30c06 NDIS!ndisCmWaitThread+0x6e fffff880`02446d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`02446d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004062040 Cid 0004.00e4 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa800401a960 Semaphore Limit 0x7fffffff Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 305 Ticks: 39985 (0:00:10:23.769) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address volsnap!VspWorkerThread (0xfffff88001774890) Stack Init fffff880024c0db0 Current fffff880024c0a50 Base fffff880024c1000 Limit fffff880024bb000 Call 0 Priority 20 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 3 PagePriority 5 Child-SP RetAddr Call Site fffff880`024c0a90 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`024c0bd0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`024c0c60 fffff880`01774910 nt!KeWaitForSingleObject+0x19f fffff880`024c0d00 fffff800`01d30c06 volsnap!VspWorkerThread+0x80 fffff880`024c0d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`024c0d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004062b60 Cid 0004.00e8 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa800401a980 Semaphore Limit 0x7fffffff Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 305 Ticks: 39985 (0:00:10:23.769) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address volsnap!VspWorkerThread (0xfffff88001774890) Stack Init fffff880024c7db0 Current fffff880024c7a50 Base fffff880024c8000 Limit fffff880024c2000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`024c7a90 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`024c7bd0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`024c7c60 fffff880`01774910 nt!KeWaitForSingleObject+0x19f fffff880`024c7d00 fffff800`01d30c06 volsnap!VspWorkerThread+0x80 fffff880`024c7d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`024c7d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004062590 Cid 0004.00ec Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa800401a9a0 Semaphore Limit 0x7fffffff Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 305 Ticks: 39985 (0:00:10:23.769) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address volsnap!VspWorkerThread (0xfffff88001774890) Stack Init fffff880024cedb0 Current fffff880024cea50 Base fffff880024cf000 Limit fffff880024c9000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`024cea90 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`024cebd0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`024cec60 fffff880`01774910 nt!KeWaitForSingleObject+0x19f fffff880`024ced00 fffff800`01d30c06 volsnap!VspWorkerThread+0x80 fffff880`024ced40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`024ced80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa800406b040 Cid 0004.00f0 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa800401a9c0 Semaphore Limit 0x7fffffff Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 475 Ticks: 39815 (0:00:10:21.117) Context Switch Count 1020 UserTime 00:00:00.000 KernelTime 00:00:00.046 Win32 Start Address volsnap!VspWorkerThread (0xfffff88001774890) Stack Init fffff880024d5db0 Current fffff880024d5a50 Base fffff880024d6000 Limit fffff880024d0000 Call 0 Priority 20 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 3 PagePriority 5 Child-SP RetAddr Call Site fffff880`024d5a90 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`024d5bd0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`024d5c60 fffff880`01774910 nt!KeWaitForSingleObject+0x19f fffff880`024d5d00 fffff800`01d30c06 volsnap!VspWorkerThread+0x80 fffff880`024d5d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`024d5d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa800406bb60 Cid 0004.00f4 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa800401a9e0 Semaphore Limit 0x7fffffff Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 305 Ticks: 39985 (0:00:10:23.769) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address volsnap!VspWorkerThread (0xfffff88001774890) Stack Init fffff880024dcdb0 Current fffff880024dca50 Base fffff880024dd000 Limit fffff880024d7000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`024dca90 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`024dcbd0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`024dcc60 fffff880`01774910 nt!KeWaitForSingleObject+0x19f fffff880`024dcd00 fffff800`01d30c06 volsnap!VspWorkerThread+0x80 fffff880`024dcd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`024dcd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa800406b680 Cid 0004.00f8 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa800401aa00 Semaphore Limit 0x7fffffff Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 305 Ticks: 39985 (0:00:10:23.769) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address volsnap!VspWorkerThread (0xfffff88001774890) Stack Init fffff880024e3db0 Current fffff880024e3a50 Base fffff880024e4000 Limit fffff880024de000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`024e3a90 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`024e3bd0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`024e3c60 fffff880`01774910 nt!KeWaitForSingleObject+0x19f fffff880`024e3d00 fffff800`01d30c06 volsnap!VspWorkerThread+0x80 fffff880`024e3d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`024e3d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa800406c040 Cid 0004.00fc Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa800401aa20 Semaphore Limit 0x7fffffff Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 305 Ticks: 39985 (0:00:10:23.769) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address volsnap!VspWorkerThread (0xfffff88001774890) Stack Init fffff880024eadb0 Current fffff880024eaa50 Base fffff880024eb000 Limit fffff880024e5000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`024eaa90 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`024eabd0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`024eac60 fffff880`01774910 nt!KeWaitForSingleObject+0x19f fffff880`024ead00 fffff800`01d30c06 volsnap!VspWorkerThread+0x80 fffff880`024ead40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`024ead80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa800406cb60 Cid 0004.0100 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa800401aa40 Semaphore Limit 0x7fffffff Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 305 Ticks: 39985 (0:00:10:23.769) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address volsnap!VspWorkerThread (0xfffff88001774890) Stack Init fffff880024f1db0 Current fffff880024f1a50 Base fffff880024f2000 Limit fffff880024ec000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`024f1a90 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`024f1bd0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`024f1c60 fffff880`01774910 nt!KeWaitForSingleObject+0x19f fffff880`024f1d00 fffff800`01d30c06 volsnap!VspWorkerThread+0x80 fffff880`024f1d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`024f1d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa800406c680 Cid 0004.0104 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa800401aa60 Semaphore Limit 0x7fffffff Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 305 Ticks: 39985 (0:00:10:23.769) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address volsnap!VspWorkerThread (0xfffff88001774890) Stack Init fffff880024f8db0 Current fffff880024f8a50 Base fffff880024f9000 Limit fffff880024f3000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`024f8a90 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`024f8bd0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`024f8c60 fffff880`01774910 nt!KeWaitForSingleObject+0x19f fffff880`024f8d00 fffff800`01d30c06 volsnap!VspWorkerThread+0x80 fffff880`024f8d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`024f8d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa800424ab60 Cid 0004.0110 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffff880029b7838 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 38982 Ticks: 1308 (0:00:00:20.404) Context Switch Count 14 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address rdbss!RxSpinUpRequestsDispatcher (0xfffff880029a16e0) Stack Init fffff8800252adb0 Current fffff8800252aa20 Base fffff8800252b000 Limit fffff88002525000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0252aa60 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0252aba0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0252ac30 fffff880`029a17a6 nt!KeWaitForSingleObject+0x19f fffff880`0252acd0 fffff800`01d30c06 rdbss!RxSpinUpRequestsDispatcher+0xc6 fffff880`0252ad40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`0252ad80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa80042698b0 Cid 0004.0114 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa8004269f60 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 519 Ticks: 39771 (0:00:10:20.431) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address blbdrive!BlbIoWorkerThread (0xfffff88000dee62c) Stack Init fffff8800251cdb0 Current fffff8800251ca40 Base fffff8800251d000 Limit fffff88002517000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0251ca80 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0251cbc0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0251cc50 fffff880`00dee65f nt!KeWaitForSingleObject+0x19f fffff880`0251ccf0 fffff800`01d30c06 blbdrive!BlbIoWorkerThread+0x33 fffff880`0251cd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`0251cd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa800426d040 Cid 0004.0118 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa800426d400 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 23842 Ticks: 16448 (0:00:04:16.590) Context Switch Count 55 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!SepRmCommandServerThread (0xfffff80001d22cf0) Stack Init fffff8800257fdb0 Current fffff8800257f270 Base fffff88002580000 Limit fffff8800257a000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0257f2b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0257f3f0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0257f480 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`0257f520 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`0257f580 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`0257f620 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`0257f6c0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`0257f700 fffff800`01a87f30 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0257f700) fffff880`0257f898 fffff800`01d22ddf nt!KiServiceLinkage fffff880`0257f8a0 fffff800`01d30c06 nt!SepRmCommandServerThread+0xef fffff880`0257fd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`0257fd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004359b60 Cid 0004.015c Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa80044374c0 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40286 Ticks: 4 (0:00:00:00.062) Context Switch Count 129 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address parport!P5FdoThread (0xfffff88002bb96e0) Stack Init fffff880025d3db0 Current fffff880025d3a00 Base fffff880025d4000 Limit fffff880025ce000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`025d3a40 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`025d3b80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`025d3c10 fffff880`02bb9742 nt!KeWaitForSingleObject+0x19f fffff880`025d3cb0 fffff800`01d30c06 parport!P5FdoThread+0x62 fffff880`025d3d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`025d3d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa80043aa9e0 Cid 0004.0164 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffff88002d13560 SynchronizationEvent fffff88002d13520 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 1132 Ticks: 39158 (0:00:10:10.868) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address raspptp!MainPassiveLevelThread (0xfffff88002d08d20) Stack Init fffff880025a9db0 Current fffff880025a9820 Base fffff880025aa000 Limit fffff880025a4000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`025a9860 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`025a99a0 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`025a9a30 fffff880`02d08d69 nt!KeWaitForMultipleObjects+0x271 fffff880`025a9ce0 fffff800`01d30c06 raspptp!MainPassiveLevelThread+0x49 fffff880`025a9d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`025a9d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa80048f2800 Cid 0004.0184 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffff88000feb4e0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 1578 Ticks: 38712 (0:00:10:03.911) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address watchdog!SMgrGdiCalloutThread (0xfffff88000fe65c4) Stack Init fffff880025a2db0 Current fffff880025a2a10 Base fffff880025a3000 Limit fffff8800259d000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`025a2a50 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`025a2b90 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`025a2c20 fffff880`00fe6613 nt!KeWaitForSingleObject+0x19f fffff880`025a2cc0 fffff800`01d30c06 watchdog!SMgrGdiCalloutThread+0x4f fffff880`025a2d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`025a2d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004926060 Cid 0004.01f0 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Alertable fffffa8004924620 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 39573 Ticks: 717 (0:00:00:11.185) Context Switch Count 252 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address msrpc!LrpcKernelBaseRoutine (0xfffff88000f811b0) Stack Init fffff88002faadb0 Current fffff88002faa6f0 Base fffff88002fab000 Limit fffff88002fa5000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02faa730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02faa870 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`02faa900 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`02faa9b0 fffff800`01d2e530 nt!IoRemoveIoCompletion+0x47 fffff880`02faaa40 fffff800`01a8b993 nt!NtRemoveIoCompletionEx+0x104 fffff880`02faaad0 fffff800`01a87f30 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02faab40) fffff880`02faacd8 fffff880`00f811e3 nt!KiServiceLinkage fffff880`02faace0 fffff800`01d30c06 msrpc!LrpcKernelBaseRoutine+0x37 fffff880`02faad40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`02faad80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004974b60 Cid 0004.022c Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa8004973a18 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 12198 Ticks: 28092 (0:00:07:18.238) Context Switch Count 21 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!EtwpLogger (0xfffff80001d7e2e0) Stack Init fffff88004069db0 Current fffff88004069800 Base fffff8800406a000 Limit fffff88004064000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04069840 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04069980 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04069a10 fffff800`01d7e3d2 nt!KeWaitForMultipleObjects+0x271 fffff880`04069cc0 fffff800`01d30c06 nt!EtwpLogger+0xf2 fffff880`04069d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`04069d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa80049e1040 Cid 0004.02c4 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa80049dfd10 NotificationEvent fffffa80049dfd28 SynchronizationEvent fffffa80049dfd70 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 39668 Ticks: 622 (0:00:00:09.703) Context Switch Count 14638 UserTime 00:00:00.000 KernelTime 00:00:00.140 Win32 Start Address luafv!UsnThread (0xfffff88003778590) Stack Init fffff880025c5db0 Current fffff880025c5740 Base fffff880025c6000 Limit fffff880025c0000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`025c5780 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`025c58c0 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`025c5950 fffff880`037784f6 nt!KeWaitForMultipleObjects+0x271 fffff880`025c5c00 fffff880`03778666 luafv!SynchronousFsControl+0x216 fffff880`025c5c80 fffff800`01d30c06 luafv!UsnThread+0xd6 fffff880`025c5d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`025c5d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004a6ab60 Cid 0004.03f8 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa8004a659d8 SynchronizationEvent fffffa8004a659f0 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 21666 Ticks: 18624 (0:00:04:50.536) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!EtwpLogger (0xfffff80001d7e2e0) Stack Init fffff88004375db0 Current fffff88004375800 Base fffff88004376000 Limit fffff88004370000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04375840 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04375980 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04375a10 fffff800`01d7e3d2 nt!KeWaitForMultipleObjects+0x271 fffff880`04375cc0 fffff800`01d30c06 nt!EtwpLogger+0xf2 fffff880`04375d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`04375d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004ae5b60 Cid 0004.045c Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffff88002c81b60 SynchronizationEvent fffff88002c81b80 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 3438 Ticks: 36852 (0:00:09:34.894) Context Switch Count 10 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address mpsdrv!IP6StringToAddress (0xfffff88002c7d230) Stack Init fffff8800455edb0 Current fffff8800455e800 Base fffff8800455f000 Limit fffff88004559000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0455e840 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0455e980 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0455ea10 fffff880`02c7d396 nt!KeWaitForMultipleObjects+0x271 fffff880`0455ecc0 fffff800`01d30c06 mpsdrv!IP6StringToAddress+0x626 fffff880`0455ed40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`0455ed80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004b82190 Cid 0004.04c0 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa8004b827d0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 12693 Ticks: 27597 (0:00:07:10.515) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address HTTP!UlpThreadPoolWorker (0xfffff8800476e010) Stack Init fffff880045ebdb0 Current fffff880045eb9f0 Base fffff880045ec000 Limit fffff880045e6000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`045eba30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`045ebb70 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`045ebc00 fffff880`0476e30b nt!KeWaitForSingleObject+0x19f fffff880`045ebca0 fffff800`01d30c06 HTTP!UlpThreadPoolWorker+0x2fb fffff880`045ebd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`045ebd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004b83b60 Cid 0004.04c4 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa8004b82650 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 3312 Ticks: 36978 (0:00:09:36.860) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address HTTP!UlpThreadPoolWorker (0xfffff8800476e010) Stack Init fffff880044c0db0 Current fffff880044c09f0 Base fffff880044c1000 Limit fffff880044bb000 Call 0 Priority 11 BasePriority 11 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`044c0a30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`044c0b70 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`044c0c00 fffff880`0476e30b nt!KeWaitForSingleObject+0x19f fffff880`044c0ca0 fffff800`01d30c06 HTTP!UlpThreadPoolWorker+0x2fb fffff880`044c0d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`044c0d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004b83680 Cid 0004.04c8 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffff880047652c0 NotificationEvent fffff880047652a0 NotificationEvent fffffa8003c0f880 NotificationEvent fffff880047652e0 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 34020 Ticks: 6270 (0:00:01:37.812) Context Switch Count 10 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address HTTP!UlpScavengerThread (0xfffff88004784340) Stack Init fffff88004806db0 Current fffff88004806770 Base fffff88004807000 Limit fffff88004801000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`048067b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`048068f0 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04806980 fffff880`047843bd nt!KeWaitForMultipleObjects+0x271 fffff880`04806c30 fffff800`01d30c06 HTTP!UlpScavengerThread+0x81 fffff880`04806d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`04806d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004b81040 Cid 0004.04cc Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff880029b7578 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40256 Ticks: 34 (0:00:00:00.530) Context Switch Count 420 UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address rdbss!RxWorkerThreadDispatcher (0xfffff880029bb540) Stack Init fffff88004820db0 Current fffff88004820980 Base fffff88004821000 Limit fffff8800481b000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`048209c0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04820b00 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04820b90 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`04820c40 fffff880`0299c0d9 nt!KeRemoveQueue+0x21 fffff880`04820c80 fffff800`01d30c06 rdbss!RxpWorkerThreadDispatcher+0xc9 fffff880`04820d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`04820d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004b81590 Cid 0004.04d0 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff880029b7348 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40256 Ticks: 34 (0:00:00:00.530) Context Switch Count 166 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address rdbss!RxWorkerThreadDispatcher (0xfffff880029bb540) Stack Init fffff88004827db0 Current fffff88004827980 Base fffff88004828000 Limit fffff88004822000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`048279c0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04827b00 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04827b90 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`04827c40 fffff880`0299c0d9 nt!KeRemoveQueue+0x21 fffff880`04827c80 fffff800`01d30c06 rdbss!RxpWorkerThreadDispatcher+0xc9 fffff880`04827d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`04827d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004b8c270 Cid 0004.04d4 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff880029b7578 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 39807 Ticks: 483 (0:00:00:07.534) Context Switch Count 353 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address rdbss!RxWorkerThreadDispatcher (0xfffff880029bb540) Stack Init fffff8800482edb0 Current fffff8800482e980 Base fffff8800482f000 Limit fffff88004829000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0482e9c0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0482eb00 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0482eb90 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`0482ec40 fffff880`0299c0d9 nt!KeRemoveQueue+0x21 fffff880`0482ec80 fffff800`01d30c06 rdbss!RxpWorkerThreadDispatcher+0xc9 fffff880`0482ed40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`0482ed80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004b8d840 Cid 0004.04d8 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff880029b7230 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40264 Ticks: 26 (0:00:00:00.405) Context Switch Count 151 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address rdbss!RxWorkerThreadDispatcher (0xfffff880029bb540) Stack Init fffff88004835db0 Current fffff88004835980 Base fffff88004836000 Limit fffff88004830000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`048359c0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04835b00 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04835b90 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`04835c40 fffff880`0299c0d9 nt!KeRemoveQueue+0x21 fffff880`04835c80 fffff800`01d30c06 rdbss!RxpWorkerThreadDispatcher+0xc9 fffff880`04835d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`04835d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004b8e040 Cid 0004.04dc Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff880029b7578 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 39807 Ticks: 483 (0:00:00:07.534) Context Switch Count 308 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address rdbss!RxWorkerThreadDispatcher (0xfffff880029bb540) Stack Init fffff8800483cdb0 Current fffff8800483c980 Base fffff8800483d000 Limit fffff88004837000 Call 0 Priority 10 BasePriority 8 UnusualBoost 2 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0483c9c0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0483cb00 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0483cb90 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`0483cc40 fffff880`0299c0d9 nt!KeRemoveQueue+0x21 fffff880`0483cc80 fffff800`01d30c06 rdbss!RxpWorkerThreadDispatcher+0xc9 fffff880`0483cd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`0483cd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004c30040 Cid 0004.05d8 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa8004b82dd0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40232 Ticks: 58 (0:00:00:00.904) Context Switch Count 140 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address HTTP!UlpThreadPoolWorker (0xfffff8800476e010) Stack Init fffff880049dadb0 Current fffff880049da9f0 Base fffff880049db000 Limit fffff880049d5000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`049daa30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`049dab70 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`049dac00 fffff880`0476e30b nt!KeWaitForSingleObject+0x19f fffff880`049daca0 fffff800`01d30c06 HTTP!UlpThreadPoolWorker+0x2fb fffff880`049dad40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`049dad80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004c47040 Cid 0004.0614 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffffa8004c46ac0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 10961 Ticks: 29329 (0:00:07:37.535) Context Switch Count 61 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address srv2!SrvProcWorkerThread (0xfffff88004a9d310) Stack Init fffff88004c14db0 Current fffff88004c149c0 Base fffff88004c15000 Limit fffff88004c0f000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04c14a00 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04c14b40 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04c14bd0 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`04c14c80 fffff880`04a9d401 nt!KeRemoveQueue+0x21 fffff880`04c14cc0 fffff800`01d30c06 srv2!SrvProcWorkerThread+0xf1 fffff880`04c14d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`04c14d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004c49b60 Cid 0004.0618 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffffa8004c46c40 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 3389 Ticks: 36901 (0:00:09:35.659) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address srv2!SrvProcWorkerThread (0xfffff88004a9d310) Stack Init fffff88004c1bdb0 Current fffff88004c1b9c0 Base fffff88004c1c000 Limit fffff88004c16000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04c1ba00 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04c1bb40 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04c1bbd0 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`04c1bc80 fffff880`04a9d401 nt!KeRemoveQueue+0x21 fffff880`04c1bcc0 fffff800`01d30c06 srv2!SrvProcWorkerThread+0xf1 fffff880`04c1bd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`04c1bd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004c48040 Cid 0004.0620 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffffa8004c467a0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 9893 Ticks: 30397 (0:00:07:54.196) Context Switch Count 30 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address srv2!SrvProcWorkerThread (0xfffff88004a9d310) Stack Init fffff88004c29db0 Current fffff88004c299c0 Base fffff88004c2a000 Limit fffff88004c24000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04c29a00 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04c29b40 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04c29bd0 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`04c29c80 fffff880`04a9d401 nt!KeRemoveQueue+0x21 fffff880`04c29cc0 fffff800`01d30c06 srv2!SrvProcWorkerThread+0xf1 fffff880`04c29d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`04c29d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004c48b60 Cid 0004.0628 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffffa8004c46920 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 3391 Ticks: 36899 (0:00:09:35.628) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address srv2!SrvProcWorkerThread (0xfffff88004a9d310) Stack Init fffff88004c30db0 Current fffff88004c309c0 Base fffff88004c31000 Limit fffff88004c2b000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04c30a00 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04c30b40 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04c30bd0 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`04c30c80 fffff880`04a9d401 nt!KeRemoveQueue+0x21 fffff880`04c30cc0 fffff800`01d30c06 srv2!SrvProcWorkerThread+0xf1 fffff880`04c30d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`04c30d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004c50b60 Cid 0004.062c Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffffa8004c46600 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 3392 Ticks: 36898 (0:00:09:35.612) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address srv2!SrvProcWorkerThread (0xfffff88004a9d310) Stack Init fffff88004c4adb0 Current fffff88004c4a9c0 Base fffff88004c4b000 Limit fffff88004c45000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04c4aa00 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04c4ab40 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04c4abd0 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`04c4ac80 fffff880`04a9d401 nt!KeRemoveQueue+0x21 fffff880`04c4acc0 fffff800`01d30c06 srv2!SrvProcWorkerThread+0xf1 fffff880`04c4ad40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`04c4ad80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004c51b60 Cid 0004.0634 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffffa8004c53028 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 3393 Ticks: 36897 (0:00:09:35.596) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address srv!WorkerThread (0xfffff88004b236d0) Stack Init fffff88004c5fdb0 Current fffff88004c5f9f0 Base fffff88004c60000 Limit fffff88004c5a000 Call 0 Priority 9 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04c5fa30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04c5fb70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04c5fc00 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`04c5fcb0 fffff880`04b23766 nt!KeRemoveQueue+0x21 fffff880`04c5fcf0 fffff800`01d30c06 srv!WorkerThread+0xa0 fffff880`04c5fd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`04c5fd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004c51680 Cid 0004.0638 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffffa8004c53348 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 3394 Ticks: 36896 (0:00:09:35.581) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address srv!WorkerThread (0xfffff88004b236d0) Stack Init fffff88004c51db0 Current fffff88004c519f0 Base fffff88004c52000 Limit fffff88004c4c000 Call 0 Priority 9 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04c51a30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04c51b70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04c51c00 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`04c51cb0 fffff880`04b23766 nt!KeRemoveQueue+0x21 fffff880`04c51cf0 fffff800`01d30c06 srv!WorkerThread+0xa0 fffff880`04c51d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`04c51d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004c527b0 Cid 0004.063c Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffffa8004c544c8 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 3395 Ticks: 36895 (0:00:09:35.565) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address srv!WorkerThread (0xfffff88004b236d0) Stack Init fffff88004c66db0 Current fffff88004c669f0 Base fffff88004c67000 Limit fffff88004c61000 Call 0 Priority 9 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04c66a30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04c66b70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04c66c00 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`04c66cb0 fffff880`04b23766 nt!KeRemoveQueue+0x21 fffff880`04c66cf0 fffff800`01d30c06 srv!WorkerThread+0xa0 fffff880`04c66d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`04c66d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004c54b60 Cid 0004.0640 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff88004afac08 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 3396 Ticks: 36894 (0:00:09:35.550) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address srv!WorkerThread (0xfffff88004b236d0) Stack Init fffff88004c6ddb0 Current fffff88004c6d9f0 Base fffff88004c6e000 Limit fffff88004c68000 Call 0 Priority 9 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04c6da30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04c6db70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04c6dc00 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`04c6dcb0 fffff880`04b23766 nt!KeRemoveQueue+0x21 fffff880`04c6dcf0 fffff800`01d30c06 srv!WorkerThread+0xa0 fffff880`04c6dd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`04c6dd80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004cdcb60 Cid 0004.07a4 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff880029b77a8 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40038 Ticks: 252 (0:00:00:03.931) Context Switch Count 91 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address rdbss!RxWorkerThreadDispatcher (0xfffff880029bb540) Stack Init fffff88004f56db0 Current fffff88004f56980 Base fffff88004f57000 Limit fffff88004f51000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04f569c0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04f56b00 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04f56b90 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`04f56c40 fffff880`0299c0d9 nt!KeRemoveQueue+0x21 fffff880`04f56c80 fffff800`01d30c06 rdbss!RxpWorkerThreadDispatcher+0xc9 fffff880`04f56d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`04f56d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004adc060 Cid 0004.07fc Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa8004ce7518 SynchronizationEvent fffffa8004ce7530 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40192 Ticks: 98 (0:00:00:01.528) Context Switch Count 1969 UserTime 00:00:00.000 KernelTime 00:00:00.031 Win32 Start Address nt!EtwpLogger (0xfffff80001d7e2e0) Stack Init fffff88004da6db0 Current fffff88004da6800 Base fffff88004da7000 Limit fffff88004da1000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04da6840 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04da6980 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04da6a10 fffff800`01d7e3d2 nt!KeWaitForMultipleObjects+0x271 fffff880`04da6cc0 fffff800`01d30c06 nt!EtwpLogger+0xf2 fffff880`04da6d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`04da6d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004e6a860 Cid 0004.0830 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff80001c315a0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 39166 Ticks: 1124 (0:00:00:17.534) Context Switch Count 773 UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address nt!ExpWorkerThread (0xfffff80001a99850) Stack Init fffff88002594db0 Current fffff880025949f0 Base fffff88002595000 Limit fffff8800258f000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02594a30 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02594b70 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`02594c00 fffff800`01a99939 nt!KeRemoveQueueEx+0x301 fffff880`02594cb0 fffff800`01d30c06 nt!ExpWorkerThread+0xe9 fffff880`02594d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`02594d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004ea1060 Cid 0004.0880 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa8004e69598 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 6562 Ticks: 33728 (0:00:08:46.160) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!EtwpLogger (0xfffff80001d7e2e0) Stack Init fffff88004419db0 Current fffff88004419800 Base fffff8800441a000 Limit fffff88004414000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04419840 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04419980 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04419a10 fffff800`01d7e3d2 nt!KeWaitForMultipleObjects+0x271 fffff880`04419cc0 fffff800`01d30c06 nt!EtwpLogger+0xf2 fffff880`04419d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`04419d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8005120040 Cid 0004.0a98 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff880029b7690 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40192 Ticks: 98 (0:00:00:01.528) Context Switch Count 134 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address rdbss!RxWorkerThreadDispatcher (0xfffff880029bb540) Stack Init fffff880045e4db0 Current fffff880045e4980 Base fffff880045e5000 Limit fffff880045df000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`045e49c0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`045e4b00 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`045e4b90 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`045e4c40 fffff880`0299c0d9 nt!KeRemoveQueue+0x21 fffff880`045e4c80 fffff800`01d30c06 rdbss!RxpWorkerThreadDispatcher+0xc9 fffff880`045e4d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`045e4d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8005120b60 Cid 0004.0a9c Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff880029b7690 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 39807 Ticks: 483 (0:00:00:07.534) Context Switch Count 116 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address rdbss!RxWorkerThreadDispatcher (0xfffff880029bb540) Stack Init fffff88004298db0 Current fffff88004298980 Base fffff88004299000 Limit fffff88004293000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`042989c0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04298b00 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04298b90 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`04298c40 fffff880`0299c0d9 nt!KeRemoveQueue+0x21 fffff880`04298c80 fffff800`01d30c06 rdbss!RxpWorkerThreadDispatcher+0xc9 fffff880`04298d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`04298d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa80050b8b60 Cid 0004.093c Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Executive) KernelMode Non-Alertable fffffa8004ecd218 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 12532 Ticks: 27758 (0:00:07:13.027) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nt!EtwpLogger (0xfffff80001d7e2e0) Stack Init fffff88005646db0 Current fffff88005646800 Base fffff88005647000 Limit fffff88005641000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05646840 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05646980 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`05646a10 fffff800`01d7e3d2 nt!KeWaitForMultipleObjects+0x271 fffff880`05646cc0 fffff800`01d30c06 nt!EtwpLogger+0xf2 fffff880`05646d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`05646d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa8004514b60 Cid 0004.0bb0 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff880029b7460 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40271 Ticks: 19 (0:00:00:00.296) Context Switch Count 9 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address rdbss!RxWorkerThreadDispatcher (0xfffff880029bb540) Stack Init fffff88005406db0 Current fffff88005406980 Base fffff88005407000 Limit fffff88005401000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`054069c0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05406b00 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`05406b90 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`05406c40 fffff880`0299c0d9 nt!KeRemoveQueue+0x21 fffff880`05406c80 fffff800`01d30c06 rdbss!RxpWorkerThreadDispatcher+0xc9 fffff880`05406d40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`05406d80 00000000`00000000 nt!KxStartSystemThread+0x16 THREAD fffffa80051a2a60 Cid 0004.14528 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (WrQueue) KernelMode Non-Alertable fffff880029b7690 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003baa890 Image: System Attached Process N/A Image: N/A Wait Start TickCount 40065 Ticks: 225 (0:00:00:03.510) Context Switch Count 11 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address rdbss!RxWorkerThreadDispatcher (0xfffff880029bb540) Stack Init fffff88007b9cdb0 Current fffff88007b9c980 Base fffff88007b9d000 Limit fffff88007b97000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`07b9c9c0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`07b9cb00 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`07b9cb90 fffff800`01a82751 nt!KeRemoveQueueEx+0x301 fffff880`07b9cc40 fffff880`0299c0d9 nt!KeRemoveQueue+0x21 fffff880`07b9cc80 fffff800`01d30c06 rdbss!RxpWorkerThreadDispatcher+0xc9 fffff880`07b9cd40 fffff800`01a6ac26 nt!PspSystemThreadStartup+0x5a fffff880`07b9cd80 00000000`00000000 nt!KxStartSystemThread+0x16 PROCESS fffffa8004277870 SessionId: none Cid: 011c Peb: 7fffffdf000 ParentCid: 0004 DirBase: 133579000 ObjectTable: fffff8a00000f3d0 HandleCount: 35. Image: smss.exe VadRoot fffffa800426f1d0 Vads 16 Clone 0 Private 89. Modified 9. Locked 0. DeviceMap fffff8a000008c10 Token fffff8a0005edc50 ElapsedTime 00:10:20.719 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (268, 50, 345) (1072KB, 200KB, 1380KB) PeakWorkingSetSize 275 VirtualSize 5 Mb PeakVirtualSize 18 Mb PageFaultCount 529 MemoryPriority BACKGROUND BasePriority 11 CommitCharge 115 Setting context for this process... .process /p /r fffffa8004277870 THREAD fffffa800426db60 Cid 011c.0120 Teb: 000007fffffdd000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa80048f3950 ProcessObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004277870 Image: smss.exe Attached Process N/A Image: N/A Wait Start TickCount 1692 Ticks: 38598 (0:00:10:02.132) Context Switch Count 457 UserTime 00:00:00.015 KernelTime 00:00:00.062 Win32 Start Address smss!NtProcessStartupW (0x0000000048427d9c) Stack Init fffff88002578db0 Current fffff88002577fd0 Base fffff88002579000 Limit fffff88002573000 Call 0 Priority 12 BasePriority 11 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`02578010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02578150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`025781e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`02578490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`02578960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`02578bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02578c20) 00000000`0028f7d8 00000000`4842557f ntdll!NtWaitForMultipleObjects+0xa 00000000`0028f7e0 00000000`48427d75 smss!wmain+0x4a3 00000000`0028f900 00000000`778339cb smss!NtProcessStartupW_AfterSecurityCookieInitialized+0x311 00000000`0028f990 00000000`00000000 ntdll!RtlUserThreadStart+0x25 THREAD fffffa8004480b60 Cid 011c.0150 Teb: 000007fffffd7000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004278190 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004277870 Image: smss.exe Attached Process N/A Image: N/A Wait Start TickCount 1686 Ticks: 38604 (0:00:10:02.226) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff8800259bdb0 Current fffff8800259b7d0 Base fffff8800259c000 Limit fffff88002596000 Call 0 Priority 12 BasePriority 11 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0259b810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0259b950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0259b9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0259ba90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0259bb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0259bc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0259bc20) 00000000`0034f6f8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0034f700 00000000`778339cb ntdll!TppWorkerThread+0x2c9 00000000`0034fa00 00000000`00000000 ntdll!RtlUserThreadStart+0x25 THREAD fffffa800491bb60 Cid 011c.01c8 Teb: 000007fffffd5000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004278190 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004277870 Image: smss.exe Attached Process N/A Image: N/A Wait Start TickCount 1686 Ticks: 38604 (0:00:10:02.226) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88002f61db0 Current fffff88002f617d0 Base fffff88002f62000 Limit fffff88002f5c000 Call 0 Priority 11 BasePriority 11 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`02f61810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02f61950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`02f619e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`02f61a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`02f61b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`02f61c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02f61c20) 00000000`0077fbf8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0077fc00 00000000`778339cb ntdll!TppWorkerThread+0x2c9 00000000`0077ff00 00000000`00000000 ntdll!RtlUserThreadStart+0x25 PROCESS fffffa80048f3950 SessionId: 0 Cid: 016c Peb: 7fffffdf000 ParentCid: 0154 DirBase: 128628000 ObjectTable: fffff8a001d62f90 HandleCount: 387. Image: csrss.exe VadRoot fffffa8004960460 Vads 91 Clone 0 Private 348. Modified 284. Locked 0. DeviceMap fffff8a000008c10 Token fffff8a001d496e0 ElapsedTime 00:10:04.901 UserTime 00:00:00.000 KernelTime 00:00:00.031 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (948, 50, 345) (3792KB, 200KB, 1380KB) PeakWorkingSetSize 952 VirtualSize 45 Mb PeakVirtualSize 46 Mb PageFaultCount 1272 MemoryPriority BACKGROUND BasePriority 13 CommitCharge 482 Setting context for this process... .process /p /r fffffa80048f3950 THREAD fffffa8004902a60 Cid 016c.0188 Teb: 000007fffffdb000 Win32Thread: fffff900c1cae850 WAIT: (WrLpcReply) UserMode Non-Alertable fffffa8004902e20 Semaphore Limit 0x1 Waiting for reply to ALPC Message fffff8a002626710 : queued at port fffffa80049fe6a0 : owned by process fffffa8004972b30 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048f3950 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 5157 Ticks: 35133 (0:00:09:08.078) Context Switch Count 9 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address winsrv!TerminalServerRequestThread (0x000007fefd753d44) Stack Init fffff88005131db0 Current fffff88005131690 Base fffff88005132000 Limit fffff8800512c000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`051316d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05131810 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`051318a0 fffff800`01aaad1f nt!KeWaitForSingleObject+0x19f fffff880`05131940 fffff800`01d92ac6 nt!AlpcpSignalAndWait+0x8f fffff880`051319f0 fffff800`01d90a50 nt!AlpcpReceiveSynchronousReply+0x46 fffff880`05131a50 fffff800`01d9f3dd nt!AlpcpProcessSynchronousRequest+0x33d fffff880`05131b70 fffff800`01d9f4b6 nt!LpcpRequestWaitReplyPort+0x9c fffff880`05131bd0 fffff800`01a8b993 nt!NtRequestWaitReplyPort+0x76 fffff880`05131c20 00000000`778200da nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05131c20) 00000000`00bdf7d8 000007fe`fd753eb1 ntdll!ZwRequestWaitReplyPort+0xa 00000000`00bdf7e0 00000000`778339cb winsrv!TerminalServerRequestThread+0x26d 00000000`00bdfa10 00000000`00000000 ntdll!RtlUserThreadStart+0x25 THREAD fffffa8004902560 Cid 016c.018c Teb: 000007fffffd9000 Win32Thread: fffff900c01d9010 WAIT: (UserRequest) UserMode Alertable fffffa80048cf1a0 SynchronizationEvent fffffa8004860350 SynchronizationEvent fffffa80048cc1a0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048f3950 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 2086 Ticks: 38204 (0:00:09:55.986) Context Switch Count 4 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address winsrv!NotificationThread (0x000007fefd753ae0) Stack Init fffff8800417adb0 Current fffff88004179fd0 Base fffff8800417b000 Limit fffff88004175000 Call 0 Priority 14 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0417a010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0417a150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0417a1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`0417a490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`0417a960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`0417abb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0417ac20) 00000000`004ef6f8 000007fe`fd753cd4 ntdll!NtWaitForMultipleObjects+0xa 00000000`004ef700 00000000`778339cb winsrv!NotificationThread+0x1f2 00000000`004efa10 00000000`00000000 ntdll!RtlUserThreadStart+0x25 THREAD fffffa8003cf8b60 Cid 016c.0190 Teb: 000007fffffd7000 Win32Thread: fffff900c00d5010 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8003cf8f20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048f3950 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 40244 Ticks: 46 (0:00:00:00.717) Context Switch Count 1810 LargeStack UserTime 00:00:00.078 KernelTime 00:00:00.140 Win32 Start Address CSRSRV!CsrApiRequestThread (0x000007fefd7b4be4) Stack Init fffff88002f37db0 Current fffff88002f37750 Base fffff88002f38000 Limit fffff88002f2f000 Call 0 Priority 14 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02f37790 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02f378d0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`02f37960 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`02f37a00 fffff800`01d8cac7 nt!AlpcpReceiveMessagePort+0x189 fffff880`02f37a60 fffff800`01d8e006 nt!AlpcpReceiveMessage+0x2d4 fffff880`02f37b00 fffff800`01a8b993 nt!NtAlpcSendWaitReceivePort+0x1e6 fffff880`02f37bb0 00000000`7782070a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02f37c20) 00000000`00c3f718 000007fe`fd7b4d51 ntdll!ZwAlpcSendWaitReceivePort+0xa 00000000`00c3f720 00000000`778339cb CSRSRV!CsrApiRequestThread+0x16d 00000000`00c3fa30 00000000`00000000 ntdll!RtlUserThreadStart+0x25 THREAD fffffa8003cf8430 Cid 016c.0194 Teb: 000007fffffd5000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8003cf87f0 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048f3950 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 1692 Ticks: 38598 (0:00:10:02.132) Context Switch Count 8 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address CSRSRV!CsrSbApiRequestThread (0x000007fefd7b3ff0) Stack Init fffff880025e1db0 Current fffff880025e1790 Base fffff880025e2000 Limit fffff880025dc000 Call 0 Priority 14 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`025e17d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`025e1910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`025e19a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`025e1a40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`025e1aa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`025e1b40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`025e1be0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`025e1c20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`025e1c20) 00000000`0055f928 000007fe`fd7b403d ntdll!NtReplyWaitReceivePort+0xa 00000000`0055f930 00000000`778339cb CSRSRV!CsrSbApiRequestThread+0x4d 00000000`0055fab0 00000000`00000000 ntdll!RtlUserThreadStart+0x25 THREAD fffffa800490d060 Cid 016c.01b0 Teb: 000007fffffdd000 Win32Thread: fffff900c01b55d0 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa800490d420 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048f3950 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 40244 Ticks: 46 (0:00:00:00.717) Context Switch Count 1716 LargeStack UserTime 00:00:00.046 KernelTime 00:00:00.046 Win32 Start Address CSRSRV!CsrApiRequestThread (0x000007fefd7b4be4) Stack Init fffff88002e99db0 Current fffff88002e99750 Base fffff88002e9a000 Limit fffff88002e91000 Call 0 Priority 14 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02e99790 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02e998d0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`02e99960 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`02e99a00 fffff800`01d8cac7 nt!AlpcpReceiveMessagePort+0x189 fffff880`02e99a60 fffff800`01d8e006 nt!AlpcpReceiveMessage+0x2d4 fffff880`02e99b00 fffff800`01a8b993 nt!NtAlpcSendWaitReceivePort+0x1e6 fffff880`02e99bb0 00000000`7782070a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02e99c20) 00000000`00b4f548 000007fe`fd7b4d51 ntdll!ZwAlpcSendWaitReceivePort+0xa 00000000`00b4f550 00000000`778339cb CSRSRV!CsrApiRequestThread+0x16d 00000000`00b4f860 00000000`00000000 ntdll!RtlUserThreadStart+0x25 THREAD fffffa800493eb60 Cid 016c.01f4 Teb: 000007fffffd3000 Win32Thread: fffff900c014a640 WAIT: (WrUserRequest) KernelMode Alertable fffffa8004934d70 SynchronizationEvent fffffa800493d3f0 NotificationTimer fffffa800493d3a0 SynchronizationTimer fffff80001c3c5e0 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048f3950 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 40223 Ticks: 67 (0:00:00:01.045) Context Switch Count 356 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address winsrv!StartCreateSystemThreads (0x000007fefd7542b0) Stack Init fffff88002ff1db0 Current fffff88002ff1630 Base fffff88002ff2000 Limit fffff88002fec000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02ff1670 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02ff17b0 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`02ff1840 fffff960`001133dd nt!KeWaitForMultipleObjects+0x271 fffff880`02ff1af0 fffff960`000a46cc win32k!RawInputThread+0x6ed fffff880`02ff1bc0 fffff960`00123fa6 win32k!xxxCreateSystemThreads+0x58 fffff880`02ff1bf0 fffff800`01a8b993 win32k!NtUserCallNoParam+0x36 fffff880`02ff1c20 000007fe`fd753d3a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02ff1c20) 00000000`00b9fe18 000007fe`fd7542c9 winsrv!NtUserCallNoParam+0xa 00000000`00b9fe20 00000000`778339cb winsrv!StartCreateSystemThreads+0x19 00000000`00b9fe50 00000000`00000000 ntdll!RtlUserThreadStart+0x25 THREAD fffffa8004940060 Cid 016c.01fc Teb: 000007fffffae000 Win32Thread: fffff900c01228e0 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa800493d330 SynchronizationEvent fffffa8004932450 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048f3950 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 11453 Ticks: 28837 (0:00:07:29.860) Context Switch Count 18 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address winsrv!StartCreateSystemThreads (0x000007fefd7542b0) Stack Init fffff8800253ddb0 Current fffff8800253d600 Base fffff8800253e000 Limit fffff88002538000 Call 0 Priority 15 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0253d640 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0253d780 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0253d810 fffff960`000e8770 nt!KeWaitForMultipleObjects+0x271 fffff880`0253dac0 fffff960`000e968c win32k!xxxMsgWaitForMultipleObjects+0x108 fffff880`0253db40 fffff960`000a46d8 win32k!xxxDesktopThread+0x254 fffff880`0253dbc0 fffff960`00123fa6 win32k!xxxCreateSystemThreads+0x64 fffff880`0253dbf0 fffff800`01a8b993 win32k!NtUserCallNoParam+0x36 fffff880`0253dc20 000007fe`fd753d3a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0253dc20) 00000000`0047f858 000007fe`fd7542c9 winsrv!NtUserCallNoParam+0xa 00000000`0047f860 00000000`778339cb winsrv!StartCreateSystemThreads+0x19 00000000`0047f890 00000000`00000000 ntdll!RtlUserThreadStart+0x25 THREAD fffffa800498f930 Cid 016c.0230 Teb: 000007fffffac000 Win32Thread: fffff900c0188c30 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa800498f810 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048f3950 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 1818 Ticks: 38472 (0:00:10:00.167) Context Switch Count 3 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address winsrv!StartCreateSystemThreads (0x000007fefd7542b0) Stack Init fffff8800408fdb0 Current fffff8800408f600 Base fffff88004090000 Limit fffff8800408a000 Call 0 Priority 14 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0408f640 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0408f780 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0408f810 fffff960`000e8770 nt!KeWaitForMultipleObjects+0x271 fffff880`0408fac0 fffff960`000e968c win32k!xxxMsgWaitForMultipleObjects+0x108 fffff880`0408fb40 fffff960`000a46d8 win32k!xxxDesktopThread+0x254 fffff880`0408fbc0 fffff960`00123fa6 win32k!xxxCreateSystemThreads+0x64 fffff880`0408fbf0 fffff800`01a8b993 win32k!NtUserCallNoParam+0x36 fffff880`0408fc20 000007fe`fd753d3a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0408fc20) 00000000`0236f8f8 000007fe`fd7542c9 winsrv!NtUserCallNoParam+0xa 00000000`0236f900 00000000`778339cb winsrv!StartCreateSystemThreads+0x19 00000000`0236f930 00000000`00000000 ntdll!RtlUserThreadStart+0x25 THREAD fffffa8004be1b60 Cid 016c.054c Teb: 000007fffffaa000 Win32Thread: fffff900c1c91c30 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8004be1f20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048f3950 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 39945 Ticks: 345 (0:00:00:05.382) Context Switch Count 1565 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.046 Win32 Start Address CSRSRV!CsrApiRequestThread (0x000007fefd7b4be4) Stack Init fffff8800494ddb0 Current fffff8800494d750 Base fffff8800494e000 Limit fffff88004945000 Call 0 Priority 14 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0494d790 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0494d8d0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0494d960 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`0494da00 fffff800`01d8cac7 nt!AlpcpReceiveMessagePort+0x189 fffff880`0494da60 fffff800`01d8e006 nt!AlpcpReceiveMessage+0x2d4 fffff880`0494db00 fffff800`01a8b993 nt!NtAlpcSendWaitReceivePort+0x1e6 fffff880`0494dbb0 00000000`7782070a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0494dc20) 00000000`0264f828 000007fe`fd7b4d51 ntdll!ZwAlpcSendWaitReceivePort+0xa 00000000`0264f830 00000000`778339cb CSRSRV!CsrApiRequestThread+0x16d 00000000`0264fb40 00000000`00000000 ntdll!RtlUserThreadStart+0x25 PROCESS fffffa8003cf60f0 SessionId: 1 Cid: 01a0 Peb: 7fffffd6000 ParentCid: 0198 DirBase: 127790000 ObjectTable: fffff8a001d7d100 HandleCount: 419. Image: csrss.exe VadRoot fffffa8004e94850 Vads 102 Clone 0 Private 437. Modified 2312. Locked 0. DeviceMap fffff8a000008c10 Token fffff8a001d7eb90 ElapsedTime 00:10:03.778 UserTime 00:00:00.000 KernelTime 00:00:00.171 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1428, 50, 345) (5712KB, 200KB, 1380KB) PeakWorkingSetSize 1428 VirtualSize 49 Mb PeakVirtualSize 49 Mb PageFaultCount 3965 MemoryPriority BACKGROUND BasePriority 13 CommitCharge 562 Setting context for this process... .process /p /r fffffa8003cf60f0 THREAD fffffa8004910a40 Cid 01a0.01b4 Teb: 000007fffffdc000 Win32Thread: fffff900c0190c30 WAIT: (WrLpcReply) UserMode Non-Alertable fffffa8004910e00 Semaphore Limit 0x1 Waiting for reply to ALPC Message fffff8a00264a750 : queued at port fffffa80049fe6a0 : owned by process fffffa8004972b30 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003cf60f0 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 12625 Ticks: 27665 (0:00:07:11.576) Context Switch Count 34 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address winsrv!TerminalServerRequestThread (0x000007fefd753d44) Stack Init fffff88004012db0 Current fffff88004012690 Base fffff88004013000 Limit fffff8800400c000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`040126d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04012810 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`040128a0 fffff800`01aaad1f nt!KeWaitForSingleObject+0x19f fffff880`04012940 fffff800`01d92ac6 nt!AlpcpSignalAndWait+0x8f fffff880`040129f0 fffff800`01d90a50 nt!AlpcpReceiveSynchronousReply+0x46 fffff880`04012a50 fffff800`01d9f3dd nt!AlpcpProcessSynchronousRequest+0x33d fffff880`04012b70 fffff800`01d9f4b6 nt!LpcpRequestWaitReplyPort+0x9c fffff880`04012bd0 fffff800`01a8b993 nt!NtRequestWaitReplyPort+0x76 fffff880`04012c20 00000000`778200da nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04012c20) 00000000`00b9fa48 000007fe`fd753eb1 ntdll!ZwRequestWaitReplyPort+0xa 00000000`00b9fa50 00000000`778339cb winsrv!TerminalServerRequestThread+0x26d 00000000`00b9fc80 00000000`00000000 ntdll!RtlUserThreadStart+0x25 THREAD fffffa8004910450 Cid 01a0.01b8 Teb: 000007fffffda000 Win32Thread: fffff900c00d7c30 WAIT: (UserRequest) UserMode Alertable fffffa80041c0e90 SynchronizationEvent fffffa80041c0f90 SynchronizationEvent fffffa80041c0f10 SynchronizationEvent fffffa8004910260 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003cf60f0 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 4958 Ticks: 35332 (0:00:09:11.182) Context Switch Count 6 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address winsrv!NotificationThread (0x000007fefd753ae0) Stack Init fffff8800418ddb0 Current fffff8800418cfd0 Base fffff8800418e000 Limit fffff88004188000 Call 0 Priority 14 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0418d010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0418d150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0418d1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`0418d490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`0418d960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`0418dbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0418dc20) 00000000`00adf768 000007fe`fd753cd4 ntdll!NtWaitForMultipleObjects+0xa 00000000`00adf770 00000000`778339cb winsrv!NotificationThread+0x1f2 00000000`00adfa80 00000000`00000000 ntdll!RtlUserThreadStart+0x25 THREAD fffffa800490c340 Cid 01a0.01bc Teb: 000007fffffd8000 Win32Thread: fffff900c00ce8d0 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa800490c700 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003cf60f0 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 39593 Ticks: 697 (0:00:00:10.873) Context Switch Count 14044 LargeStack UserTime 00:00:00.140 KernelTime 00:00:00.171 Win32 Start Address CSRSRV!CsrApiRequestThread (0x000007fefd7b4be4) Stack Init fffff88002f7bdb0 Current fffff88002f7b750 Base fffff88002f7c000 Limit fffff88002f73000 Call 0 Priority 14 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02f7b790 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02f7b8d0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`02f7b960 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`02f7ba00 fffff800`01d8cac7 nt!AlpcpReceiveMessagePort+0x189 fffff880`02f7ba60 fffff800`01d8e006 nt!AlpcpReceiveMessage+0x2d4 fffff880`02f7bb00 fffff800`01a8b993 nt!NtAlpcSendWaitReceivePort+0x1e6 fffff880`02f7bbb0 00000000`7782070a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02f7bc20) 00000000`00b5f778 000007fe`fd7b4d51 ntdll!ZwAlpcSendWaitReceivePort+0xa 00000000`00b5f780 00000000`778339cb CSRSRV!CsrApiRequestThread+0x16d 00000000`00b5fa90 00000000`00000000 ntdll!RtlUserThreadStart+0x25 THREAD fffffa8004911b60 Cid 01a0.01c0 Teb: 000007fffffd4000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8004911f20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003cf60f0 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 1691 Ticks: 38599 (0:00:10:02.148) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address CSRSRV!CsrSbApiRequestThread (0x000007fefd7b3ff0) Stack Init fffff88002f68db0 Current fffff88002f68790 Base fffff88002f69000 Limit fffff88002f63000 Call 0 Priority 14 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`02f687d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02f68910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`02f689a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`02f68a40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`02f68aa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`02f68b40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`02f68be0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`02f68c20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02f68c20) 00000000`00a9f708 000007fe`fd7b403d ntdll!NtReplyWaitReceivePort+0xa 00000000`00a9f710 00000000`778339cb CSRSRV!CsrSbApiRequestThread+0x4d 00000000`00a9f890 00000000`00000000 ntdll!RtlUserThreadStart+0x25 THREAD fffffa800491fb60 Cid 01a0.01d4 Teb: 000007fffffde000 Win32Thread: fffff900c01bfc30 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa800491ff20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003cf60f0 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 40020 Ticks: 270 (0:00:00:04.212) Context Switch Count 14062 LargeStack UserTime 00:00:00.140 KernelTime 00:00:00.124 Win32 Start Address CSRSRV!CsrApiRequestThread (0x000007fefd7b4be4) Stack Init fffff88002f23db0 Current fffff88002f23750 Base fffff88002f24000 Limit fffff88002f1b000 Call 0 Priority 14 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02f23790 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02f238d0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`02f23960 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`02f23a00 fffff800`01d8cac7 nt!AlpcpReceiveMessagePort+0x189 fffff880`02f23a60 fffff800`01d8e006 nt!AlpcpReceiveMessage+0x2d4 fffff880`02f23b00 fffff800`01a8b993 nt!NtAlpcSendWaitReceivePort+0x1e6 fffff880`02f23bb0 00000000`7782070a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02f23c20) 00000000`00e8f758 000007fe`fd7b4d51 ntdll!ZwAlpcSendWaitReceivePort+0xa 00000000`00e8f760 00000000`778339cb CSRSRV!CsrApiRequestThread+0x16d 00000000`00e8fa70 00000000`00000000 ntdll!RtlUserThreadStart+0x25 THREAD fffffa800493d490 Cid 01a0.01f8 Teb: 000007fffffae000 Win32Thread: fffff900c0145a60 WAIT: (WrUserRequest) KernelMode Alertable fffffa8004936200 SynchronizationEvent fffffa8004934b30 NotificationTimer fffffa8004934ae0 SynchronizationTimer fffffa8004923500 SynchronizationEvent IRP List: fffffa800458a8b0: (0006,03a0) Flags: 00060970 Mdl: 00000000 fffffa8004427e10: (0006,01f0) Flags: 00060970 Mdl: 00000000 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003cf60f0 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 40290 Ticks: 0 Context Switch Count 42343 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.265 Win32 Start Address winsrv!StartCreateSystemThreads (0x000007fefd7542b0) Stack Init fffff8800242edb0 Current fffff8800242e630 Base fffff8800242f000 Limit fffff88002429000 Call 0 Priority 14 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0242e670 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0242e7b0 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0242e840 fffff960`001133dd nt!KeWaitForMultipleObjects+0x271 fffff880`0242eaf0 fffff960`000a46cc win32k!RawInputThread+0x6ed fffff880`0242ebc0 fffff960`00123fa6 win32k!xxxCreateSystemThreads+0x58 fffff880`0242ebf0 fffff800`01a8b993 win32k!NtUserCallNoParam+0x36 fffff880`0242ec20 000007fe`fd753d3a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0242ec20) 00000000`00e2fd88 000007fe`fd7542c9 winsrv!NtUserCallNoParam+0xa 00000000`00e2fd90 00000000`778339cb winsrv!StartCreateSystemThreads+0x19 00000000`00e2fdc0 00000000`00000000 ntdll!RtlUserThreadStart+0x25 THREAD fffffa800493f060 Cid 01a0.0200 Teb: 000007fffffac000 Win32Thread: fffff900c012c010 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa800493ea40 SynchronizationEvent fffffa8004932fe0 SynchronizationEvent IRP List: fffffa8004a13010: (0006,03a0) Flags: 00060970 Mdl: 00000000 fffffa80047b1e10: (0006,01f0) Flags: 00060970 Mdl: 00000000 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003cf60f0 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 40290 Ticks: 0 Context Switch Count 18468 LargeStack UserTime 00:00:00.000 KernelTime 00:00:02.152 Win32 Start Address winsrv!StartCreateSystemThreads (0x000007fefd7542b0) Stack Init fffff88002560db0 Current fffff88002560600 Base fffff88002561000 Limit fffff8800255b000 Call 0 Priority 15 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02560640 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02560780 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`02560810 fffff960`000e8770 nt!KeWaitForMultipleObjects+0x271 fffff880`02560ac0 fffff960`000e968c win32k!xxxMsgWaitForMultipleObjects+0x108 fffff880`02560b40 fffff960`000a46d8 win32k!xxxDesktopThread+0x254 fffff880`02560bc0 fffff960`00123fa6 win32k!xxxCreateSystemThreads+0x64 fffff880`02560bf0 fffff800`01a8b993 win32k!NtUserCallNoParam+0x36 fffff880`02560c20 000007fe`fd753d3a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02560c20) 00000000`00d6ff18 000007fe`fd7542c9 winsrv!NtUserCallNoParam+0xa 00000000`00d6ff20 00000000`778339cb winsrv!StartCreateSystemThreads+0x19 00000000`00d6ff50 00000000`00000000 ntdll!RtlUserThreadStart+0x25 THREAD fffffa8004d42b60 Cid 01a0.0684 Teb: 000007fffffaa000 Win32Thread: fffff900c01d1470 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8004d42f20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8003cf60f0 Image: csrss.exe Attached Process N/A Image: N/A Wait Start TickCount 39184 Ticks: 1106 (0:00:00:17.253) Context Switch Count 14573 LargeStack UserTime 00:00:00.171 KernelTime 00:00:00.140 Win32 Start Address CSRSRV!CsrApiRequestThread (0x000007fefd7b4be4) Stack Init fffff88005012db0 Current fffff88005012750 Base fffff88005013000 Limit fffff8800500a000 Call 0 Priority 14 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05012790 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`050128d0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05012960 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`05012a00 fffff800`01d8cac7 nt!AlpcpReceiveMessagePort+0x189 fffff880`05012a60 fffff800`01d8e006 nt!AlpcpReceiveMessage+0x2d4 fffff880`05012b00 fffff800`01a8b993 nt!NtAlpcSendWaitReceivePort+0x1e6 fffff880`05012bb0 00000000`7782070a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05012c20) 00000000`0258f618 000007fe`fd7b4d51 ntdll!ZwAlpcSendWaitReceivePort+0xa 00000000`0258f620 00000000`778339cb CSRSRV!CsrApiRequestThread+0x16d 00000000`0258f930 00000000`00000000 ntdll!RtlUserThreadStart+0x25 PROCESS fffffa80048ec6c0 SessionId: 0 Cid: 01a8 Peb: 7fffffd6000 ParentCid: 011c DirBase: 127995000 ObjectTable: fffff8a001d80640 HandleCount: 792. Image: psxss.exe VadRoot fffffa8004908d10 Vads 100 Clone 0 Private 529. Modified 2. Locked 0. DeviceMap fffff8a000008c10 Token fffff8a001d827b0 ElapsedTime 00:10:03.731 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1406, 50, 345) (5624KB, 200KB, 1380KB) PeakWorkingSetSize 1414 VirtualSize 35 Mb PeakVirtualSize 36 Mb PageFaultCount 1498 MemoryPriority BACKGROUND BasePriority 13 CommitCharge 685 Setting context for this process... .process /p /r fffffa80048ec6c0 THREAD fffffa800490a060 Cid 01a8.01ac Teb: 000007fffffde000 Win32Thread: fffff900c00ba010 WAIT: (DelayExecution) UserMode Non-Alertable fffffa8004a3e7d0 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048ec6c0 Image: psxss.exe Attached Process N/A Image: N/A Wait Start TickCount 3060 Ticks: 37230 (0:00:09:40.791) Context Switch Count 359 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.015 Win32 Start Address psxss!mainCRTStartup (0x0000000049b38bac) Stack Init fffff88002f8edb0 Current fffff88002f8e970 Base fffff88002f8f000 Limit fffff88002f86000 Call 0 Priority 14 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`02f8e9b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02f8eaf0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`02f8eb80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`02f8ebf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`02f8ec20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02f8ec20) 00000000`0031f128 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`0031f130 00000000`49aeb841 KERNELBASE!SleepEx+0xab 00000000`0031f1d0 00000000`49b38a5d psxss!main+0xc45 00000000`0031f850 00000000`776cf56d psxss!GetComputerNameW+0x199 00000000`0031f890 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0031f8c0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800491a3b0 Cid 01a8.01c4 Teb: 000007fffffdc000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa800491a770 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048ec6c0 Image: psxss.exe Attached Process N/A Image: N/A Wait Start TickCount 1686 Ticks: 38604 (0:00:10:02.226) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address psxss!PsxSetTimeOfDay (0x0000000049aeee54) Stack Init fffff880025bedb0 Current fffff880025be790 Base fffff880025bf000 Limit fffff880025b9000 Call 0 Priority 14 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`025be7d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`025be910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`025be9a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`025bea40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`025beaa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`025beb40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`025bebe0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`025bec20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`025bec20) 00000000`00c1f5b8 00000000`49aef73a ntdll!NtReplyWaitReceivePort+0xa 00000000`00c1f5c0 00000000`49aeee9d psxss!PsxSbApiRequestThread+0x42 00000000`00c1f850 00000000`776cf56d psxss!PsxSetTimeOfDay+0x101 00000000`00c1f880 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00c1f8b0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a50230 Cid 01a8.03b0 Teb: 000007fffffda000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a50730 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048ec6c0 Image: psxss.exe Attached Process N/A Image: N/A Wait Start TickCount 2303 Ticks: 37987 (0:00:09:52.600) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address psxss!PsxSetTimeOfDay (0x0000000049aeee54) Stack Init fffff880041c5db0 Current fffff880041c4fd0 Base fffff880041c6000 Limit fffff880041c0000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`041c5010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`041c5150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`041c51e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`041c5490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`041c5960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`041c5bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`041c5c20) 00000000`00e1faa8 00000000`49b2eaca ntdll!NtWaitForMultipleObjects+0xa 00000000`00e1fab0 00000000`49aeee9d psxss!InitPsxThreadPool+0x2da 00000000`00e1faf0 00000000`776cf56d psxss!PsxSetTimeOfDay+0x101 00000000`00e1fb20 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00e1fb50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a51060 Cid 01a8.03b4 Teb: 000007fffffd8000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a50110 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048ec6c0 Image: psxss.exe Attached Process N/A Image: N/A Wait Start TickCount 2303 Ticks: 37987 (0:00:09:52.600) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address psxss!PsxSetTimeOfDay (0x0000000049aeee54) Stack Init fffff880042eddb0 Current fffff880042ed900 Base fffff880042ee000 Limit fffff880042e8000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`042ed940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`042eda80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`042edb10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`042edbb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`042edc20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`042edc20) 00000000`00ccf968 00000000`49b2e8e6 ntdll!NtWaitForSingleObject+0xa 00000000`00ccf970 00000000`49aeee9d psxss!InitPsxThreadPool+0xf6 00000000`00ccf9a0 00000000`776cf56d psxss!PsxSetTimeOfDay+0x101 00000000`00ccf9d0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00ccfa00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a51ac0 Cid 01a8.03b8 Teb: 000007fffffd4000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a50110 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048ec6c0 Image: psxss.exe Attached Process N/A Image: N/A Wait Start TickCount 2303 Ticks: 37987 (0:00:09:52.600) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address psxss!PsxSetTimeOfDay (0x0000000049aeee54) Stack Init fffff88004307db0 Current fffff88004307900 Base fffff88004308000 Limit fffff88004302000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04307940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04307a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04307b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04307bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04307c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04307c20) 00000000`00eafec8 00000000`49b2e8e6 ntdll!NtWaitForSingleObject+0xa 00000000`00eafed0 00000000`49aeee9d psxss!InitPsxThreadPool+0xf6 00000000`00eaff00 00000000`776cf56d psxss!PsxSetTimeOfDay+0x101 00000000`00eaff30 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00eaff60 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a52060 Cid 01a8.03bc Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a50110 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048ec6c0 Image: psxss.exe Attached Process N/A Image: N/A Wait Start TickCount 2303 Ticks: 37987 (0:00:09:52.600) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address psxss!PsxSetTimeOfDay (0x0000000049aeee54) Stack Init fffff8800430edb0 Current fffff8800430e900 Base fffff8800430f000 Limit fffff88004309000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0430e940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0430ea80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0430eb10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`0430ebb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`0430ec20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0430ec20) 00000000`0100f7b8 00000000`49b2e8e6 ntdll!NtWaitForSingleObject+0xa 00000000`0100f7c0 00000000`49aeee9d psxss!InitPsxThreadPool+0xf6 00000000`0100f7f0 00000000`776cf56d psxss!PsxSetTimeOfDay+0x101 00000000`0100f820 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0100f850 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a52b60 Cid 01a8.03c0 Teb: 000007fffffac000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a4d2b0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048ec6c0 Image: psxss.exe Attached Process N/A Image: N/A Wait Start TickCount 2303 Ticks: 37987 (0:00:09:52.600) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address psxss!PsxSetTimeOfDay (0x0000000049aeee54) Stack Init fffff88004315db0 Current fffff88004315900 Base fffff88004316000 Limit fffff88004310000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04315940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04315a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04315b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04315bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04315c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04315c20) 00000000`010af778 00000000`49ace2fa ntdll!NtWaitForSingleObject+0xa 00000000`010af780 00000000`49aeee9d psxss!DomainSweepCache+0x326 00000000`010af8a0 00000000`776cf56d psxss!PsxSetTimeOfDay+0x101 00000000`010af8d0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`010af900 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a534b0 Cid 01a8.03c4 Teb: 000007fffffaa000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004a539b0 SynchronizationTimer fffffa8004a53b20 SynchronizationTimer fffffa8004a532a0 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048ec6c0 Image: psxss.exe Attached Process N/A Image: N/A Wait Start TickCount 13843 Ticks: 26447 (0:00:06:52.575) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff8800431cdb0 Current fffff8800431bfd0 Base fffff8800431d000 Limit fffff88004317000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0431c010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0431c150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0431c1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`0431c490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`0431c960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`0431cbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0431cc20) 00000000`0093f698 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`0093f6a0 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`0093f940 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0093f970 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004bbd060 Cid 01a8.04ec Teb: 000007fffffa6000 Win32Thread: fffff900c1c8c010 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004bbc3c0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048ec6c0 Image: psxss.exe Attached Process N/A Image: N/A Wait Start TickCount 12625 Ticks: 27665 (0:00:07:11.576) Context Switch Count 15 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address psxss!PsxSetTimeOfDay (0x0000000049aeee54) Stack Init fffff8800485ddb0 Current fffff8800485d720 Base fffff8800485e000 Limit fffff88004857000 Call 0 Priority 15 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0485d760 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0485d8a0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0485d930 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`0485d9d0 fffff960`00119bf3 win32k!xxxRealSleepThread+0x257 fffff880`0485da70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7b3 fffff880`0485db50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`0485db90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`0485dc20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0485dc20) 00000000`0152f758 00000000`775c899e USER32!NtUserGetMessage+0xa 00000000`0152f760 00000000`49b2606b USER32!GetMessageA+0xc4 00000000`0152f790 00000000`49aeee9d psxss!AsyncMethod+0x2b3 00000000`0152f890 00000000`776cf56d psxss!PsxSetTimeOfDay+0x101 00000000`0152f8c0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0152f8f0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004bc11d0 Cid 01a8.04f0 Teb: 000007fffffa4000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8004bc1590 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048ec6c0 Image: psxss.exe Attached Process N/A Image: N/A Wait Start TickCount 3059 Ticks: 37231 (0:00:09:40.807) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address psxss!PsxSetTimeOfDay (0x0000000049aeee54) Stack Init fffff8800457fdb0 Current fffff8800457f750 Base fffff88004580000 Limit fffff8800457a000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0457f790 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0457f8d0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0457f960 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`0457fa00 fffff800`01d8cac7 nt!AlpcpReceiveMessagePort+0x189 fffff880`0457fa60 fffff800`01d8e006 nt!AlpcpReceiveMessage+0x2d4 fffff880`0457fb00 fffff800`01a8b993 nt!NtAlpcSendWaitReceivePort+0x1e6 fffff880`0457fbb0 00000000`7782070a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0457fc20) 00000000`013ff968 00000000`49acaae6 ntdll!ZwAlpcSendWaitReceivePort+0xa 00000000`013ff970 00000000`49aeee9d psxss!PsxTerminalRequestThread+0x102 00000000`013ffa70 00000000`776cf56d psxss!PsxSetTimeOfDay+0x101 00000000`013ffaa0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`013ffad0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004bc1b60 Cid 01a8.04f4 Teb: 000007fffffa2000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8004bc1f20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048ec6c0 Image: psxss.exe Attached Process N/A Image: N/A Wait Start TickCount 3059 Ticks: 37231 (0:00:09:40.807) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address psxss!PsxSetTimeOfDay (0x0000000049aeee54) Stack Init fffff88004843db0 Current fffff88004843790 Base fffff88004844000 Limit fffff8800483e000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`048437d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04843910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`048439a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`04843a40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`04843aa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`04843b40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`04843be0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`04843c20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04843c20) 00000000`0168f938 00000000`49b33233 ntdll!NtReplyWaitReceivePort+0xa 00000000`0168f940 00000000`49aeee9d psxss!PsxDbgRequestThread+0x7b 00000000`0168f970 00000000`776cf56d psxss!PsxSetTimeOfDay+0x101 00000000`0168f9a0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0168f9d0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004bc2060 Cid 01a8.04f8 Teb: 000007fffffa0000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004bc2060 Thread Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048ec6c0 Image: psxss.exe Attached Process N/A Image: N/A Wait Start TickCount 3059 Ticks: 37231 (0:00:09:40.807) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address psxss!PsxSetTimeOfDay (0x0000000049aeee54) Stack Init fffff8800484adb0 Current fffff8800484a900 Base fffff8800484b000 Limit fffff88004845000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0484a940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0484aa80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0484ab10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`0484abb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`0484ac20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0484ac20) 00000000`0160fa78 00000000`49b14947 ntdll!NtWaitForSingleObject+0xa 00000000`0160fa80 00000000`49aeee9d psxss!AlarmThreadRoutine+0x6b 00000000`0160fad0 00000000`776cf56d psxss!PsxSetTimeOfDay+0x101 00000000`0160fb00 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0160fb30 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004bc2b60 Cid 01a8.04fc Teb: 000007fffff9e000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8004bc2f20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048ec6c0 Image: psxss.exe Attached Process N/A Image: N/A Wait Start TickCount 3061 Ticks: 37229 (0:00:09:40.776) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address psxss!PsxSetTimeOfDay (0x0000000049aeee54) Stack Init fffff88004864db0 Current fffff88004864790 Base fffff88004865000 Limit fffff8800485f000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`048647d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04864910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`048649a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`04864a40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`04864aa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`04864b40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`04864be0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`04864c20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04864c20) 00000000`0180f8a8 00000000`49ac1774 ntdll!NtReplyWaitReceivePort+0xa 00000000`0180f8b0 00000000`49aeee9d psxss!PsxApiRequestThread+0x13c 00000000`0180fb20 00000000`776cf56d psxss!PsxSetTimeOfDay+0x101 00000000`0180fb50 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0180fb80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004bc2660 Cid 01a8.0500 Teb: 000007fffff9c000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8004bc2a20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048ec6c0 Image: psxss.exe Attached Process N/A Image: N/A Wait Start TickCount 3061 Ticks: 37229 (0:00:09:40.776) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address psxss!PsxSetTimeOfDay (0x0000000049aeee54) Stack Init fffff8800486bdb0 Current fffff8800486b790 Base fffff8800486c000 Limit fffff88004866000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0486b7d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0486b910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0486b9a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`0486ba40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`0486baa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`0486bb40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`0486bbe0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`0486bc20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0486bc20) 00000000`018cfc68 00000000`49ac1774 ntdll!NtReplyWaitReceivePort+0xa 00000000`018cfc70 00000000`49aeee9d psxss!PsxApiRequestThread+0x13c 00000000`018cfee0 00000000`776cf56d psxss!PsxSetTimeOfDay+0x101 00000000`018cff10 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`018cff40 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004bc3060 Cid 01a8.0504 Teb: 000007fffff9a000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8004bc3420 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048ec6c0 Image: psxss.exe Attached Process N/A Image: N/A Wait Start TickCount 3061 Ticks: 37229 (0:00:09:40.776) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address psxss!PsxSetTimeOfDay (0x0000000049aeee54) Stack Init fffff88004872db0 Current fffff88004872790 Base fffff88004873000 Limit fffff8800486d000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`048727d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04872910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`048729a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`04872a40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`04872aa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`04872b40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`04872be0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`04872c20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04872c20) 00000000`0148fa88 00000000`49ac1774 ntdll!NtReplyWaitReceivePort+0xa 00000000`0148fa90 00000000`49aeee9d psxss!PsxApiRequestThread+0x13c 00000000`0148fd00 00000000`776cf56d psxss!PsxSetTimeOfDay+0x101 00000000`0148fd30 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0148fd60 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004bc3b60 Cid 01a8.0508 Teb: 000007fffff98000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8004bc3f20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048ec6c0 Image: psxss.exe Attached Process N/A Image: N/A Wait Start TickCount 3061 Ticks: 37229 (0:00:09:40.776) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address psxss!PsxSetTimeOfDay (0x0000000049aeee54) Stack Init fffff88004879db0 Current fffff88004879790 Base fffff8800487a000 Limit fffff88004874000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`048797d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04879910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`048799a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`04879a40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`04879aa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`04879b40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`04879be0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`04879c20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04879c20) 00000000`0175faa8 00000000`49ac1774 ntdll!NtReplyWaitReceivePort+0xa 00000000`0175fab0 00000000`49aeee9d psxss!PsxApiRequestThread+0x13c 00000000`0175fd20 00000000`776cf56d psxss!PsxSetTimeOfDay+0x101 00000000`0175fd50 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0175fd80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004bc3660 Cid 01a8.050c Teb: 000007fffff96000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8004bc3a20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048ec6c0 Image: psxss.exe Attached Process N/A Image: N/A Wait Start TickCount 3061 Ticks: 37229 (0:00:09:40.776) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address psxss!PsxSetTimeOfDay (0x0000000049aeee54) Stack Init fffff88004880db0 Current fffff88004880790 Base fffff88004881000 Limit fffff8800487b000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`048807d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04880910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`048809a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`04880a40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`04880aa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`04880b40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`04880be0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`04880c20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04880c20) 00000000`01aef9c8 00000000`49ac1774 ntdll!NtReplyWaitReceivePort+0xa 00000000`01aef9d0 00000000`49aeee9d psxss!PsxApiRequestThread+0x13c 00000000`01aefc40 00000000`776cf56d psxss!PsxSetTimeOfDay+0x101 00000000`01aefc70 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01aefca0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004bc4b60 Cid 01a8.0510 Teb: 000007fffff94000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8004bc4f20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048ec6c0 Image: psxss.exe Attached Process N/A Image: N/A Wait Start TickCount 3059 Ticks: 37231 (0:00:09:40.807) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address psxss!PsxSetTimeOfDay (0x0000000049aeee54) Stack Init fffff88004887db0 Current fffff88004887750 Base fffff88004888000 Limit fffff88004882000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04887790 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`048878d0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04887960 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`04887a00 fffff800`01d8cac7 nt!AlpcpReceiveMessagePort+0x189 fffff880`04887a60 fffff800`01d8e006 nt!AlpcpReceiveMessage+0x2d4 fffff880`04887b00 fffff800`01a8b993 nt!NtAlpcSendWaitReceivePort+0x1e6 fffff880`04887bb0 00000000`7782070a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04887c20) 00000000`0198fcd8 00000000`49aea5f0 ntdll!ZwAlpcSendWaitReceivePort+0xa 00000000`0198fce0 00000000`49aeee9d psxss!PsxrunRequestThread+0xb4 00000000`0198fe50 00000000`776cf56d psxss!PsxSetTimeOfDay+0x101 00000000`0198fe80 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0198feb0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8003c28060 Cid 01a8.09d8 Teb: 000007fffff92000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004a53da0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80048ec6c0 Image: psxss.exe Attached Process N/A Image: N/A Wait Start TickCount 39613 Ticks: 677 (0:00:00:10.561) Context Switch Count 11 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004dbbdb0 Current fffff88004dbb7d0 Base fffff88004dbc000 Limit fffff88004db6000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04dbb810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04dbb950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04dbb9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04dbba90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04dbbb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04dbbc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04dbbc20) 00000000`01c8fc08 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`01c8fc10 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`01c8ff10 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01c8ff40 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa800491d910 SessionId: 1 Cid: 01cc Peb: 7fffffdf000 ParentCid: 0198 DirBase: 126d56000 ObjectTable: fffff8a001d8a0c0 HandleCount: 95. Image: winlogon.exe VadRoot fffffa800491c930 Vads 61 Clone 0 Private 334. Modified 2. Locked 0. DeviceMap fffff8a000008c10 Token fffff8a001d95c50 ElapsedTime 00:10:02.654 UserTime 00:00:00.015 KernelTime 00:00:00.046 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1250, 50, 345) (5000KB, 200KB, 1380KB) PeakWorkingSetSize 1263 VirtualSize 30 Mb PeakVirtualSize 55 Mb PageFaultCount 1380 MemoryPriority BACKGROUND BasePriority 13 CommitCharge 413 Setting context for this process... .process /p /r fffffa800491d910 THREAD fffffa800491f060 Cid 01cc.01d0 Teb: 000007fffffdd000 Win32Thread: fffff900c00df900 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a10d00 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa800491d910 Image: winlogon.exe Attached Process N/A Image: N/A Wait Start TickCount 10897 Ticks: 29393 (0:00:07:38.533) Context Switch Count 449 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.046 Win32 Start Address winlogon!WinMainCRTStartup (0x00000000ff06ec08) Stack Init fffff88002fd0db0 Current fffff88002fd0900 Base fffff88002fd1000 Limit fffff88002fc7000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`02fd0940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02fd0a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`02fd0b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`02fd0bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`02fd0c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02fd0c20) 00000000`001ff778 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`001ff780 00000000`ff0619ad KERNELBASE!WaitForSingleObjectEx+0x79 00000000`001ff820 00000000`ff0616e8 winlogon!SignalManagerWaitForSignal+0x135 00000000`001ff860 00000000`ff06b8b0 winlogon!StateMachineRun+0x404 00000000`001ffb80 00000000`ff06ed85 winlogon!WinMain+0x13a3 00000000`001ffcf0 00000000`776cf56d winlogon!I_WMsgkSendMessage+0x252 00000000`001ffdb0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`001ffde0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a07390 Cid 01cc.0318 Teb: 000007fffffd7000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004a07890 SynchronizationTimer fffffa8004a07a00 SynchronizationTimer fffffa8004a80e40 NotificationEvent fffffa8004d342d0 SynchronizationEvent fffffa8004d34230 SynchronizationEvent fffffa8004d34130 SynchronizationEvent fffffa8004a08060 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa800491d910 Image: winlogon.exe Attached Process N/A Image: N/A Wait Start TickCount 19437 Ticks: 20853 (0:00:05:25.308) Context Switch Count 17 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff880025fddb0 Current fffff880025fcfd0 Base fffff880025fe000 Limit fffff880025f8000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`025fd010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`025fd150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`025fd1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`025fd490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`025fd960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`025fdbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`025fdc20) 00000000`012ff688 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`012ff690 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`012ff930 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`012ff960 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004553b60 Cid 01cc.0b70 Teb: 000007fffffd5000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049225c0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa800491d910 Image: winlogon.exe Attached Process N/A Image: N/A Wait Start TickCount 36617 Ticks: 3673 (0:00:00:57.299) Context Switch Count 5 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880055f7db0 Current fffff880055f77d0 Base fffff880055f8000 Limit fffff880055f2000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`055f7810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`055f7950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`055f79e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`055f7a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`055f7b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`055f7c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`055f7c20) 00000000`0115f7f8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0115f800 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0115fb00 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0115fb30 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa800491f630 SessionId: 0 Cid: 01d8 Peb: 7fffffd5000 ParentCid: 0154 DirBase: 1270ae000 ObjectTable: fffff8a001d8c830 HandleCount: 77. Image: wininit.exe VadRoot fffffa800491f540 Vads 61 Clone 0 Private 281. Modified 8. Locked 3. DeviceMap fffff8a000008c10 Token fffff8a001d94650 ElapsedTime 00:10:02.639 UserTime 00:00:00.015 KernelTime 00:00:00.062 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1050, 50, 345) (4200KB, 200KB, 1380KB) PeakWorkingSetSize 1067 VirtualSize 48 Mb PeakVirtualSize 51 Mb PageFaultCount 1166 MemoryPriority BACKGROUND BasePriority 13 CommitCharge 366 Setting context for this process... .process /p /r fffffa800491f630 THREAD fffffa8004921b60 Cid 01d8.01dc Teb: 000007fffffde000 Win32Thread: fffff900c00bb010 WAIT: (UserRequest) UserMode Non-Alertable fffffa80049536c0 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa800491f630 Image: wininit.exe Attached Process N/A Image: N/A Wait Start TickCount 1901 Ticks: 38389 (0:00:09:58.872) Context Switch Count 346 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.046 Win32 Start Address wininit!WinMainCRTStartup (0x00000000ffaa6290) Stack Init fffff88002fbddb0 Current fffff88002fbd900 Base fffff88002fbe000 Limit fffff88002fb4000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`02fbd940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02fbda80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`02fbdb10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`02fbdbb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`02fbdc20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02fbdc20) 00000000`000ef9c8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`000ef9d0 00000000`ffaa284c KERNELBASE!WaitForSingleObjectEx+0x79 00000000`000efa70 00000000`ffaa640d wininit!WinMain+0xf30 00000000`000efba0 00000000`776cf56d wininit!EnablePrivilege+0x272 00000000`000efc60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`000efc90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80049639f0 Cid 01d8.0208 Teb: 000007fffffd6000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004963ef0 SynchronizationTimer fffffa80049623e0 SynchronizationTimer fffffa80049655f0 ProcessObject fffffa8004970b30 ProcessObject fffffa8004972b30 ProcessObject fffffa8004963880 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa800491f630 Image: wininit.exe Attached Process N/A Image: N/A Wait Start TickCount 13665 Ticks: 26625 (0:00:06:55.352) Context Switch Count 12 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff88002ecbdb0 Current fffff88002ecafd0 Base fffff88002ecc000 Limit fffff88002ec6000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`02ecb010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02ecb150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`02ecb1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`02ecb490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`02ecb960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`02ecbbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02ecbc20) 00000000`0249f928 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`0249f930 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`0249fbd0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0249fc00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004ffb060 Cid 01d8.06d4 Teb: 000007fffffdc000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80043548a0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa800491f630 Image: wininit.exe Attached Process N/A Image: N/A Wait Start TickCount 39435 Ticks: 855 (0:00:00:13.338) Context Switch Count 8 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff8800449fdb0 Current fffff8800449f7d0 Base fffff880044a0000 Limit fffff8800449a000 Call 0 Priority 13 BasePriority 13 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0449f810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0449f950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0449f9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0449fa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0449fb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0449fc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0449fc20) 00000000`00d5fbe8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`00d5fbf0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`00d5fef0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00d5ff20 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa80049655f0 SessionId: 0 Cid: 0210 Peb: 7fffffdb000 ParentCid: 01d8 DirBase: 125d4e000 ObjectTable: fffff8a001ea5580 HandleCount: 215. Image: services.exe VadRoot fffffa8004965500 Vads 89 Clone 0 Private 947. Modified 35. Locked 2. DeviceMap fffff8a000008c10 Token fffff8a001eaa060 ElapsedTime 00:10:01.718 UserTime 00:00:00.156 KernelTime 00:00:00.858 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (2003, 50, 345) (8012KB, 200KB, 1380KB) PeakWorkingSetSize 2878 VirtualSize 42 Mb PeakVirtualSize 47 Mb PageFaultCount 3324 MemoryPriority BACKGROUND BasePriority 9 CommitCharge 1106 Setting context for this process... .process /p /r fffffa80049655f0 THREAD fffffa80049b5060 Cid 0210.0254 Teb: 000007fffffdc000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa80049b2380 SynchronizationTimer fffffa80049b41d0 SynchronizationTimer fffffa80049c6b30 ProcessObject fffffa80049dc060 ProcessObject fffffa8004a1b740 ProcessObject fffffa8004a282f0 ProcessObject fffffa8004a444f0 ProcessObject fffffa8004a57b30 ProcessObject fffffa8004a7c590 ProcessObject fffffa800495db30 ProcessObject fffffa8004b9eb30 ProcessObject fffffa8004bdeb30 ProcessObject fffffa8004c05790 ProcessObject fffffa8004969da0 SynchronizationTimer fffffa8004d16060 ProcessObject fffffa8004ce66a0 ProcessObject fffffa8004d23b30 ProcessObject fffffa8004990dc0 NotificationEvent fffffa8005094060 ProcessObject fffffa80050a2060 ProcessObject fffffa8005101060 ProcessObject fffffa8005175a60 ProcessObject fffffa800486cdc0 SynchronizationTimer fffffa800540e060 ProcessObject fffffa80049b5ef0 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049655f0 Image: services.exe Attached Process N/A Image: N/A Wait Start TickCount 39699 Ticks: 591 (0:00:00:09.219) Context Switch Count 73 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff880040b0db0 Current fffff880040affd0 Base fffff880040b1000 Limit fffff880040ab000 Call 0 Priority 11 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`040b0010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`040b0150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`040b01e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`040b0490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`040b0960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`040b0bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`040b0c20) 00000000`00eaf7b8 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`00eaf7c0 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`00eafa60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00eafa90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80049be6c0 Cid 0210.0274 Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004c72600 SynchronizationEvent fffffa8004c72680 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049655f0 Image: services.exe Attached Process N/A Image: N/A Wait Start TickCount 37307 Ticks: 2983 (0:00:00:46.535) Context Switch Count 35 UserTime 00:00:00.015 KernelTime 00:00:00.000 Win32 Start Address UBPM!UbpmpConsumeEvents (0x000007fefc9294c4) Stack Init fffff880025b7db0 Current fffff880025b6fd0 Base fffff880025b8000 Limit fffff880025b2000 Call 0 Priority 9 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`025b7010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`025b7150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`025b71e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`025b7490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`025b7960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`025b7bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`025b7c20) 00000000`0133f6a8 000007fe`fedf0407 ntdll!NtWaitForMultipleObjects+0xa 00000000`0133f6b0 000007fe`fedf0cf4 ADVAPI32!EtwpProcessRealTimeTraces+0x85 00000000`0133f710 000007fe`fc929550 ADVAPI32!ProcessTrace+0x23f 00000000`0133fb80 00000000`776cf56d UBPM!UbpmpConsumeEvents+0x105 00000000`0133fbd0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0133fc00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80049d6060 Cid 0210.02c0 Teb: 000007fffffa8000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049d49f0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049655f0 Image: services.exe Attached Process N/A Image: N/A Wait Start TickCount 5372 Ticks: 34918 (0:00:09:04.724) Context Switch Count 8 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88002f5adb0 Current fffff88002f5a7d0 Base fffff88002f5b000 Limit fffff88002f55000 Call 0 Priority 10 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`02f5a810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02f5a950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`02f5a9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`02f5aa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`02f5ab20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`02f5ac20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02f5ac20) 00000000`014afb08 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`014afb10 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`014afe10 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`014afe40 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004fcdb60 Cid 0210.0834 Teb: 000007fffffd9000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049aa620 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049655f0 Image: services.exe Attached Process N/A Image: N/A Wait Start TickCount 39699 Ticks: 591 (0:00:00:09.219) Context Switch Count 938 UserTime 00:00:00.000 KernelTime 00:00:00.046 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880009fcdb0 Current fffff880009fc7d0 Base fffff880009fd000 Limit fffff880009f7000 Call 0 Priority 10 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`009fc810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`009fc950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`009fc9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`009fca90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`009fcb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`009fcc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`009fcc20) 00000000`00c8fa28 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`00c8fa30 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`00c8fd30 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00c8fd60 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80050d4060 Cid 0210.0154 Teb: 000007fffffd5000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049ba060 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049655f0 Image: services.exe Attached Process N/A Image: N/A Wait Start TickCount 39675 Ticks: 615 (0:00:00:09.594) Context Switch Count 14 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004077db0 Current fffff880040777d0 Base fffff88004078000 Limit fffff88004072000 Call 0 Priority 9 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04077810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04077950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`040779e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04077a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04077b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04077c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04077c20) 00000000`0140f4f8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0140f500 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0140f800 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0140f830 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005332b60 Cid 0210.08e8 Teb: 000007fffffde000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049aa620 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049655f0 Image: services.exe Attached Process N/A Image: N/A Wait Start TickCount 37051 Ticks: 3239 (0:00:00:50.528) Context Switch Count 46 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005420db0 Current fffff880054207d0 Base fffff88005421000 Limit fffff8800541b000 Call 0 Priority 9 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05420810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05420950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`054209e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05420a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05420b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05420c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05420c20) 00000000`0013f978 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0013f980 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0013fc80 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0013fcb0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005186060 Cid 0210.0494 Teb: 000007fffffd7000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049ba060 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049655f0 Image: services.exe Attached Process N/A Image: N/A Wait Start TickCount 37051 Ticks: 3239 (0:00:00:50.528) Context Switch Count 5 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005309db0 Current fffff880053097d0 Base fffff8800530a000 Limit fffff88005304000 Call 0 Priority 9 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05309810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05309950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`053099e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05309a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05309b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05309c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05309c20) 00000000`0112f688 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0112f690 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0112f990 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0112f9c0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005187060 Cid 0210.09e4 Teb: 000007fffffd3000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049ba060 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049655f0 Image: services.exe Attached Process N/A Image: N/A Wait Start TickCount 37051 Ticks: 3239 (0:00:00:50.528) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005a7adb0 Current fffff88005a7a7d0 Base fffff88005a7b000 Limit fffff88005a75000 Call 0 Priority 9 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05a7a810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05a7a950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`05a7a9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05a7aa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05a7ab20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05a7ac20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05a7ac20) 00000000`00dbfc38 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`00dbfc40 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`00dbff40 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00dbff70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800535fb60 Cid 0210.0320 Teb: 000007fffffac000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049ba060 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049655f0 Image: services.exe Attached Process N/A Image: N/A Wait Start TickCount 37051 Ticks: 3239 (0:00:00:50.528) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005ab4db0 Current fffff88005ab47d0 Base fffff88005ab5000 Limit fffff88005aaf000 Call 0 Priority 9 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05ab4810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05ab4950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`05ab49e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05ab4a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05ab4b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05ab4c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05ab4c20) 00000000`0106f9a8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0106f9b0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0106fcb0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0106fce0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005360060 Cid 0210.08b4 Teb: 000007fffffaa000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049aa620 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049655f0 Image: services.exe Attached Process N/A Image: N/A Wait Start TickCount 38696 Ticks: 1594 (0:00:00:24.866) Context Switch Count 43 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005ac2db0 Current fffff88005ac27d0 Base fffff88005ac3000 Limit fffff88005abd000 Call 0 Priority 9 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05ac2810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05ac2950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`05ac29e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05ac2a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05ac2b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05ac2c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05ac2c20) 00000000`0238f998 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0238f9a0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0238fca0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0238fcd0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004970b30 SessionId: 0 Cid: 0218 Peb: 7fffffda000 ParentCid: 01d8 DirBase: 125daf000 ObjectTable: fffff8a001e805b0 HandleCount: 670. Image: lsass.exe VadRoot fffffa800446a4b0 Vads 138 Clone 0 Private 1122. Modified 11. Locked 3. DeviceMap fffff8a000008c10 Token fffff8a001ebe060 ElapsedTime 00:10:01.250 UserTime 00:00:00.405 KernelTime 00:00:00.156 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (3160, 50, 345) (12640KB, 200KB, 1380KB) PeakWorkingSetSize 3170 VirtualSize 47 Mb PeakVirtualSize 48 Mb PageFaultCount 3559 MemoryPriority BACKGROUND BasePriority 9 CommitCharge 1314 Setting context for this process... .process /p /r fffffa8004970b30 THREAD fffffa8004971060 Cid 0218.0228 Teb: 000007fffffdc000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8004971420 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004970b30 Image: lsass.exe Attached Process N/A Image: N/A Wait Start TickCount 3587 Ticks: 36703 (0:00:09:32.570) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address lsass!LsapRmServerThread (0x00000000ff2c2bc0) Stack Init fffff88004054db0 Current fffff88004054790 Base fffff88004055000 Limit fffff8800404f000 Call 0 Priority 10 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`040547d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04054910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`040549a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`04054a40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`04054aa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`04054b40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`04054be0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`04054c20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04054c20) 00000000`0050f8d8 00000000`ff2c2c29 ntdll!NtReplyWaitReceivePort+0xa 00000000`0050f8e0 00000000`776cf56d lsass!LsapRmServerThread+0x69 00000000`0050fd20 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0050fd50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004991060 Cid 0218.0234 Teb: 000007fffffd8000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004b22ac0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004970b30 Image: lsass.exe Attached Process N/A Image: N/A Wait Start TickCount 2910 Ticks: 37380 (0:00:09:43.131) Context Switch Count 12 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address lsasrv!ServiceDispatcherThread (0x000007fefd1cefd0) Stack Init fffff88002fd7db0 Current fffff88002fd7900 Base fffff88002fd8000 Limit fffff88002fd2000 Call 0 Priority 10 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`02fd7940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02fd7a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`02fd7b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`02fd7bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`02fd7c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02fd7c20) 00000000`00a0f688 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`00a0f690 000007fe`ff4eaffb KERNELBASE!WaitForSingleObjectEx+0x79 00000000`00a0f730 000007fe`ff4e9d61 sechost!ScSendResponseReceiveControls+0x13b 00000000`00a0f820 000007fe`ff4e9c16 sechost!ScDispatcherLoop+0x121 00000000`00a0f930 000007fe`fd1cf0a2 sechost!StartServiceCtrlDispatcherW+0x14e 00000000`00a0f980 00000000`776cf56d lsasrv!ServiceDispatcherThread+0xd2 00000000`00a0f9b0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00a0f9e0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004998060 Cid 0218.0238 Teb: 000007fffffd6000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa800496c060 SynchronizationTimer fffffa8004f9ee60 SynchronizationEvent fffffa800499dad0 SynchronizationTimer fffffa80049974c0 SynchronizationEvent fffffa80049b02f0 SynchronizationEvent fffffa80049b3510 SynchronizationEvent fffffa80049b1f50 SynchronizationEvent fffffa800486d480 SynchronizationEvent fffffa800496c1e0 SynchronizationEvent fffffa80047c7fe0 SynchronizationEvent fffffa80042120e0 SynchronizationEvent fffffa80048697e0 SynchronizationEvent fffffa800486bf60 SynchronizationEvent fffffa800486b510 SynchronizationEvent fffffa800486f8e0 SynchronizationEvent fffffa8004265550 SynchronizationEvent fffffa80049ad360 SynchronizationEvent fffffa80049a9720 SynchronizationEvent fffffa80049afc80 SynchronizationEvent fffffa80049b0670 SynchronizationEvent fffffa8004a3ed00 SynchronizationEvent fffffa8004b51bf0 SynchronizationEvent fffffa8004b55fe0 SynchronizationEvent fffffa800499cf60 SynchronizationEvent fffffa8004f9a540 SynchronizationEvent fffffa8004f9d740 SynchronizationEvent fffffa8004f9efe0 SynchronizationEvent fffffa8004dae770 SynchronizationEvent fffffa8004ef33f0 SynchronizationEvent fffffa8004f99210 SynchronizationEvent fffffa8004f9d220 SynchronizationEvent fffffa800499d800 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004970b30 Image: lsass.exe Attached Process N/A Image: N/A Wait Start TickCount 40143 Ticks: 147 (0:00:00:02.293) Context Switch Count 178 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff88004046db0 Current fffff88004045fd0 Base fffff88004047000 Limit fffff88004041000 Call 0 Priority 9 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04046010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04046150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`040461e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04046490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04046960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04046bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04046c20) 00000000`00caf848 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`00caf850 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`00cafaf0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00cafb20 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004999990 Cid 0218.023c Teb: 000007fffffd4000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80047edcb0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004970b30 Image: lsass.exe Attached Process N/A Image: N/A Wait Start TickCount 35598 Ticks: 4692 (0:00:01:13.195) Context Switch Count 43 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004062db0 Current fffff880040627d0 Base fffff88004063000 Limit fffff8800405d000 Call 0 Priority 10 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04062810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04062950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`040629e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04062a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04062b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04062c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04062c20) 00000000`00d4f938 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`00d4f940 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`00d4fc40 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00d4fc70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004999490 Cid 0218.0240 Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004209a10 QueueObject IRP List: fffffa8004cf7010: (0006,03a0) Flags: 00060000 Mdl: 00000000 fffffa8004c3e100: (0006,03a0) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004970b30 Image: lsass.exe Attached Process N/A Image: N/A Wait Start TickCount 37051 Ticks: 3239 (0:00:00:50.528) Context Switch Count 1777 UserTime 00:00:00.171 KernelTime 00:00:00.093 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff8800405bdb0 Current fffff8800405b7d0 Base fffff8800405c000 Limit fffff88004056000 Call 0 Priority 9 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0405b810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0405b950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0405b9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0405ba90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0405bb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0405bc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0405bc20) 00000000`00e6f788 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`00e6f790 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`00e6fa90 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00e6fac0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80049c4060 Cid 0218.0284 Teb: 000007fffffde000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004209a10 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004970b30 Image: lsass.exe Attached Process N/A Image: N/A Wait Start TickCount 40143 Ticks: 147 (0:00:00:02.293) Context Switch Count 4545 UserTime 00:00:00.187 KernelTime 00:00:00.140 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880040fbdb0 Current fffff880040fb7d0 Base fffff880040fc000 Limit fffff880040f6000 Call 0 Priority 9 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`040fb810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`040fb950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`040fb9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`040fba90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`040fbb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`040fbc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`040fbc20) 00000000`018af708 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`018af710 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`018afa10 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`018afa40 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004b1e670 Cid 0218.04a0 Teb: 000007fffffa8000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004b24670 NotificationEvent fffffa8004b265b0 SynchronizationEvent fffffa8004b1e490 NotificationEvent fffffa8004b28cd0 SynchronizationEvent fffffa8004b27d80 SynchronizationEvent fffffa80049a9180 SynchronizationEvent fffffa8004b3aec0 NotificationEvent fffffa8004b2e3a0 NotificationEvent IRP List: fffffa8004b57010: (0006,01f0) Flags: 00060000 Mdl: fffffa8004c013d0 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004970b30 Image: lsass.exe Attached Process N/A Image: N/A Wait Start TickCount 17389 Ticks: 22901 (0:00:05:57.257) Context Switch Count 248 UserTime 00:00:00.046 KernelTime 00:00:00.000 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff880045cfdb0 Current fffff880045cefd0 Base fffff880045d0000 Limit fffff880045ca000 Call 0 Priority 11 BasePriority 9 UnusualBoost 2 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`045cf010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`045cf150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`045cf1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`045cf490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`045cf960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`045cfbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`045cfc20) 00000000`01b4f568 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`01b4f570 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`01b4f670 000007fe`fcbc939f kernel32!WaitForMultipleObjects+0xb0 00000000`01b4f700 000007fe`fcbc4eb9 netlogon!NlMainLoop+0x694 00000000`01b4fbe0 000007fe`fd1da493 netlogon!NlNetlogonMain+0x4d7 00000000`01b4fc40 000007fe`ff4ea82d lsasrv!LsapStartService+0x263 00000000`01b4fcd0 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`01b4fd00 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01b4fd30 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800452c060 Cid 0218.0148 Teb: 000007fffffac000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004209a10 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004970b30 Image: lsass.exe Attached Process N/A Image: N/A Wait Start TickCount 40143 Ticks: 147 (0:00:00:02.293) Context Switch Count 579 UserTime 00:00:00.015 KernelTime 00:00:00.031 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005b0fdb0 Current fffff88005b0f7d0 Base fffff88005b10000 Limit fffff88005b0a000 Call 0 Priority 9 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05b0f810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05b0f950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`05b0f9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05b0fa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05b0fb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05b0fc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05b0fc20) 00000000`0194fb18 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0194fb20 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0194fe20 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0194fe50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004972b30 SessionId: 0 Cid: 0220 Peb: 7fffffd5000 ParentCid: 01d8 DirBase: 126175000 ObjectTable: fffff8a001629530 HandleCount: 146. Image: lsm.exe VadRoot fffffa800420af70 Vads 59 Clone 0 Private 347. Modified 0. Locked 0. DeviceMap fffff8a000008c10 Token fffff8a0000adc50 ElapsedTime 00:10:01.188 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1003, 50, 345) (4012KB, 200KB, 1380KB) PeakWorkingSetSize 1009 VirtualSize 21 Mb PeakVirtualSize 21 Mb PageFaultCount 1058 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 595 Setting context for this process... .process /p /r fffffa8004972b30 THREAD fffffa8004972630 Cid 0220.0224 Teb: 000007fffffde000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa80049bc310 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004972b30 Image: lsm.exe Attached Process N/A Image: N/A Wait Start TickCount 2133 Ticks: 38157 (0:00:09:55.253) Context Switch Count 93 UserTime 00:00:00.000 KernelTime 00:00:00.031 Win32 Start Address lsm!mainCRTStartup (0x00000000ffba5ad0) Stack Init fffff8800404ddb0 Current fffff8800404d900 Base fffff8800404e000 Limit fffff88004048000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0404d940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0404da80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0404db10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`0404dbb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`0404dc20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0404dc20) 00000000`001bf608 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`001bf610 000007fe`fecc0afd KERNELBASE!WaitForSingleObjectEx+0x79 00000000`001bf6b0 000007fe`fed402ec RPCRT4!EVENT::Wait+0xd 00000000`001bf6e0 000007fe`fed43475 RPCRT4!RPC_SERVER::WaitForStopServerListening+0x1c 00000000`001bf710 000007fe`fed58b42 RPCRT4!RPC_SERVER::WaitServerListen+0x55 00000000`001bf740 00000000`ffba26e0 RPCRT4!RpcMgmtWaitServerListen+0x22 00000000`001bf770 00000000`ffba5be2 lsm!main+0x29d 00000000`001bf7d0 00000000`776cf56d lsm!CRegistry::GetNextSubKey+0x225 00000000`001bf810 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`001bf840 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80049b93f0 Cid 0220.026c Teb: 000007fffffdc000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa80049b9c80 SynchronizationTimer fffffa80049b9df0 SynchronizationTimer fffffa80048f3950 ProcessObject fffffa800491f630 ProcessObject fffffa8003cf60f0 ProcessObject fffffa800491d910 ProcessObject fffffa80049b9b10 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004972b30 Image: lsm.exe Attached Process N/A Image: N/A Wait Start TickCount 19344 Ticks: 20946 (0:00:05:26.759) Context Switch Count 15 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff880040eddb0 Current fffff880040ecfd0 Base fffff880040ee000 Limit fffff880040e8000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`040ed010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`040ed150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`040ed1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`040ed490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`040ed960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`040edbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`040edc20) 00000000`0060f5a8 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`0060f5b0 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`0060f850 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0060f880 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80049fbb00 Cid 0220.0300 Teb: 000007fffffda000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa80049fbec0 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004972b30 Image: lsm.exe Attached Process N/A Image: N/A Wait Start TickCount 12617 Ticks: 27673 (0:00:07:11.701) Context Switch Count 14 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880041bedb0 Current fffff880041be790 Base fffff880041bf000 Limit fffff880041b9000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`041be7d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`041be910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`041be9a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`041bea40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`041beaa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`041beb40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`041bebe0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`041bec20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`041bec20) 00000000`00a0f338 00000000`ffb96579 ntdll!NtReplyWaitReceivePort+0xa 00000000`00a0f340 00000000`ffba4d15 lsm!CCsrMgr::LpcWorker+0x59 00000000`00a0f4e0 00000000`777ef8eb lsm!CCsrMgr::staticLpcWorker+0x9 00000000`00a0f510 00000000`777e9d9f ntdll!RtlpTpWorkCallback+0x16b 00000000`00a0f5f0 00000000`776cf56d ntdll!TppWorkerThread+0x5ff 00000000`00a0f8f0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00a0f920 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80049fb560 Cid 0220.0304 Teb: 000007fffffd8000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa80049fb920 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004972b30 Image: lsm.exe Attached Process N/A Image: N/A Wait Start TickCount 12625 Ticks: 27665 (0:00:07:11.576) Context Switch Count 12 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880041e1db0 Current fffff880041e1790 Base fffff880041e2000 Limit fffff880041dc000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`041e17d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`041e1910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`041e19a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`041e1a40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`041e1aa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`041e1b40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`041e1be0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`041e1c20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`041e1c20) 00000000`0024f458 00000000`ffb96579 ntdll!NtReplyWaitReceivePort+0xa 00000000`0024f460 00000000`ffba4d15 lsm!CCsrMgr::LpcWorker+0x59 00000000`0024f600 00000000`777ef8eb lsm!CCsrMgr::staticLpcWorker+0x9 00000000`0024f630 00000000`777e9d9f ntdll!RtlpTpWorkCallback+0x16b 00000000`0024f710 00000000`776cf56d ntdll!TppWorkerThread+0x5ff 00000000`0024fa10 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0024fa40 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80049ff650 Cid 0220.0308 Teb: 000007fffffd6000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa80049ffa10 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004972b30 Image: lsm.exe Attached Process N/A Image: N/A Wait Start TickCount 12617 Ticks: 27673 (0:00:07:11.701) Context Switch Count 7 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880041fbdb0 Current fffff880041fb790 Base fffff880041fc000 Limit fffff880041f6000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`041fb7d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`041fb910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`041fb9a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`041fba40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`041fbaa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`041fbb40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`041fbbe0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`041fbc20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`041fbc20) 00000000`00a8f708 00000000`ffb96579 ntdll!NtReplyWaitReceivePort+0xa 00000000`00a8f710 00000000`ffba4d15 lsm!CCsrMgr::LpcWorker+0x59 00000000`00a8f8b0 00000000`777ef8eb lsm!CCsrMgr::staticLpcWorker+0x9 00000000`00a8f8e0 00000000`777e9d9f ntdll!RtlpTpWorkCallback+0x16b 00000000`00a8f9c0 00000000`776cf56d ntdll!TppWorkerThread+0x5ff 00000000`00a8fcc0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00a8fcf0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a00060 Cid 0220.030c Teb: 000007fffffd3000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8004a00420 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004972b30 Image: lsm.exe Attached Process N/A Image: N/A Wait Start TickCount 12625 Ticks: 27665 (0:00:07:11.576) Context Switch Count 8 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880024b6db0 Current fffff880024b6790 Base fffff880024b7000 Limit fffff880024b1000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`024b67d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`024b6910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`024b69a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`024b6a40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`024b6aa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`024b6b40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`024b6be0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`024b6c20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`024b6c20) 00000000`00bbf298 00000000`ffb96579 ntdll!NtReplyWaitReceivePort+0xa 00000000`00bbf2a0 00000000`ffba4d15 lsm!CCsrMgr::LpcWorker+0x59 00000000`00bbf440 00000000`777ef8eb lsm!CCsrMgr::staticLpcWorker+0x9 00000000`00bbf470 00000000`777e9d9f ntdll!RtlpTpWorkCallback+0x16b 00000000`00bbf550 00000000`776cf56d ntdll!TppWorkerThread+0x5ff 00000000`00bbf850 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00bbf880 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a00b60 Cid 0220.0310 Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa80049ffe60 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004972b30 Image: lsm.exe Attached Process N/A Image: N/A Wait Start TickCount 4959 Ticks: 35331 (0:00:09:11.167) Context Switch Count 11 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88002544db0 Current fffff88002544900 Base fffff88002545000 Limit fffff8800253f000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`02544940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02544a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`02544b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`02544bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`02544c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02544c20) 00000000`00c3f4d8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`00c3f4e0 00000000`ffb97238 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`00c3f580 00000000`777ef8eb lsm!CSCMNotify::staticSCMNotificationThread+0xf1 00000000`00c3f5d0 00000000`777e9d9f ntdll!RtlpTpWorkCallback+0x16b 00000000`00c3f6b0 00000000`776cf56d ntdll!TppWorkerThread+0x5ff 00000000`00c3f9b0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00c3f9e0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a01060 Cid 0220.0314 Teb: 000007fffffac000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004a09110 SynchronizationEvent fffffa8004a0afe0 SynchronizationEvent fffffa8004a0af60 SynchronizationEvent fffffa8004a0aee0 SynchronizationEvent fffffa8004a0ae60 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004972b30 Image: lsm.exe Attached Process N/A Image: N/A Wait Start TickCount 2133 Ticks: 38157 (0:00:09:55.253) Context Switch Count 17 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880025f6db0 Current fffff880025f5fd0 Base fffff880025f7000 Limit fffff880025f1000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`025f6010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`025f6150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`025f61e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`025f6490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`025f6960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`025f6bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`025f6c20) 00000000`00cef298 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`00cef2a0 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`00cef3a0 00000000`ffba073e kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`00cef430 00000000`777ef8eb lsm!CPolicyMonitor::PolicyMonitorWorker+0x264 00000000`00cef490 00000000`777e9d9f ntdll!RtlpTpWorkCallback+0x16b 00000000`00cef570 00000000`776cf56d ntdll!TppWorkerThread+0x5ff 00000000`00cef870 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00cef8a0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004e9db60 Cid 0220.03f4 Teb: 000007fffffa6000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049bdb60 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004972b30 Image: lsm.exe Attached Process N/A Image: N/A Wait Start TickCount 37492 Ticks: 2798 (0:00:00:43.649) Context Switch Count 30 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005232db0 Current fffff880052327d0 Base fffff88005233000 Limit fffff8800522d000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05232810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05232950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`052329e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05232a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05232b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05232c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05232c20) 00000000`0139f768 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0139f770 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0139fa70 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0139faa0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004f64b60 Cid 0220.0a4c Teb: 000007fffffa8000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049bdb60 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004972b30 Image: lsm.exe Attached Process N/A Image: N/A Wait Start TickCount 37051 Ticks: 3239 (0:00:00:50.528) Context Switch Count 7 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004109db0 Current fffff880041097d0 Base fffff8800410a000 Limit fffff88004104000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04109810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04109950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`041099e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04109a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04109b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04109c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04109c20) 00000000`00def488 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`00def490 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`00def790 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00def7c0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa80049c6b30 SessionId: 0 Cid: 0288 Peb: 7fffffd8000 ParentCid: 0210 DirBase: 1253c5000 ObjectTable: fffff8a001f12220 HandleCount: 351. Image: svchost.exe VadRoot fffffa80049c6940 Vads 114 Clone 0 Private 768. Modified 23. Locked 0. DeviceMap fffff8a000008c10 Token fffff8a001f3b060 ElapsedTime 00:09:56.960 UserTime 00:00:00.234 KernelTime 00:00:00.468 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (2190, 50, 345) (8760KB, 200KB, 1380KB) PeakWorkingSetSize 2213 VirtualSize 46 Mb PeakVirtualSize 47 Mb PageFaultCount 3174 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 980 Setting context for this process... .process /p /r fffffa80049c6b30 THREAD fffffa800496eb60 Cid 0288.028c Teb: 000007fffffde000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa80049c7d50 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049c6b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 4958 Ticks: 35332 (0:00:09:11.182) Context Switch Count 74 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address svchost!wmainCRTStartup (0x00000000ffa9246c) Stack Init fffff88004102db0 Current fffff88004102900 Base fffff88004103000 Limit fffff880040fd000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04102940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04102a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04102b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04102bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04102c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04102c20) 00000000`0014f768 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0014f770 000007fe`ff4eaffb KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0014f810 000007fe`ff4e9d61 sechost!ScSendResponseReceiveControls+0x13b 00000000`0014f900 000007fe`ff4e9c16 sechost!ScDispatcherLoop+0x121 00000000`0014fa10 00000000`ffa91d3a sechost!StartServiceCtrlDispatcherW+0x14e 00000000`0014fa60 00000000`ffa9257a svchost!wmain+0x110 00000000`0014fa90 00000000`776cf56d svchost!ScCreateWellKnownSids+0x2fd 00000000`0014fad0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0014fb00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80049cf9f0 Cid 0288.029c Teb: 000007fffffd4000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa80049cfef0 SynchronizationTimer fffffa80049cf060 SynchronizationTimer fffffa80049ce5a0 SynchronizationEvent fffffa80049c1970 SynchronizationEvent fffffa80049d0e40 SynchronizationEvent fffffa80049b7120 SynchronizationEvent fffffa80049d4730 SynchronizationEvent fffffa80049d47b0 SynchronizationEvent fffffa80049e2a70 SynchronizationEvent fffffa80049e2b70 SynchronizationEvent fffffa80049c8b90 SynchronizationEvent fffffa80049dfb90 SynchronizationEvent fffffa80049e2210 SynchronizationEvent fffffa80049cf880 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049c6b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 26151 Ticks: 14139 (0:00:03:40.569) Context Switch Count 236 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff88004117db0 Current fffff88004116fd0 Base fffff88004118000 Limit fffff88004112000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04117010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04117150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`041171e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04117490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04117960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04117bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04117c20) 00000000`0070f628 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`0070f630 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`0070f8d0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0070f900 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80049d1060 Cid 0288.02a8 Teb: 000007fffffaa000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8003c1eb28 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049c6b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 12625 Ticks: 27665 (0:00:07:11.576) Context Switch Count 44 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address umpnpmgr!DeviceEventThreadProc (0x000007fefc8771e0) Stack Init fffff880040d1db0 Current fffff880040d1930 Base fffff880040d2000 Limit fffff880040cc000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`040d1970 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`040d1ab0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`040d1b40 fffff800`01cf83d2 nt!KeWaitForSingleObject+0x19f fffff880`040d1be0 fffff800`01a8b993 nt!NtGetPlugPlayEvent+0x172 fffff880`040d1c20 00000000`77820c0a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`040d1c20) 00000000`011ffa18 000007fe`fc8772ab ntdll!NtGetPlugPlayEvent+0xa 00000000`011ffa20 00000000`776cf56d umpnpmgr!DeviceEventThreadProc+0x110 00000000`011ffed0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`011fff00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80049d2b60 Cid 0288.02b4 Teb: 000007fffffd6000 Win32Thread: fffff900c01de4a0 WAIT: (UserRequest) UserMode Alertable fffffa80049d3060 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049c6b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3530 Ticks: 36760 (0:00:09:33.459) Context Switch Count 517 LargeStack UserTime 00:00:00.046 KernelTime 00:00:00.031 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff88004167db0 Current fffff88004167900 Base fffff88004168000 Limit fffff8800415f000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04167940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04167a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04167b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04167bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04167c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04167c20) 00000000`0166faa8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0166fab0 000007fe`fc7e5990 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0166fb50 00000000`ffa91344 umpo!UmpoMain+0x58a 00000000`0166fbf0 000007fe`ff4ea82d svchost!ServiceStarter+0x1e8 00000000`0166fc80 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`0166fcb0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0166fce0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80049d3750 Cid 0288.02b8 Teb: 000007fffffa4000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Non-Alertable fffffa80049d3c50 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049c6b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 6453 Ticks: 33837 (0:00:08:47.860) Context Switch Count 22 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address umpo!UmpoNotifyWorker (0x000007fefc7e332c) Stack Init fffff8800414ddb0 Current fffff8800414d7b0 Base fffff8800414e000 Limit fffff88004148000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0414d7f0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0414d930 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0414d9c0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0414da70 fffff800`01d479a5 nt!IoRemoveIoCompletion+0x47 fffff880`0414db00 fffff800`01a8b993 nt!NtRemoveIoCompletion+0x145 fffff880`0414dbb0 00000000`7781ff4a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0414dc20) 00000000`016ef6b8 000007fe`fda9162d ntdll!ZwRemoveIoCompletion+0xa 00000000`016ef6c0 00000000`776bbd81 KERNELBASE!GetQueuedCompletionStatus+0x39 00000000`016ef720 000007fe`fc7e3365 kernel32!GetQueuedCompletionStatusStub+0x11 00000000`016ef760 00000000`776cf56d umpo!UmpoNotifyWorker+0x39 00000000`016ef7c0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`016ef7f0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80049d4060 Cid 0288.02bc Teb: 000007fffffa2000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa80049d4420 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049c6b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 6460 Ticks: 33830 (0:00:08:47.751) Context Switch Count 181 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address umpo!UmpoAlpcListenForPoMessages (0x000007fefc7e10b0) Stack Init fffff88004154db0 Current fffff88004154750 Base fffff88004155000 Limit fffff8800414f000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04154790 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`041548d0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04154960 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`04154a00 fffff800`01d8cac7 nt!AlpcpReceiveMessagePort+0x189 fffff880`04154a60 fffff800`01d8e006 nt!AlpcpReceiveMessage+0x2d4 fffff880`04154b00 fffff800`01a8b993 nt!NtAlpcSendWaitReceivePort+0x1e6 fffff880`04154bb0 00000000`7782070a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04154c20) 00000000`0079f6d8 000007fe`fc7e1179 ntdll!ZwAlpcSendWaitReceivePort+0xa 00000000`0079f6e0 00000000`776cf56d umpo!UmpoAlpcListenForPoMessages+0xc9 00000000`0079f800 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0079f830 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80049db060 Cid 0288.02cc Teb: 000007fffff9e000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049dbc30 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049c6b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 2107 Ticks: 38183 (0:00:09:55.658) Context Switch Count 9 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff8800419bdb0 Current fffff8800419b7d0 Base fffff8800419c000 Limit fffff88004196000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0419b810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0419b950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0419b9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0419ba90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0419bb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0419bc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0419bc20) 00000000`0189fa98 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0189faa0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0189fda0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0189fdd0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004573b60 Cid 0288.0600 Teb: 000007fffffdc000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049e24f0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049c6b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 23721 Ticks: 16569 (0:00:04:18.478) Context Switch Count 5 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880041a2db0 Current fffff880041a27d0 Base fffff880041a3000 Limit fffff8800419d000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`041a2810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`041a2950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`041a29e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`041a2a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`041a2b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`041a2c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`041a2c20) 00000000`012af5a8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`012af5b0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`012af8b0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`012af8e0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004571060 Cid 0288.0330 Teb: 000007fffffda000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049c5ee0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049c6b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 36226 Ticks: 4064 (0:00:01:03.398) Context Switch Count 572 UserTime 00:00:00.015 KernelTime 00:00:00.093 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005388db0 Current fffff880053887d0 Base fffff88005389000 Limit fffff88005383000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05388810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05388950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`053889e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05388a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05388b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05388c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05388c20) 00000000`0179f508 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0179f510 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0179f810 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0179f840 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004581950 Cid 0288.0814 Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049c5ee0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049c6b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 39699 Ticks: 591 (0:00:00:09.219) Context Switch Count 871 UserTime 00:00:00.015 KernelTime 00:00:00.078 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff8800543cdb0 Current fffff8800543c7d0 Base fffff8800543d000 Limit fffff88005437000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0543c810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0543c950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0543c9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0543ca90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0543cb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0543cc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0543cc20) 00000000`005df958 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`005df960 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`005dfc60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`005dfc90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80050a0960 Cid 0288.08c4 Teb: 000007fffffac000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049c5ee0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80049c6b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 38875 Ticks: 1415 (0:00:00:22.074) Context Switch Count 538 UserTime 00:00:00.000 KernelTime 00:00:00.031 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880043fadb0 Current fffff880043fa7d0 Base fffff880043fb000 Limit fffff880043f5000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`043fa810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`043fa950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`043fa9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`043faa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`043fab20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`043fac20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`043fac20) 00000000`01a7f708 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`01a7f710 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`01a7fa10 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01a7fa40 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa80049dc060 SessionId: 0 Cid: 02d8 Peb: 7fffffdc000 ParentCid: 0210 DirBase: 124ec6000 ObjectTable: fffff8a001fc2ed0 HandleCount: 271. Image: svchost.exe VadRoot fffffa80049dd090 Vads 82 Clone 0 Private 769. Modified 4. Locked 2. DeviceMap fffff8a001f05400 Token fffff8a001f83ab0 ElapsedTime 00:09:55.993 UserTime 00:00:00.327 KernelTime 00:00:00.171 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1818, 50, 345) (7272KB, 200KB, 1380KB) PeakWorkingSetSize 1824 VirtualSize 35 Mb PeakVirtualSize 39 Mb PageFaultCount 2160 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 891 Setting context for this process... .process /p /r fffffa80049dc060 THREAD fffffa80049e6710 Cid 02d8.02dc Teb: 000007fffffde000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa80049e77c0 SynchronizationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa80049dc060 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 2120 Ticks: 38170 (0:00:09:55.455) Context Switch Count 14 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address svchost!wmainCRTStartup (0x00000000ffa9246c) Stack Init fffff880041a9db0 Current fffff880041a9900 Base fffff880041aa000 Limit fffff880041a4000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`041a9940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`041a9a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`041a9b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`041a9bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`041a9c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`041a9c20) 00000000`0021fbb8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0021fbc0 000007fe`ff4eaffb KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0021fc60 000007fe`ff4e9d61 sechost!ScSendResponseReceiveControls+0x13b 00000000`0021fd50 000007fe`ff4e9c16 sechost!ScDispatcherLoop+0x121 00000000`0021fe60 00000000`ffa91d3a sechost!StartServiceCtrlDispatcherW+0x14e 00000000`0021feb0 00000000`ffa9257a svchost!wmain+0x110 00000000`0021fee0 00000000`776cf56d svchost!ScCreateWellKnownSids+0x2fd 00000000`0021ff20 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0021ff50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80049ed060 Cid 02d8.02f0 Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa80049ec530 SynchronizationTimer fffffa80049e8060 SynchronizationTimer fffffa80049f0630 SynchronizationEvent fffffa80049f1700 SynchronizationEvent fffffa80049d55e0 SynchronizationEvent fffffa80049f4470 SynchronizationEvent fffffa8004aea9a0 SynchronizationEvent fffffa80049f62e0 SynchronizationEvent fffffa80049ec3c0 SynchronizationTimer Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa80049dc060 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 36736 Ticks: 3554 (0:00:00:55.442) Context Switch Count 31 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff880041ccdb0 Current fffff880041cbfd0 Base fffff880041cd000 Limit fffff880041c7000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`041cc010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`041cc150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`041cc1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`041cc490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`041cc960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`041ccbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`041ccc20) 00000000`00bef4f8 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`00bef500 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`00bef7a0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00bef7d0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80049ef850 Cid 02d8.02f8 Teb: 000007fffffd6000 Win32Thread: fffff900c01d9900 WAIT: (DelayExecution) UserMode Non-Alertable fffffa80049efc10 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa80049dc060 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 39398 Ticks: 892 (0:00:00:13.915) Context Switch Count 160 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff880041f4db0 Current fffff880041f4970 Base fffff880041f5000 Limit fffff880041ef000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`041f49b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`041f4af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`041f4b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`041f4bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`041f4c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`041f4c20) 00000000`0067f5a8 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`0067f5b0 000007fe`fc773e92 KERNELBASE!SleepEx+0xab 00000000`0067f650 000007fe`fc76e9bb rpcss!ObjectExporterWorkerThread+0x50b 00000000`0067f6f0 000007fe`fc76fa88 rpcss!ScmServiceMain+0xdd 00000000`0067f720 00000000`ffa91344 rpcss!ServiceMain+0x251 00000000`0067f9e0 000007fe`ff4ea82d svchost!ServiceStarter+0x1e8 00000000`0067fa70 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`0067faa0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0067fad0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80049f1060 Cid 02d8.02fc Teb: 000007fffffaa000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049f0580 QueueObject IRP List: fffffa8004b4b180: (0006,01f0) Flags: 00060030 Mdl: 00000000 fffffa80047c7b20: (0006,01f0) Flags: 00060030 Mdl: 00000000 Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa80049dc060 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3438 Ticks: 36852 (0:00:09:34.894) Context Switch Count 16 UserTime 00:00:00.015 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880041dadb0 Current fffff880041da7d0 Base fffff880041db000 Limit fffff880041d5000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`041da810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`041da950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`041da9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`041daa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`041dab20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`041dac20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`041dac20) 00000000`0015f528 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0015f530 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0015f830 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0015f860 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004925060 Cid 02d8.0498 Teb: 000007fffffda000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049e7710 QueueObject Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa80049dc060 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 39647 Ticks: 643 (0:00:00:10.030) Context Switch Count 867 UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880059f0db0 Current fffff880059f07d0 Base fffff880059f1000 Limit fffff880059eb000 Call 0 Priority 9 BasePriority 8 UnusualBoost 1 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`059f0810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`059f0950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`059f09e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`059f0a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`059f0b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`059f0c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`059f0c20) 00000000`0197f538 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0197f540 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0197f840 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0197f870 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004c1e5e0 Cid 02d8.06e4 Teb: 000007fffffd4000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa8004c1e9a0 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa80049dc060 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 39647 Ticks: 643 (0:00:00:10.030) Context Switch Count 58 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address rpcss!ObjectExporterTaskThread (0x000007fefc778e80) Stack Init fffff880052d3db0 Current fffff880052d3970 Base fffff880052d4000 Limit fffff880052ce000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`052d39b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`052d3af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`052d3b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`052d3bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`052d3c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`052d3c20) 00000000`005ffa18 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`005ffa20 000007fe`fc778f63 KERNELBASE!SleepEx+0xab 00000000`005ffac0 00000000`776cf56d rpcss!ObjectExporterTaskThread+0x115 00000000`005ffb00 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`005ffb30 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004f36060 Cid 02d8.0a44 Teb: 000007fffffac000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049e7710 QueueObject Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa80049dc060 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 39834 Ticks: 456 (0:00:00:07.113) Context Switch Count 1380 UserTime 00:00:00.046 KernelTime 00:00:00.031 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880041d3db0 Current fffff880041d37d0 Base fffff880041d4000 Limit fffff880041ce000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`041d3810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`041d3950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`041d39e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`041d3a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`041d3b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`041d3c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`041d3c20) 00000000`00cbf7c8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`00cbf7d0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`00cbfad0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00cbfb00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004523660 Cid 02d8.05b0 Teb: 000007fffffa8000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049e7710 QueueObject Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa80049dc060 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 36736 Ticks: 3554 (0:00:00:55.442) Context Switch Count 557 UserTime 00:00:00.015 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005772db0 Current fffff880057727d0 Base fffff88005773000 Limit fffff8800576d000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05772810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05772950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`057729e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05772a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05772b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05772c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05772c20) 00000000`01a0f708 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`01a0f710 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`01a0fa10 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01a0fa40 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004a1b740 SessionId: 0 Cid: 0334 Peb: 7fffffd6000 ParentCid: 0210 DirBase: 123faf000 ObjectTable: fffff8a00201d550 HandleCount: 410. Image: svchost.exe VadRoot fffffa8004a1a180 Vads 151 Clone 0 Private 2086. Modified 18. Locked 5. DeviceMap fffff8a002020e00 Token fffff8a00205e9f0 ElapsedTime 00:09:55.494 UserTime 00:00:00.109 KernelTime 00:00:00.124 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (3900, 50, 345) (15600KB, 200KB, 1380KB) PeakWorkingSetSize 3914 VirtualSize 64 Mb PeakVirtualSize 78 Mb PageFaultCount 4860 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 3852 Setting context for this process... .process /p /r fffffa8004a1b740 THREAD fffffa8004a1d8a0 Cid 0334.0338 Teb: 000007fffffde000 Win32Thread: fffff900c01dc010 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a1f2b0 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a1b740 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 4957 Ticks: 35333 (0:00:09:11.198) Context Switch Count 74 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.031 Win32 Start Address svchost!wmainCRTStartup (0x00000000ffa9246c) Stack Init fffff88004212db0 Current fffff88004212900 Base fffff88004213000 Limit fffff8800420c000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04212940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04212a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04212b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04212bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04212c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04212c20) 00000000`000ef7f8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`000ef800 000007fe`ff4eaffb KERNELBASE!WaitForSingleObjectEx+0x79 00000000`000ef8a0 000007fe`ff4e9d61 sechost!ScSendResponseReceiveControls+0x13b 00000000`000ef990 000007fe`ff4e9c16 sechost!ScDispatcherLoop+0x121 00000000`000efaa0 00000000`ffa91d3a sechost!StartServiceCtrlDispatcherW+0x14e 00000000`000efaf0 00000000`ffa9257a svchost!wmain+0x110 00000000`000efb20 00000000`776cf56d svchost!ScCreateWellKnownSids+0x2fd 00000000`000efb60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`000efb90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a1e5c0 Cid 0334.033c Teb: 000007fffffdc000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004a1eac0 SynchronizationTimer fffffa8004a1ec30 SynchronizationTimer fffffa8004a35b10 SynchronizationEvent fffffa8004a35600 SynchronizationEvent fffffa8004a24b60 SynchronizationEvent fffffa8004a3e360 NotificationEvent fffffa8004a3d800 NotificationEvent fffffa800493d1b0 NotificationEvent fffffa8004aca060 ProcessObject fffffa8004acffe0 SynchronizationEvent fffffa8004acfc50 SynchronizationEvent fffffa8004ad0dc0 SynchronizationEvent fffffa8004ae28d0 NotificationEvent fffffa8004ad1b00 NotificationEvent fffffa8004aed3c0 NotificationEvent fffffa8004b01910 NotificationEvent fffffa8004b1c810 NotificationEvent fffffa8004b2d6a0 NotificationEvent fffffa8004b2b060 NotificationEvent fffffa8004b015b0 NotificationEvent fffffa8004c135d0 NotificationEvent fffffa8004c77240 NotificationEvent fffffa8004cbd610 NotificationEvent fffffa8004cbd0c0 NotificationEvent fffffa8004b7c890 NotificationEvent fffffa8004a8c7f0 SynchronizationEvent fffffa8004a8c390 SynchronizationEvent fffffa8004e75cc0 NotificationEvent fffffa8004c3ab40 NotificationEvent fffffa8003c43fe0 NotificationEvent fffffa8004f4da60 NotificationEvent fffffa80043ebd10 NotificationEvent fffffa8004a1e3b0 SynchronizationTimer Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a1b740 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 39107 Ticks: 1183 (0:00:00:18.454) Context Switch Count 214 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff88002fa3db0 Current fffff88002fa2fd0 Base fffff88002fa4000 Limit fffff88002f9e000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02fa3010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02fa3150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`02fa31e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`02fa3490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`02fa3960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`02fa3bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02fa3c20) 00000000`00defb68 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`00defb70 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`00defe10 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00defe40 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a21b60 Cid 0334.034c Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a0a360 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a1b740 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3108 Ticks: 37182 (0:00:09:40.042) Context Switch Count 250 UserTime 00:00:00.031 KernelTime 00:00:00.171 Win32 Start Address wevtsvc!RegistryMonitor::WaitThreadRoutine (0x000007fefc4dc4d4) Stack Init fffff88004219db0 Current fffff88004219900 Base fffff8800421a000 Limit fffff88004214000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04219940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04219a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04219b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04219bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04219c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04219c20) 00000000`00ebfde8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`00ebfdf0 000007fe`fc4dc549 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`00ebfe90 00000000`776cf56d wevtsvc!RegistryMonitor::WaitThreadRoutine+0x108 00000000`00ebff40 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00ebff70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a24060 Cid 0334.0350 Teb: 000007fffffac000 Win32Thread: fffff900c01dd6b0 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a231e0 SynchronizationEvent fffffa8004a25b40 SynchronizationEvent fffffa8004a23360 SynchronizationEvent fffffa8004a23550 SynchronizationTimer fffffa8004a232e0 SynchronizationEvent fffffa8004a233e0 SynchronizationTimer fffffa8004a25ac0 SynchronizationEvent fffffa8004a23260 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a1b740 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 36822 Ticks: 3468 (0:00:00:54.101) Context Switch Count 38 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address wevtsvc!OsEventsPowerEvent (0x000007fefc4f4d90) Stack Init fffff88004246db0 Current fffff88004245fd0 Base fffff88004247000 Limit fffff8800423f000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04246010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04246150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`042461e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04246490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04246960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04246bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04246c20) 00000000`0152f668 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0152f670 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0152f770 000007fe`fc4f4f70 kernel32!WaitForMultipleObjects+0xb0 00000000`0152f800 00000000`776cf56d wevtsvc!OsEventsPowerEvent+0x34b 00000000`0152f8b0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0152f8e0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a79b60 Cid 0334.0084 Teb: 000007fffffd4000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a82ea0 SynchronizationEvent fffffa8004a82e20 SynchronizationEvent IRP List: fffffa8004a3f370: (0006,0118) Flags: 00060000 Mdl: fffffa800420a570 Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a1b740 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 30512 Ticks: 9778 (0:00:02:32.537) Context Switch Count 40 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff88004360db0 Current fffff8800435ffd0 Base fffff88004361000 Limit fffff8800435b000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04360010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04360150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`043601e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04360490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04360960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04360bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04360c20) 00000000`01ecf6f8 000007fe`fb7514a8 ntdll!NtWaitForMultipleObjects+0xa 00000000`01ecf700 00000000`ffa91344 lmhsvc!ServiceMain+0x28c 00000000`01ecf920 000007fe`ff4ea82d svchost!ServiceStarter+0x1e8 00000000`01ecf9b0 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`01ecf9e0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01ecfa10 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a7c060 Cid 0334.010c Teb: 000007fffffa8000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a85110 NotificationEvent fffffa8004a85190 SynchronizationEvent fffffa8004a88230 NotificationEvent fffffa8004a891a0 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a1b740 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 2694 Ticks: 37596 (0:00:09:46.501) Context Switch Count 70 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff880043a2db0 Current fffff880043a1fd0 Base fffff880043a3000 Limit fffff8800439d000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`043a2010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`043a2150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`043a21e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`043a2490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`043a2960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`043a2bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`043a2c20) 00000000`01f5f948 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`01f5f950 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`01f5fa50 000007fe`fb662891 kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`01f5fae0 000007fe`fb672004 dhcpcore!ProcessDhcpRequestForever+0x2c8 00000000`01f5fbb0 00000000`ffa91344 dhcpcore!ServiceMain+0x398 00000000`01f5fc50 000007fe`ff4ea82d svchost!ServiceStarter+0x1e8 00000000`01f5fce0 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`01f5fd10 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01f5fd40 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a82540 Cid 0334.0160 Teb: 000007fffffa0000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a82da0 SynchronizationEvent fffffa8004a82d20 SynchronizationEvent IRP List: fffffa8004a10ee0: (0006,0118) Flags: 00060000 Mdl: fffffa80047b2380 Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a1b740 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 2460 Ticks: 37830 (0:00:09:50.151) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address lmhsvc!CheckIPAddrWorkerRtn (0x000007fefb752070) Stack Init fffff880043dedb0 Current fffff880043ddfd0 Base fffff880043df000 Limit fffff880043d9000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`043de010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`043de150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`043de1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`043de490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`043de960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`043debb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`043dec20) 00000000`01fefb18 000007fe`fb752114 ntdll!NtWaitForMultipleObjects+0xa 00000000`01fefb20 00000000`776cf56d lmhsvc!CheckIPAddrWorkerRtn+0xbf 00000000`01fefb90 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01fefbc0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a88340 Cid 0334.0174 Teb: 000007fffff9e000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004a85110 NotificationEvent fffffa8004a86b60 SynchronizationEvent fffffa8004a89d20 NotificationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a1b740 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 38005 Ticks: 2285 (0:00:00:35.646) Context Switch Count 27 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address dhcpcore6!Dhcpv6Main (0x000007fefb5c5440) Stack Init fffff880043e5db0 Current fffff880043e4fd0 Base fffff880043e6000 Limit fffff880043e0000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`043e5010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`043e5150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`043e51e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`043e5490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`043e5960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`043e5bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`043e5c20) 00000000`00fff908 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`00fff910 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`00fffa10 000007fe`fb5c2fce kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`00fffaa0 000007fe`fb5c55fc dhcpcore6!ProcessDhcpv6RequestForever+0x17b 00000000`00fffde0 00000000`776cf56d dhcpcore6!Dhcpv6Main+0x24a 00000000`00fffe50 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00fffe80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004ac9060 Cid 0334.0408 Teb: 000007fffff98000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Non-Alertable fffffa800492efb0 QueueObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a1b740 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 4957 Ticks: 35333 (0:00:09:11.198) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address audiosrv!EventWorkerThread (0x000007fefb15f440) Stack Init fffff880044b9db0 Current fffff880044b97b0 Base fffff880044ba000 Limit fffff880044b4000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`044b97f0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`044b9930 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`044b99c0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`044b9a70 fffff800`01d479a5 nt!IoRemoveIoCompletion+0x47 fffff880`044b9b00 fffff800`01a8b993 nt!NtRemoveIoCompletion+0x145 fffff880`044b9bb0 00000000`7781ff4a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`044b9c20) 00000000`01b4fcc8 000007fe`fda9162d ntdll!ZwRemoveIoCompletion+0xa 00000000`01b4fcd0 00000000`776bbd81 KERNELBASE!GetQueuedCompletionStatus+0x39 00000000`01b4fd30 000007fe`fb15f48e kernel32!GetQueuedCompletionStatusStub+0x11 00000000`01b4fd70 00000000`776cf56d audiosrv!EventWorkerThread+0xb1 00000000`01b4fdb0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01b4fde0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004acd060 Cid 0334.0418 Teb: 000007fffff94000 Win32Thread: fffff900c1c87c30 WAIT: (UserRequest) UserMode Alertable fffffa800492d320 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a1b740 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 2776 Ticks: 37514 (0:00:09:45.222) Context Switch Count 20 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address MMDevAPI!CDeviceEnumerator::PnpNotificationThreadWrapper (0x000007fefb8b6204) Stack Init fffff88004500db0 Current fffff880044fffd0 Base fffff88004501000 Limit fffff880044f9000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04500010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04500150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`045001e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04500490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04500960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04500bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04500c20) 00000000`023af488 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`023af490 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`023af590 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`023af620 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`023af6c0 000007fe`fb8b35be USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`023af700 00000000`776cf56d MMDevAPI!CDeviceEnumerator::PnpNotificationThread+0x3d8 00000000`023af850 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`023af880 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004ad0740 Cid 0334.0428 Teb: 000007fffff92000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004acfe80 QueueObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a1b740 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 2677 Ticks: 37613 (0:00:09:46.766) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004521db0 Current fffff880045217d0 Base fffff88004522000 Limit fffff8800451c000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04521810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04521950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`045219e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04521a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04521b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04521c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04521c20) 00000000`016cf728 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`016cf730 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`016cfa30 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`016cfa60 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004be3620 Cid 0334.0548 Teb: 000007fffffa4000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004bd86e0 SynchronizationEvent fffffa8004bd8760 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a1b740 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 39999 Ticks: 291 (0:00:00:04.539) Context Switch Count 103 UserTime 00:00:00.031 KernelTime 00:00:00.031 Win32 Start Address wevtsvc!ProcessEventsThread (0x000007fefc4dc08c) Stack Init fffff8800428adb0 Current fffff88004289fd0 Base fffff8800428b000 Limit fffff88004285000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0428a010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0428a150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0428a1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`0428a490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`0428a960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`0428abb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0428ac20) 00000000`0284f2a8 000007fe`fedf0407 ntdll!NtWaitForMultipleObjects+0xa 00000000`0284f2b0 000007fe`fedf0cf4 ADVAPI32!EtwpProcessRealTimeTraces+0x85 00000000`0284f310 000007fe`fc4dc0e1 ADVAPI32!ProcessTrace+0x23f 00000000`0284f780 00000000`776cf56d wevtsvc!ProcessEventsThread+0x55 00000000`0284f7b0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0284f7e0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a328c0 Cid 0334.0550 Teb: 000007fffffa2000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a37530 SynchronizationEvent fffffa8004aef930 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a1b740 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 5256 Ticks: 35034 (0:00:09:06.533) Context Switch Count 11 UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address wevtsvc!ProcessEventsThread (0x000007fefc4dc08c) Stack Init fffff88004291db0 Current fffff88004290fd0 Base fffff88004292000 Limit fffff8800428c000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04291010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04291150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`042911e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04291490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04291960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04291bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04291c20) 00000000`0224f5b8 000007fe`fedf0407 ntdll!NtWaitForMultipleObjects+0xa 00000000`0224f5c0 000007fe`fedf0cf4 ADVAPI32!EtwpProcessRealTimeTraces+0x85 00000000`0224f620 000007fe`fc4dc0e1 ADVAPI32!ProcessTrace+0x23f 00000000`0224fa90 00000000`776cf56d wevtsvc!ProcessEventsThread+0x55 00000000`0224fac0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0224faf0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004b0a4f0 Cid 0334.0554 Teb: 000007fffffa6000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004bde1f0 SynchronizationEvent fffffa8004b96830 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a1b740 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 39999 Ticks: 291 (0:00:00:04.539) Context Switch Count 197 UserTime 00:00:00.031 KernelTime 00:00:00.000 Win32 Start Address wevtsvc!ProcessEventsThread (0x000007fefc4dc08c) Stack Init fffff88004283db0 Current fffff88004282fd0 Base fffff88004284000 Limit fffff8800427e000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04283010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04283150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`042831e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04283490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04283960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04283bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04283c20) 00000000`019af8c8 000007fe`fedf0407 ntdll!NtWaitForMultipleObjects+0xa 00000000`019af8d0 000007fe`fedf0cf4 ADVAPI32!EtwpProcessRealTimeTraces+0x85 00000000`019af930 000007fe`fc4dc0e1 ADVAPI32!ProcessTrace+0x23f 00000000`019afda0 00000000`776cf56d wevtsvc!ProcessEventsThread+0x55 00000000`019afdd0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`019afe00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80050e82b0 Cid 0334.0a70 Teb: 000007fffffd8000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004a1eeb0 QueueObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a1b740 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 38697 Ticks: 1593 (0:00:00:24.850) Context Switch Count 1609 UserTime 00:00:00.062 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004f6bdb0 Current fffff88004f6b7d0 Base fffff88004f6c000 Limit fffff88004f66000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04f6b810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04f6b950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04f6b9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04f6ba90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04f6bb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04f6bc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04f6bc20) 00000000`0186fbf8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0186fc00 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0186ff00 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0186ff30 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800510a990 Cid 0334.097c Teb: 000007fffff9c000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa800510ad50 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a1b740 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 39286 Ticks: 1004 (0:00:00:15.662) Context Switch Count 11 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ole32!CRpcThreadCache::RpcWorkerThreadEntry (0x000007fefdb23570) Stack Init fffff880049b7db0 Current fffff880049b7970 Base fffff880049b8000 Limit fffff880049b2000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`049b79b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`049b7af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`049b7b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`049b7bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`049b7c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`049b7c20) 00000000`02dffa68 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`02dffa70 000007fe`fdb1ea00 KERNELBASE!SleepEx+0xab 00000000`02dffb10 000007fe`fdb22046 ole32!CROIDTable::WorkerThreadLoop+0x10 00000000`02dffb40 000007fe`fdb2358a ole32!CRpcThread::WorkerLoop+0x1e 00000000`02dffb80 00000000`776cf56d ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1a 00000000`02dffbb0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`02dffbe0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004580660 Cid 0334.05fc Teb: 000007fffffda000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004a1eeb0 QueueObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a1b740 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 39699 Ticks: 591 (0:00:00:09.219) Context Switch Count 1349 UserTime 00:00:00.093 KernelTime 00:00:00.062 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880049bedb0 Current fffff880049be7d0 Base fffff880049bf000 Limit fffff880049b9000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`049be810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`049be950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`049be9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`049bea90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`049beb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`049bec20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`049bec20) 00000000`01e4f5a8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`01e4f5b0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`01e4f8b0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01e4f8e0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004df6860 Cid 0334.02d0 Teb: 000007fffff9a000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004a1eeb0 QueueObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a1b740 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 39699 Ticks: 591 (0:00:00:09.219) Context Switch Count 594 UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880041b7db0 Current fffff880041b77d0 Base fffff880041b8000 Limit fffff880041b2000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`041b7810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`041b7950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`041b79e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`041b7a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`041b7b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`041b7c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`041b7c20) 00000000`017bfab8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`017bfac0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`017bfdc0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`017bfdf0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004a282f0 SessionId: 0 Cid: 0354 Peb: 7fffffdf000 ParentCid: 0210 DirBase: 123d77000 ObjectTable: fffff8a00205f710 HandleCount: 1109. Image: svchost.exe VadRoot fffffa8004fff510 Vads 320 Clone 0 Private 4654. Modified 26302. Locked 2. DeviceMap fffff8a000008c10 Token fffff8a002071060 ElapsedTime 00:09:54.995 UserTime 00:00:00.343 KernelTime 00:00:00.670 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (9618, 50, 345) (38472KB, 200KB, 1380KB) PeakWorkingSetSize 113130 VirtualSize 290 Mb PeakVirtualSize 1531 Mb PageFaultCount 303670 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 5589 Setting context for this process... .process /p /r fffffa8004a282f0 THREAD fffffa8004a2ab60 Cid 0354.0358 Teb: 000007fffffdd000 Win32Thread: fffff900c1c79010 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a2ce50 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 23870 Ticks: 16420 (0:00:04:16.153) Context Switch Count 99 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.015 Win32 Start Address svchost!wmainCRTStartup (0x00000000ffa9246c) Stack Init fffff88004259db0 Current fffff88004259900 Base fffff8800425a000 Limit fffff88004254000 Call 0 Priority 13 BasePriority 8 UnusualBoost 5 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04259940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04259a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04259b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04259bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04259c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04259c20) 00000000`001ff4b8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`001ff4c0 000007fe`ff4eaffb KERNELBASE!WaitForSingleObjectEx+0x79 00000000`001ff560 000007fe`ff4e9d61 sechost!ScSendResponseReceiveControls+0x13b 00000000`001ff650 000007fe`ff4e9c16 sechost!ScDispatcherLoop+0x121 00000000`001ff760 00000000`ffa91d3a sechost!StartServiceCtrlDispatcherW+0x14e 00000000`001ff7b0 00000000`ffa9257a svchost!wmain+0x110 00000000`001ff7e0 00000000`776cf56d svchost!ScCreateWellKnownSids+0x2fd 00000000`001ff820 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`001ff850 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a2b060 Cid 0354.035c Teb: 000007fffffdb000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004a275c0 SynchronizationTimer fffffa8004a27730 SynchronizationTimer fffffa8004a3ff20 SynchronizationEvent fffffa8004a48790 SynchronizationEvent fffffa8004a57990 SynchronizationEvent fffffa800431e290 SynchronizationEvent fffffa800443d2e0 SynchronizationEvent fffffa8004a31230 SynchronizationEvent fffffa8004a67280 SynchronizationEvent fffffa8004916470 SynchronizationEvent fffffa8004acfaf0 SynchronizationEvent fffffa8004ad1b80 SynchronizationEvent fffffa8004af4e90 SynchronizationEvent fffffa8004b04990 SynchronizationEvent fffffa8004b1c890 SynchronizationEvent fffffa8004b2d800 SynchronizationEvent fffffa8004b419d0 SynchronizationEvent fffffa8004b014b0 SynchronizationEvent fffffa8004bd5cb0 SynchronizationEvent fffffa8004beec30 SynchronizationEvent fffffa8004bea2f0 SynchronizationEvent fffffa8004bea610 SynchronizationEvent fffffa8004be5120 SynchronizationEvent fffffa8004a0c8e0 SynchronizationEvent fffffa8004be1620 SynchronizationEvent fffffa8004a3e2e0 SynchronizationEvent fffffa8004bde5f0 SynchronizationEvent fffffa8004be5b40 SynchronizationEvent fffffa8004b76e90 SynchronizationEvent fffffa8004b76df0 SynchronizationEvent fffffa8004c4a2c0 SynchronizationEvent fffffa8004c394c0 NotificationEvent fffffa8004b644c0 NotificationEvent fffffa8004b68460 SynchronizationEvent fffffa8004c453f0 SynchronizationEvent fffffa8004c45280 SynchronizationTimer fffffa8004c47ef0 SynchronizationTimer fffffa8004c45200 SynchronizationEvent fffffa8004c478f0 SynchronizationEvent fffffa8004c4efe0 SynchronizationEvent fffffa8004c536e0 SynchronizationEvent fffffa8004c55ee0 SynchronizationEvent fffffa8004c51440 SynchronizationEvent fffffa8004c4fca0 SynchronizationEvent fffffa8004c54170 SynchronizationEvent fffffa8004c55b60 SynchronizationEvent fffffa8004c55ae0 SynchronizationEvent fffffa8004c55a60 SynchronizationEvent fffffa8004c64e10 SynchronizationEvent fffffa8004c56260 SynchronizationEvent fffffa8004c64c10 SynchronizationEvent fffffa8004c56ce0 SynchronizationEvent fffffa8004afd860 SynchronizationEvent fffffa8004c433d0 SynchronizationEvent fffffa8004c560e0 SynchronizationEvent fffffa8004c564a0 SynchronizationEvent fffffa8004c49600 SynchronizationEvent fffffa8004c476f0 SynchronizationEvent fffffa8003f9e680 SynchronizationEvent fffffa8004c8c580 SynchronizationEvent fffffa8004c64d10 SynchronizationEvent fffffa8004c4ec10 SynchronizationEvent fffffa8004afcb50 SynchronizationEvent fffffa8004a273b0 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 40238 Ticks: 52 (0:00:00:00.811) Context Switch Count 1258 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff88004027db0 Current fffff88004026fd0 Base fffff88004028000 Limit fffff88004022000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04027010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04027150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`040271e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04027490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04027960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04027bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04027c20) 00000000`00d9fb78 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`00d9fb80 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`00d9fe20 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00d9fe50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a2d870 Cid 0354.036c Teb: 000007fffffd3000 Win32Thread: fffff900c1c7bc30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a3fea0 NotificationEvent fffffa8004a488a0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 2281 Ticks: 38009 (0:00:09:52.944) Context Switch Count 58 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.000 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff880042abdb0 Current fffff880042aafd0 Base fffff880042ac000 Limit fffff880042a5000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`042ab010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`042ab150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`042ab1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`042ab490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`042ab960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`042abbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`042abc20) 00000000`00d1fc78 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`00d1fc80 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`00d1fd80 000007fe`fbe991f4 kernel32!WaitForMultipleObjects+0xb0 00000000`00d1fe10 000007fe`fbe99105 profsvc!CUserProfileService::ServiceMain+0xee 00000000`00d1fe60 00000000`ffa91344 profsvc!UserProfileServiceMain+0xa8 00000000`00d1fe90 000007fe`ff4ea82d svchost!ServiceStarter+0x1e8 00000000`00d1ff20 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`00d1ff50 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00d1ff80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a98060 Cid 0354.019c Teb: 000007fffffa8000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a8ec50 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 12630 Ticks: 27660 (0:00:07:11.498) Context Switch Count 422 UserTime 00:00:00.000 KernelTime 00:00:00.046 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff88002fffdb0 Current fffff88002fff900 Base fffff88003000000 Limit fffff88002ffa000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`02fff940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02fffa80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`02fffb10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`02fffbb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`02fffc20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02fffc20) 00000000`0179fa08 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0179fa10 000007fe`fb531536 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0179fab0 000007fe`fb53966a shsvcs!GSM::_RunService+0x4a 00000000`0179faf0 000007fe`fb53947d shsvcs!GSM::_ServiceMainHelper+0x225 00000000`0179fb40 000007fe`fb5310a1 shsvcs!GSM::CServiceMainTask::_DoStuff+0xd 00000000`0179fb70 000007fe`fb538f3e shsvcs!CThreadTask::_CallDoStuff+0x76 00000000`0179fba0 00000000`ffa91344 shsvcs!GSM::ServiceMain+0xa4 00000000`0179fc80 000007fe`ff4ea82d svchost!ServiceStarter+0x1e8 00000000`0179fd10 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`0179fd40 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0179fd70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004aa1060 Cid 0354.0198 Teb: 000007fffffa6000 Win32Thread: fffff900c1c83c30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004ab7880 SynchronizationEvent fffffa8004b727f0 SynchronizationEvent fffffa8004ab7800 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 2956 Ticks: 37334 (0:00:09:42.414) Context Switch Count 643 LargeStack UserTime 00:00:00.046 KernelTime 00:00:00.078 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff88004412db0 Current fffff88004411fd0 Base fffff88004413000 Limit fffff8800440a000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04412010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04412150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`044121e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04412490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04412960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04412bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04412c20) 00000000`014bf358 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`014bf360 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`014bf460 000007fe`fb413975 kernel32!WaitForMultipleObjects+0xb0 00000000`014bf4f0 000007fe`fb418acd schedsvc!Scheduler::TimerThreadFunction+0x349 00000000`014bf710 000007fe`fb424512 schedsvc!JobsService[::CNtService]::WorkerThread+0x15e 00000000`014bf7b0 000007fe`fb424401 schedsvc!CNtService::Run+0x118 00000000`014bf7f0 00000000`ffa91344 schedsvc!ServiceMain+0x109 00000000`014bf940 000007fe`ff4ea82d svchost!ServiceStarter+0x1e8 00000000`014bf9d0 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`014bfa00 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`014bfa30 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004ab8b60 Cid 0354.0264 Teb: 000007fffffa4000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa800427d6a0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 34258 Ticks: 6032 (0:00:01:34.099) Context Switch Count 40 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004227db0 Current fffff880042277d0 Base fffff88004228000 Limit fffff88004222000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04227810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04227950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`042279e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04227a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04227b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04227c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04227c20) 00000000`01a0f9a8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`01a0f9b0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`01a0fcb0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01a0fce0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004aad060 Cid 0354.0144 Teb: 000007fffffa2000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa80043844c0 SynchronizationEvent fffffa8004ab7780 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 2534 Ticks: 37756 (0:00:09:48.997) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address schedsvc!CSessionMgr::StartJobsCallback (0x000007fefb426928) Stack Init fffff88004383db0 Current fffff88004382fd0 Base fffff88004384000 Limit fffff8800437e000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04383010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04383150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`043831e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04383490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04383960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04383bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04383c20) 00000000`01c0f9a8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`01c0f9b0 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`01c0fab0 000007fe`fb413250 kernel32!WaitForMultipleObjects+0xb0 00000000`01c0fb40 000007fe`fb426979 schedsvc!CSessionMgr::LaunchLoop+0x8c 00000000`01c0fb90 00000000`776cf56d schedsvc!CSessionMgr::StartJobsCallback+0x97 00000000`01c0fc10 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01c0fc40 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004868b60 Cid 0354.025c Teb: 000007fffffa0000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a19cb0 SynchronizationEvent fffffa80049dcf60 SynchronizationEvent fffffa8004a19d30 SynchronizationEvent fffffa8004a12060 SynchronizationTimer fffffa8004a16060 SynchronizationTimer IRP List: fffffa8004433010: (0006,03a0) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 2735 Ticks: 37555 (0:00:09:45.861) Context Switch Count 8 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address taskcomp!CompatibilityAdapter::MonitorThread (0x000007fefb241a50) Stack Init fffff88004433db0 Current fffff88004432fd0 Base fffff88004434000 Limit fffff8800442e000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04433010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04433150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`044331e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04433490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04433960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04433bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04433c20) 00000000`01cff5a8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`01cff5b0 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`01cff6b0 000007fe`fb241afe kernel32!WaitForMultipleObjects+0xb0 00000000`01cff740 00000000`776cf56d taskcomp!CompatibilityAdapter::MonitorThread+0x138 00000000`01cff7c0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01cff7f0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004abb060 Cid 0354.02c8 Teb: 000007fffff9e000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Alertable fffffa8004abb420 Semaphore Limit 0x1 Impersonation token: fffff8a00213a060 (Level Delegation) Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 38775 Ticks: 1515 (0:00:00:23.634) Context Switch Count 481 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff88004441db0 Current fffff88004441970 Base fffff88004442000 Limit fffff8800443c000 Call 0 Priority 27 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`044419b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04441af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`04441b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`04441bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`04441c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04441c20) 00000000`01dcfc48 000007fe`fb131aaf ntdll!NtDelayExecution+0xa 00000000`01dcfc50 000007fe`fb133c3d mmcss!CiSchedulerInitiailize+0x143 00000000`01dcfcb0 00000000`ffa91344 mmcss!CsServiceMain+0x1ea 00000000`01dcfd60 000007fe`ff4ea82d svchost!ServiceStarter+0x1e8 00000000`01dcfdf0 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`01dcfe20 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01dcfe50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004ac1720 Cid 0354.0368 Teb: 000007fffff9c000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa80049932b0 NotificationEvent fffffa8004a19320 Semaphore Limit 0x7fffffff fffffa8004a14060 NotificationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 38775 Ticks: 1515 (0:00:00:23.634) Context Switch Count 653 UserTime 00:00:00.015 KernelTime 00:00:00.000 Win32 Start Address mmcss!CsServerApiLoop (0x000007fefb134164) Stack Init fffff88004448db0 Current fffff88004447fd0 Base fffff88004449000 Limit fffff88004443000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04448010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04448150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`044481e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04448490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04448960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04448bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04448c20) 00000000`00ecf6d8 000007fe`fb1316ec ntdll!NtWaitForMultipleObjects+0xa 00000000`00ecf6e0 000007fe`fb13416d mmcss!CiServerApiLoop+0x37c 00000000`00ecf900 00000000`776cf56d mmcss!CsServerApiLoop+0x9 00000000`00ecf940 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00ecf970 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004be55c0 Cid 0354.0558 Teb: 000007fffff94000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a33e90 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3114 Ticks: 37176 (0:00:09:39.949) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address AUTHZ!AuthzpDeQueueThreadWorker (0x000007fefcf01a70) Stack Init fffff880048e0db0 Current fffff880048e0900 Base fffff880048e1000 Limit fffff880048db000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`048e0940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`048e0a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`048e0b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`048e0bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`048e0c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`048e0c20) 00000000`0210fb48 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0210fb50 000007fe`fcf01a99 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0210fbf0 00000000`776cf56d AUTHZ!AuthzpDeQueueThreadWorker+0x29 00000000`0210fc20 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0210fc50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004afc410 Cid 0354.055c Teb: 000007fffff92000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004afca20 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3438 Ticks: 36852 (0:00:09:34.894) Context Switch Count 8 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880048bddb0 Current fffff880048bd7d0 Base fffff880048be000 Limit fffff880048b8000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`048bd810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`048bd950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`048bd9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`048bda90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`048bdb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`048bdc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`048bdc20) 00000000`025ef978 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`025ef980 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`025efc80 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`025efcb0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004c25b60 Cid 0354.05cc Teb: 000007fffff96000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004c169a0 NotificationEvent fffffa8004b66270 SynchronizationEvent fffffa8004b661d0 SynchronizationEvent fffffa8004b76fb8 NotificationEvent IRP List: fffffa800445cc60: (0006,03a0) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 17027 Ticks: 23263 (0:00:06:02.905) Context Switch Count 53 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff880049d3db0 Current fffff880049d2fd0 Base fffff880049d4000 Limit fffff880049ce000 Call 0 Priority 10 BasePriority 10 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`049d3010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`049d3150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`049d31e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`049d3490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`049d3960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`049d3bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`049d3c20) 00000000`0270f368 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0270f370 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0270f470 000007fe`fa6c14ac kernel32!WaitForMultipleObjects+0xb0 00000000`0270f500 000007fe`fa6c4025 wmisvc!WaitingFunction+0x179 00000000`0270f5b0 000007fe`fa6c3cda wmisvc!MyService::WorkerThread+0x320 00000000`0270f730 000007fe`fa6c3ba4 wmisvc!CNtService::Run+0x13b 00000000`0270f8c0 00000000`ffa91344 wmisvc!ServiceMain+0x11d 00000000`0270f960 000007fe`ff4ea82d svchost!ServiceStarter+0x1e8 00000000`0270f9f0 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`0270fa20 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0270fa50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004b5e790 Cid 0354.05f0 Teb: 000007fffff8e000 Win32Thread: fffff900c1c96ac0 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004b67f50 SynchronizationEvent fffffa8003bc6af0 SynchronizationEvent fffffa8004cb9590 SynchronizationEvent fffffa8004c44fe0 SynchronizationEvent fffffa8004cab3e0 SynchronizationEvent fffffa8004afe460 SynchronizationEvent fffffa8004c7ac50 SynchronizationEvent fffffa8004c34c40 SynchronizationEvent fffffa8004b67ed0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 18901 Ticks: 21389 (0:00:05:33.670) Context Switch Count 306 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff88004d66db0 Current fffff88004d65fd0 Base fffff88004d67000 Limit fffff88004d61000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04d66010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04d66150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04d661e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04d66490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04d66960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04d66bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04d66c20) 00000000`0293f398 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0293f3a0 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0293f4a0 000007fe`fa302328 kernel32!WaitForMultipleObjects+0xb0 00000000`0293f530 000007fe`fa303b4b srvsvc!SsScavengerThread+0x71d 00000000`0293f640 00000000`ffa91344 srvsvc!ServiceMain+0x662 00000000`0293f750 000007fe`ff4ea82d svchost!ServiceStarter+0x1e8 00000000`0293f7e0 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`0293f810 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0293f840 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004c4e4c0 Cid 0354.0624 Teb: 000007fffff82000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004c838e0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3427 Ticks: 36863 (0:00:09:35.066) Context Switch Count 11 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880048fcdb0 Current fffff880048fc900 Base fffff880048fd000 Limit fffff880048f7000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. *** ERROR: Symbol file could not be found. Defaulted to export symbols for iphlpsvc.dll - Child-SP RetAddr Call Site fffff880`048fc940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`048fca80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`048fcb10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`048fcbb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`048fcc20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`048fcc20) 00000000`02f6f838 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`02f6f840 000007fe`fa433ba0 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`02f6f8e0 00000000`00000644 iphlpsvc!ServiceMain+0x5a7c 00000000`02f6f8e8 00000000`00100002 0x644 00000000`02f6f8f0 00000000`00000001 0x100002 00000000`02f6f8f8 00000000`000009a4 0x1 00000000`02f6f900 000007fe`fa3f8820 0x9a4 00000000`02f6f908 000007fe`fa3f9208 iphlpsvc+0x18820 00000000`02f6f910 00000000`00000b10 iphlpsvc+0x19208 00000000`02f6f918 00000000`00000001 0xb10 00000000`02f6f920 00000000`778d42c0 0x1 00000000`02f6f928 00000000`0000ffff ntdll!`string' 00000000`02f6f930 00000000`00000000 0xffff THREAD fffffa8004c69b60 Cid 0354.0650 Teb: 000007fffff7a000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004c54320 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3408 Ticks: 36882 (0:00:09:35.362) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address AUTHZ!AuthzpDeQueueThreadWorker (0x000007fefcf01a70) Stack Init fffff88004c82db0 Current fffff88004c82900 Base fffff88004c83000 Limit fffff88004c7d000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04c82940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04c82a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04c82b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04c82bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04c82c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04c82c20) 00000000`031af7f8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`031af800 000007fe`fcf01a99 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`031af8a0 00000000`776cf56d AUTHZ!AuthzpDeQueueThreadWorker+0x29 00000000`031af8d0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`031af900 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004c81b60 Cid 0354.0690 Teb: 000007fffff78000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004c36a40 SynchronizationTimer fffffa8004c7f240 SynchronizationEvent fffffa8004c7bdf0 SynchronizationEvent fffffa8004a9ade0 SynchronizationEvent fffffa8004c7bc70 SynchronizationEvent fffffa8004bd5bc0 SynchronizationEvent fffffa8004c8a530 SynchronizationEvent fffffa8004c92ae0 SynchronizationEvent fffffa8004c7bf60 SynchronizationEvent fffffa8004b74260 SynchronizationTimer fffffa8004cb7060 SynchronizationEvent fffffa80043ec860 SynchronizationEvent fffffa8004b646b0 SynchronizationEvent fffffa80049c6b30 ProcessObject fffffa80049c6b30 ProcessObject fffffa80049c6b30 ProcessObject fffffa80049c6b30 ProcessObject fffffa8004c81990 SynchronizationEvent fffffa8004c80490 SynchronizationEvent fffffa8004c7b4d0 SynchronizationEvent fffffa8004c82280 SynchronizationEvent fffffa8004cb32f0 SynchronizationEvent fffffa8004f9f260 SynchronizationEvent fffffa8004fa2fe0 SynchronizationEvent fffffa8004fa2e60 SynchronizationEvent fffffa8004fa2ce0 SynchronizationEvent fffffa8004fa2a60 SynchronizationEvent fffffa8004fa2ae0 SynchronizationEvent fffffa8004fa2960 SynchronizationEvent fffffa8004fa3fe0 SynchronizationEvent fffffa8004fa3e60 SynchronizationEvent fffffa8004fa33d0 SynchronizationEvent fffffa8004fa3150 SynchronizationEvent fffffa8004fa31d0 SynchronizationEvent fffffa8004fa4fe0 SynchronizationEvent fffffa8004fa4de0 SynchronizationEvent fffffa8004fa4c60 SynchronizationEvent fffffa8004fa49e0 SynchronizationEvent fffffa8004fa4a60 SynchronizationEvent fffffa8004fa4860 SynchronizationEvent fffffa8004fa4660 SynchronizationEvent fffffa8004fa5108 NotificationEvent fffffa8004fa5ae0 SynchronizationEvent fffffa8004fa5860 SynchronizationEvent fffffa8004fa58e0 SynchronizationEvent fffffa8004fa5760 SynchronizationEvent fffffa8004fa5560 SynchronizationEvent fffffa8004fa53e0 SynchronizationEvent fffffa8004fa6fe0 SynchronizationEvent fffffa8004fa51e0 SynchronizationEvent fffffa8004fa6de0 SynchronizationEvent fffffa8004fa7fe0 SynchronizationEvent fffffa8004fa7ee0 SynchronizationEvent fffffa8004fa7de0 SynchronizationEvent fffffa8004fb98e0 NotificationEvent fffffa8005010b80 SynchronizationEvent fffffa8004cfa580 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 34258 Ticks: 6032 (0:00:01:34.099) Context Switch Count 446 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff88004ccddb0 Current fffff88004cccfd0 Base fffff88004cce000 Limit fffff88004cc8000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04ccd010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04ccd150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04ccd1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04ccd490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04ccd960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04ccdbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04ccdc20) 00000000`0390f568 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`0390f570 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`0390f810 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0390f840 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004c82b60 Cid 0354.0698 Teb: 000007fffff74000 Win32Thread: fffff900c1c97ac0 WAIT: (WrQueue) UserMode Alertable fffffa8004a279b0 QueueObject IRP List: fffffa8004fa4160: (0006,03a0) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 40238 Ticks: 52 (0:00:00:00.811) Context Switch Count 2390 LargeStack UserTime 00:00:00.046 KernelTime 00:00:00.031 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005157db0 Current fffff880051577d0 Base fffff88005158000 Limit fffff88005152000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05157810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05157950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`051579e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05157a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05157b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05157c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05157c20) 00000000`0398f768 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0398f770 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0398fa70 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0398faa0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004cfa7b0 Cid 0354.0718 Teb: 000007fffff5c000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004cb65d0 NotificationEvent fffffa8004cb6730 SynchronizationEvent fffffa8004c393c0 SynchronizationEvent fffffa8004c39340 SynchronizationEvent fffffa8004b0bc40 NotificationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3587 Ticks: 36703 (0:00:09:32.570) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address gpsvc!GPOThread (0x000007fefc0f45d8) Stack Init fffff88004db4db0 Current fffff88004db3fd0 Base fffff88004db5000 Limit fffff88004daf000 Call 0 Priority 1 BasePriority 1 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04db4010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04db4150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04db41e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04db4490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04db4960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04db4bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04db4c20) 00000000`018df968 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`018df970 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`018dfa70 000007fe`fc0f493e kernel32!WaitForMultipleObjects+0xb0 00000000`018dfb00 00000000`776cf56d gpsvc!GPOThread+0x435 00000000`018dfe00 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`018dfe30 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004b7bb60 Cid 0354.0528 Teb: 000007fffff64000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d07e60 NotificationEvent fffffa8004d0c7d0 SynchronizationEvent fffffa8004c3c9e0 SynchronizationEvent fffffa8004d0f330 SynchronizationEvent fffffa8004cd6060 NotificationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 4957 Ticks: 35333 (0:00:09:11.198) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address gpsvc!GPOThread (0x000007fefc0f45d8) Stack Init fffff88004e99db0 Current fffff88004e98fd0 Base fffff88004e9a000 Limit fffff88004e94000 Call 0 Priority 1 BasePriority 1 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04e99010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04e99150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04e991e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04e99490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04e99960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04e99bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04e99c20) 00000000`0306f868 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0306f870 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0306f970 000007fe`fc0f493e kernel32!WaitForMultipleObjects+0xb0 00000000`0306fa00 00000000`776cf56d gpsvc!GPOThread+0x435 00000000`0306fd00 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0306fd30 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004f49060 Cid 0354.0944 Teb: 000007fffff60000 Win32Thread: fffff900c1ca4010 WAIT: (UserRequest) UserMode Alertable fffffa8004f26bb0 SynchronizationTimer fffffa8004e56e80 NotificationEvent fffffa8004edc2a0 SynchronizationEvent IRP List: fffffa8004b75430: (0006,01f0) Flags: 00060030 Mdl: 00000000 fffffa8004ae3e10: (0006,01f0) Flags: 00060030 Mdl: 00000000 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 12625 Ticks: 27665 (0:00:07:11.576) Context Switch Count 314 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff88004f7edb0 Current fffff88004f7dfd0 Base fffff88004f7f000 Limit fffff88004f77000 Call 0 Priority 13 BasePriority 8 UnusualBoost 3 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04f7e010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04f7e150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04f7e1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04f7e490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04f7e960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04f7ebb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04f7ec20) 00000000`0456f678 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0456f680 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0456f780 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0456f810 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`0456f8b0 000007fe`f5781a77 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`0456f8f0 000007fe`f578c55f qmgr!CJobManager::TaskThread+0x4b 00000000`0456f970 000007fe`f5770050 qmgr!InitQmgr+0x253 00000000`0456fa20 000007fe`f576f999 qmgr!BITSServiceMainProc+0x6a8 00000000`0456fb60 00000000`ffa91344 qmgr!BITSServiceMain+0x9 00000000`0456fba0 000007fe`ff4ea82d svchost!ServiceStarter+0x1e8 00000000`0456fc30 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`0456fc60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0456fc90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004f25340 Cid 0354.0948 Teb: 000007fffff62000 Win32Thread: fffff900c1ca4620 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004f23dc0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 30686 Ticks: 9604 (0:00:02:29.823) Context Switch Count 31 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ole32!CRpcThreadCache::RpcWorkerThreadEntry (0x000007fefdb23570) Stack Init fffff88005144db0 Current fffff880051446f0 Base fffff88005145000 Limit fffff8800513f000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05144730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05144870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05144900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`051449a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`05144a40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`05144a70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`05144b50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`05144b90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`05144c20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05144c20) 00000000`043afcd8 00000000`775cc95e USER32!NtUserGetMessage+0xa 00000000`043afce0 000007fe`fdb1ca7e USER32!GetMessageW+0x34 00000000`043afd10 000007fe`fdc635c7 ole32!CDllHost::STAWorkerLoop+0x8a 00000000`043afd70 000007fe`fdb22046 ole32!CDllHost::WorkerThread+0xd7 00000000`043afdb0 000007fe`fdb2358a ole32!CRpcThread::WorkerLoop+0x1e 00000000`043afdf0 00000000`776cf56d ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1a 00000000`043afe20 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`043afe50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8003c22060 Cid 0354.09cc Teb: 000007fffff88000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa80049e9290 NotificationEvent fffffa8004c76cc0 NotificationEvent IRP List: fffffa8004a88940: (0006,0118) Flags: 00060800 Mdl: 00000000 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 8051 Ticks: 32239 (0:00:08:22.931) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ncprov!CNCProvider::ConnectThreadProc (0x000007fef4e6506c) Stack Init fffff88004ca3db0 Current fffff88004ca2fd0 Base fffff88004ca4000 Limit fffff88004c9e000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04ca3010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04ca3150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04ca31e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04ca3490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04ca3960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04ca3bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04ca3c20) 00000000`0266fba8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0266fbb0 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0266fcb0 000007fe`f4e652b7 kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0266fd40 000007fe`f4e6509b ncprov!CNCProvider::ConnectLoop+0x12f 00000000`0266fdd0 00000000`776cf56d ncprov!CNCProvider::ConnectThreadProc+0x2f 00000000`0266fe10 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0266fe40 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8003c22b60 Cid 0354.09d0 Teb: 000007fffff86000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a3ccc0 NotificationEvent fffffa8004cbd960 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 8051 Ticks: 32239 (0:00:08:22.931) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address NCObjAPI!CNamedPipeClient::ProviderReadyThreadProc (0x000007fef9aa1c20) Stack Init fffff88004cdbdb0 Current fffff88004cdafd0 Base fffff88004cdc000 Limit fffff88004cd6000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04cdb010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04cdb150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04cdb1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04cdb490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04cdb960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04cdbbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04cdbc20) 00000000`0379f7d8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0379f7e0 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0379f8e0 000007fe`f9aa1c9a kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0379f970 00000000`776cf56d NCObjAPI!CNamedPipeClient::ProviderReadyThreadProc+0x15d 00000000`0379f9e0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0379fa10 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8003c22660 Cid 0354.09d4 Teb: 000007fffff7e000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004c1a1c0 NotificationEvent fffffa8004ad4080 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 8051 Ticks: 32239 (0:00:08:22.931) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address NCObjAPI!CNamedPipeClient::ProviderReadyThreadProc (0x000007fef9aa1c20) Stack Init fffff88004c74db0 Current fffff88004c73fd0 Base fffff88004c75000 Limit fffff88004c6f000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04c74010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04c74150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04c741e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04c74490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04c74960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04c74bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04c74c20) 00000000`0384fa98 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0384faa0 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0384fba0 000007fe`f9aa1c9a kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0384fc30 00000000`776cf56d NCObjAPI!CNamedPipeClient::ProviderReadyThreadProc+0x15d 00000000`0384fca0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0384fcd0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800502c390 Cid 0354.0a48 Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa800502c750 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 30595 Ticks: 9695 (0:00:02:31.242) Context Switch Count 14 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address aelupsvc!AelpProcessLPCCalls (0x000007fef2791ab0) Stack Init fffff88004cbfdb0 Current fffff88004cbf750 Base fffff88004cc0000 Limit fffff88004cba000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04cbf790 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04cbf8d0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04cbf960 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`04cbfa00 fffff800`01d8cac7 nt!AlpcpReceiveMessagePort+0x189 fffff880`04cbfa60 fffff800`01d8e006 nt!AlpcpReceiveMessage+0x2d4 fffff880`04cbfb00 fffff800`01a8b993 nt!NtAlpcSendWaitReceivePort+0x1e6 fffff880`04cbfbb0 00000000`7782070a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04cbfc20) 00000000`02a0fd48 000007fe`f2791c5c ntdll!ZwAlpcSendWaitReceivePort+0xa 00000000`02a0fd50 00000000`00000000 aelupsvc!AelpProcessLPCCalls+0x1fd THREAD fffffa80050ebb60 Cid 0354.08f4 Teb: 000007fffff8a000 Win32Thread: fffff900c1cc0010 WAIT: (UserRequest) UserMode Alertable fffffa8004f44ba0 SynchronizationEvent fffffa800486bd90 NotificationEvent fffffa80050261d0 SynchronizationEvent fffffa80044fab30 ProcessObject IRP List: fffffa8003c46330: (0006,01f0) Flags: 00060030 Mdl: 00000000 fffffa8004d99010: (0006,01f0) Flags: 00060030 Mdl: 00000000 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 16960 Ticks: 23330 (0:00:06:03.950) Context Switch Count 321 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.062 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff88005703db0 Current fffff88005702fd0 Base fffff88005704000 Limit fffff880056fc000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05703010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05703150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`057031e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05703490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`05703960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`05703bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05703c20) 00000000`03e6fa38 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`03e6fa40 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`03e6fb40 000007fe`f2501586 kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`03e6fbd0 000007fe`f23c413c wuaueng!CSusEventSystem::Run+0x292 00000000`03e6fc60 00000000`ffa91344 wuaueng!ServiceMain+0x390 00000000`03e6fd80 000007fe`ff4ea82d svchost!ServiceStarter+0x1e8 00000000`03e6fe10 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`03e6fe40 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`03e6fe70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80050f93f0 Cid 0354.09c0 Teb: 000007fffffac000 Win32Thread: fffff900c01882d0 WAIT: (UserRequest) UserMode Non-Alertable fffffa80049474c0 NotificationEvent fffffa8004e7e860 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 16960 Ticks: 23330 (0:00:06:03.950) Context Switch Count 12198 LargeStack UserTime 00:00:05.163 KernelTime 00:00:04.508 Win32 Start Address wuaueng!CWorkItemManager::ExecuteWorkItemWrapper (0x000007fef23c9640) Stack Init fffff8800590cdb0 Current fffff8800590bfd0 Base fffff8800590d000 Limit fffff88005904000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0590c010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0590c150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0590c1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`0590c490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`0590c960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`0590cbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0590cc20) 00000000`074bf7f8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`074bf800 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`074bf900 000007fe`f23c96cc kernel32!WaitForMultipleObjects+0xb0 00000000`074bf990 00000000`776cf56d wuaueng!CWorkItemManager::ExecuteWorkItemWrapper+0x8c 00000000`074bfa10 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`074bfa40 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005109b60 Cid 0354.0ba0 Teb: 000007fffff8c000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa80049474c0 NotificationEvent fffffa8004b21fe0 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 16638 Ticks: 23652 (0:00:06:08.973) Context Switch Count 14 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address wuaueng!CWorkItemManager::ExecuteWorkItemWrapper (0x000007fef23c9640) Stack Init fffff880043d7db0 Current fffff880043d6fd0 Base fffff880043d8000 Limit fffff880043d2000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`043d7010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`043d7150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`043d71e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`043d7490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`043d7960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`043d7bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`043d7c20) 00000000`07adf8d8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`07adf8e0 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`07adf9e0 000007fe`f23c96cc kernel32!WaitForMultipleObjects+0xb0 00000000`07adfa70 00000000`776cf56d wuaueng!CWorkItemManager::ExecuteWorkItemWrapper+0x8c 00000000`07adfaf0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`07adfb20 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004de8060 Cid 0354.0904 Teb: 000007fffffd5000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004fa0fb0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 30595 Ticks: 9695 (0:00:02:31.242) Context Switch Count 29 UserTime 00:00:00.015 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004f39db0 Current fffff88004f397d0 Base fffff88004f3a000 Limit fffff88004f34000 Call 0 Priority 10 BasePriority 8 UnusualBoost 2 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04f39810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04f39950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04f399e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04f39a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04f39b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04f39c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04f39c20) 00000000`0361f758 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0361f760 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0361fa60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0361fa90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005101b60 Cid 0354.09c8 Teb: 000007fffffd9000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004a279b0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 39661 Ticks: 629 (0:00:00:09.812) Context Switch Count 1491 UserTime 00:00:00.000 KernelTime 00:00:00.078 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880050a5db0 Current fffff880050a57d0 Base fffff880050a6000 Limit fffff880050a0000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`050a5810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`050a5950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`050a59e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`050a5a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`050a5b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`050a5c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`050a5c20) 00000000`078bf7d8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`078bf7e0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`078bfae0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`078bfb10 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80049044a0 Cid 0354.06b0 Teb: 000007fffffd7000 Win32Thread: fffff900c1ca5c30 WAIT: (WrQueue) UserMode Alertable fffffa8004a279b0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a282f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 40238 Ticks: 52 (0:00:00:00.811) Context Switch Count 1239 LargeStack UserTime 00:00:00.031 KernelTime 00:00:00.062 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004f2bdb0 Current fffff88004f2b7d0 Base fffff88004f2c000 Limit fffff88004f23000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04f2b810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04f2b950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04f2b9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04f2ba90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04f2bb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04f2bc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04f2bc20) 00000000`0a1efba8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0a1efbb0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0a1efeb0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0a1efee0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004a444f0 SessionId: 0 Cid: 0384 Peb: 7fffffd6000 ParentCid: 0210 DirBase: 100e40000 ObjectTable: fffff8a002090bd0 HandleCount: 480. Image: svchost.exe VadRoot fffffa8004a35510 Vads 164 Clone 0 Private 1622. Modified 0. Locked 114. DeviceMap fffff8a002020e00 Token fffff8a0020a6060 ElapsedTime 00:09:53.560 UserTime 00:00:00.093 KernelTime 00:00:00.046 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (3862, 50, 345) (15448KB, 200KB, 1380KB) PeakWorkingSetSize 3923 VirtualSize 66 Mb PeakVirtualSize 72 Mb PageFaultCount 4177 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 2090 Setting context for this process... .process /p /r fffffa8004a444f0 THREAD fffffa8004a41710 Cid 0384.0388 Teb: 000007fffffde000 Win32Thread: fffff900c1c7a380 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a47350 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a444f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 23842 Ticks: 16448 (0:00:04:16.590) Context Switch Count 48 LargeStack UserTime 00:00:00.031 KernelTime 00:00:00.000 Win32 Start Address svchost!wmainCRTStartup (0x00000000ffa9246c) Stack Init fffff880042c5db0 Current fffff880042c5900 Base fffff880042c6000 Limit fffff880042c0000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`042c5940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`042c5a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`042c5b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`042c5bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`042c5c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`042c5c20) 00000000`0015f4a8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0015f4b0 000007fe`ff4eaffb KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0015f550 000007fe`ff4e9d61 sechost!ScSendResponseReceiveControls+0x13b 00000000`0015f640 000007fe`ff4e9c16 sechost!ScDispatcherLoop+0x121 00000000`0015f750 00000000`ffa91d3a sechost!StartServiceCtrlDispatcherW+0x14e 00000000`0015f7a0 00000000`ffa9257a svchost!wmain+0x110 00000000`0015f7d0 00000000`776cf56d svchost!ScCreateWellKnownSids+0x2fd 00000000`0015f810 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0015f840 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a465c0 Cid 0384.038c Teb: 000007fffffdc000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004a46ac0 SynchronizationTimer fffffa8004c41220 SynchronizationEvent fffffa8004a46c30 SynchronizationTimer fffffa8004a54610 SynchronizationEvent fffffa8004a50ea0 SynchronizationEvent fffffa8004a797a0 SynchronizationEvent fffffa8004a75570 SynchronizationEvent fffffa8004c28b60 SynchronizationEvent fffffa8004c31e60 NotificationEvent fffffa8004c31ee0 SynchronizationEvent fffffa8004c31ae0 SynchronizationEvent fffffa8004c317c0 SynchronizationEvent fffffa8004c33180 Thread fffffa8004c318c0 SynchronizationEvent fffffa8004c31740 SynchronizationEvent fffffa8004c316c0 SynchronizationEvent fffffa8004c41bd0 SynchronizationEvent fffffa8004c40a60 SynchronizationEvent fffffa8004c28a60 NotificationEvent fffffa8004cb3b00 SynchronizationEvent fffffa8004c28a60 NotificationEvent fffffa8004c34100 SynchronizationEvent fffffa8004c31a40 NotificationEvent fffffa8004b7ab20 SynchronizationEvent fffffa8004c41e10 SynchronizationEvent fffffa8004c28dd0 SynchronizationEvent fffffa8004b756d0 SynchronizationEvent fffffa8004c31840 SynchronizationEvent fffffa8004e24c00 NotificationEvent fffffa8004dbb7e0 Semaphore Limit 0x7fffffff fffffa8003c45fe0 SynchronizationEvent fffffa8004352770 SynchronizationEvent fffffa8004a30a60 SynchronizationEvent fffffa8004e8dce0 SynchronizationEvent fffffa800486f690 SynchronizationEvent fffffa8005171aa0 SynchronizationTimer fffffa8004fb3450 SynchronizationTimer fffffa8005087060 SynchronizationTimer fffffa8004fd4570 Semaphore Limit 0x7fffffff fffffa8004c80890 SynchronizationEvent fffffa8004e31240 Semaphore Limit 0x7fffffff fffffa8004574890 SynchronizationTimer fffffa8003c2e5c0 SynchronizationTimer fffffa8005165da0 SynchronizationTimer fffffa8004ff12b0 SynchronizationEvent fffffa8004a463b0 SynchronizationTimer fffffa8004f44400 SynchronizationTimer Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a444f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 40279 Ticks: 11 (0:00:00:00.171) Context Switch Count 1419 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff88004267db0 Current fffff88004266fd0 Base fffff88004268000 Limit fffff88004262000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04267010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04267150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`042671e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04267490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04267960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04267bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04267c20) 00000000`00d6f928 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`00d6f930 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`00d6fbd0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00d6fc00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a48060 Cid 0384.0390 Teb: 000007fffffda000 Win32Thread: fffff900c1c90470 WAIT: (WrQueue) UserMode Alertable fffffa8004a46eb0 QueueObject IRP List: fffffa8004ca2950: (0006,01f0) Flags: 00060030 Mdl: 00000000 fffffa80049f8010: (0006,01f0) Flags: 00060030 Mdl: 00000000 Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a444f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 23846 Ticks: 16444 (0:00:04:16.528) Context Switch Count 912 LargeStack UserTime 00:00:00.031 KernelTime 00:00:00.015 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff8800493adb0 Current fffff8800493a7d0 Base fffff8800493b000 Limit fffff88004934000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0493a810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0493a950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0493a9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0493aa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0493ab20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0493ac20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0493ac20) 00000000`00c4f578 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`00c4f580 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`00c4f880 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00c4f8b0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a48b60 Cid 0384.0394 Teb: 000007fffffd8000 Win32Thread: fffff900c1c90850 WAIT: (WrQueue) UserMode Alertable fffffa8004a46eb0 QueueObject IRP List: fffffa8004bfe310: (0006,01f0) Flags: 00060030 Mdl: 00000000 fffffa8004b10600: (0006,01f0) Flags: 00060030 Mdl: 00000000 Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a444f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 38040 Ticks: 2250 (0:00:00:35.100) Context Switch Count 1318 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.062 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004927db0 Current fffff880049277d0 Base fffff88004928000 Limit fffff88004922000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04927810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04927950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`049279e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04927a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04927b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04927c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04927c20) 00000000`00f7fb48 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`00f7fb50 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`00f7fe50 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00f7fe80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a57060 Cid 0384.03cc Teb: 000007fffffac000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004a4d3d0 QueueObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a444f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 35075 Ticks: 5215 (0:00:01:21.354) Context Switch Count 10 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff8800432adb0 Current fffff8800432a7d0 Base fffff8800432b000 Limit fffff88004325000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0432a810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0432a950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0432a9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0432aa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0432ab20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0432ac20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0432ac20) 00000000`014bf578 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`014bf580 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`014bf880 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`014bf8b0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004c33180 Cid 0384.05dc Teb: 000007fffffa4000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004c30560 NotificationEvent fffffa8004c31fe0 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a444f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 23588 Ticks: 16702 (0:00:04:20.552) Context Switch Count 7 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address w32time!ClockDisciplineThread (0x000007fefa66b1b0) Stack Init fffff880049e1db0 Current fffff880049e0fd0 Base fffff880049e2000 Limit fffff880049dc000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`049e1010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`049e1150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`049e11e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`049e1490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`049e1960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`049e1bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`049e1c20) 00000000`01a7efc8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`01a7efd0 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`01a7f0d0 000007fe`fa661439 kernel32!WaitForMultipleObjects+0xb0 00000000`01a7f160 00000000`776cf56d w32time!ClockDisciplineThread+0x76a 00000000`01a7f780 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01a7f7b0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004afeb60 Cid 0384.05e0 Teb: 000007fffffa2000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004c31060 NotificationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a444f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 40256 Ticks: 34 (0:00:00:00.530) Context Switch Count 131 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address msvcrt!endthreadex (0x000007fefdd173fc) Stack Init fffff880049e8db0 Current fffff880049e8900 Base fffff880049e9000 Limit fffff880049e3000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`049e8940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`049e8a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`049e8b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`049e8bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`049e8c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`049e8c20) 00000000`018bfd48 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`018bfd50 000007fe`fa5b4ef4 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`018bfdf0 000007fe`fdd142bf vmictimeprovider!ICTimeSyncProviderLaunch+0x2d0 00000000`018bfe60 000007fe`fdd17459 msvcrt!endthreadex+0x47 00000000`018bfe90 00000000`776cf56d msvcrt!endthreadex+0xe0 00000000`018bfec0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`018bfef0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004c415d0 Cid 0384.0678 Teb: 000007fffffa0000 Win32Thread: fffff900c1c98a70 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004c41b50 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a444f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3503 Ticks: 36787 (0:00:09:33.880) Context Switch Count 30 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address netprofm!NetProfileManStartStopThread (0x000007fef9f40ea8) Stack Init fffff88004ddcdb0 Current fffff88004ddc900 Base fffff88004ddd000 Limit fffff88004dd6000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04ddc940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04ddca80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04ddcb10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04ddcbb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04ddcc20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04ddcc20) 00000000`01affdb8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`01affdc0 000007fe`f9f41041 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`01affe60 00000000`776cf56d netprofm!NetProfileManStartStopThread+0x227 00000000`01affea0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01affed0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004c42060 Cid 0384.0680 Teb: 000007fffff9e000 Win32Thread: fffff900c1c95ac0 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004c42890 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a444f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 5114 Ticks: 35176 (0:00:09:08.749) Context Switch Count 76 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address netprofm!CImplINetworkListManager::EventMgrThreadProc (0x000007fef9f39db0) Stack Init fffff88004cf5db0 Current fffff88004cf56f0 Base fffff88004cf6000 Limit fffff88004cef000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04cf5730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04cf5870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04cf5900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`04cf59a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`04cf5a40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`04cf5a70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`04cf5b50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`04cf5b90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`04cf5c20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04cf5c20) 00000000`01d6fa58 00000000`775cc95e USER32!NtUserGetMessage+0xa 00000000`01d6fa60 000007fe`f9f39e50 USER32!GetMessageW+0x34 00000000`01d6fa90 00000000`776cf56d netprofm!CImplINetworkListManager::EventMgrThreadProc+0x26b 00000000`01d6fb40 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01d6fb70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004c89060 Cid 0384.06f8 Teb: 000007fffff9c000 Win32Thread: fffff900c1c9ac30 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004c736b0 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a444f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 5114 Ticks: 35176 (0:00:09:08.749) Context Switch Count 131 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address netprofm!CImplINetworkListManager::EventWorkerThreadProc (0x000007fef9f3aa10) Stack Init fffff88004defdb0 Current fffff88004def6f0 Base fffff88004df0000 Limit fffff88004de9000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04def730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04def870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04def900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`04def9a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`04defa40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`04defa70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`04defb50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`04defb90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`04defc20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04defc20) 00000000`0196f8e8 00000000`775cc95e USER32!NtUserGetMessage+0xa 00000000`0196f8f0 000007fe`f9f3aabb USER32!GetMessageW+0x34 00000000`0196f920 00000000`776cf56d netprofm!CImplINetworkListManager::EventWorkerThreadProc+0xc4 00000000`0196f9c0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0196f9f0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004cb70e0 Cid 0384.06fc Teb: 000007fffff9a000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004c731e0 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a444f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3503 Ticks: 36787 (0:00:09:33.880) Context Switch Count 11 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address netprofm!NLAServiceStatusListenerThread (0x000007fef9f41c94) Stack Init fffff88004cd4db0 Current fffff88004cd4900 Base fffff88004cd5000 Limit fffff88004ccf000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04cd4940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04cd4a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04cd4b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04cd4bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04cd4c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04cd4c20) 00000000`0231fbc8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0231fbd0 000007fe`f9f41d3f KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0231fc70 00000000`776cf56d netprofm!NLAServiceStatusListenerThread+0xc6 00000000`0231fca0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0231fcd0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004e61580 Cid 0384.0b60 Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8005092270 SynchronizationEvent fffffa8004fe4150 NotificationEvent fffffa8004cc7fe0 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a444f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 24199 Ticks: 16091 (0:00:04:11.021) Context Switch Count 336 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address fdwsd!CWsdWorker::WorkerStart (0x000007fef796d3c8) Stack Init fffff8800409ddb0 Current fffff8800409cfd0 Base fffff8800409e000 Limit fffff88004098000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0409d010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0409d150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0409d1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`0409d490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`0409d960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`0409dbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0409dc20) 00000000`017fefa8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`017fefb0 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`017ff0b0 000007fe`f796d6ac kernel32!WaitForMultipleObjects+0xb0 00000000`017ff140 000007fe`f796d5bf fdwsd!CWsdWorker::WorkerMain+0xa0 00000000`017ff1b0 000007fe`fdb07e62 fdwsd!WorkerMainWithComContext+0x4b 00000000`017ff1f0 000007fe`fdb07b87 ole32!EnterForCallback+0x192 00000000`017ff330 000007fe`fdb3361c ole32!SwitchForCallback+0x387 00000000`017ff590 000007fe`fdb33139 ole32!PerformCallback+0x47c 00000000`017ff660 000007fe`fdb51825 ole32!CObjectContext::InternalContextCallback+0x165 00000000`017ff780 000007fe`fdb518c1 ole32!CObjectContext::ContextCallback+0x81 00000000`017ff810 000007fe`f796d4b4 ole32!CContextSwitcher::ContextCallback+0x6d 00000000`017ff850 00000000`776cf56d fdwsd!CWsdWorker::WorkerStart+0xec 00000000`017ff8a0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`017ff8d0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800510cb60 Cid 0384.0a20 Teb: 000007fffffa8000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8005092270 SynchronizationEvent fffffa8004fe4150 NotificationEvent fffffa8004cc7fe0 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a444f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 24199 Ticks: 16091 (0:00:04:11.021) Context Switch Count 341 UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address fdwsd!CWsdWorker::WorkerStart (0x000007fef796d3c8) Stack Init fffff880045a0db0 Current fffff8800459ffd0 Base fffff880045a1000 Limit fffff8800459b000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`045a0010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`045a0150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`045a01e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`045a0490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`045a0960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`045a0bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`045a0c20) 00000000`01ccf2d8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`01ccf2e0 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`01ccf3e0 000007fe`f796d6ac kernel32!WaitForMultipleObjects+0xb0 00000000`01ccf470 000007fe`f796d5bf fdwsd!CWsdWorker::WorkerMain+0xa0 00000000`01ccf4e0 000007fe`fdb07e62 fdwsd!WorkerMainWithComContext+0x4b 00000000`01ccf520 000007fe`fdb07b87 ole32!EnterForCallback+0x192 00000000`01ccf660 000007fe`fdb3361c ole32!SwitchForCallback+0x387 00000000`01ccf8c0 000007fe`fdb33139 ole32!PerformCallback+0x47c 00000000`01ccf990 000007fe`fdb51825 ole32!CObjectContext::InternalContextCallback+0x165 00000000`01ccfab0 000007fe`fdb518c1 ole32!CObjectContext::ContextCallback+0x81 00000000`01ccfb40 000007fe`f796d4b4 ole32!CContextSwitcher::ContextCallback+0x6d 00000000`01ccfb80 00000000`776cf56d fdwsd!CWsdWorker::WorkerStart+0xec 00000000`01ccfbd0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01ccfc00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004eee660 Cid 0384.02b0 Teb: 000007fffffa6000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8005092270 SynchronizationEvent fffffa8004fe4150 NotificationEvent fffffa8004cc7fe0 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a444f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 24199 Ticks: 16091 (0:00:04:11.021) Context Switch Count 250 UserTime 00:00:00.000 KernelTime 00:00:00.031 Win32 Start Address fdwsd!CWsdWorker::WorkerStart (0x000007fef796d3c8) Stack Init fffff880045a7db0 Current fffff880045a6fd0 Base fffff880045a8000 Limit fffff880045a2000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`045a7010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`045a7150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`045a71e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`045a7490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`045a7960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`045a7bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`045a7c20) 00000000`0135f3f8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0135f400 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0135f500 000007fe`f796d6ac kernel32!WaitForMultipleObjects+0xb0 00000000`0135f590 000007fe`f796d5bf fdwsd!CWsdWorker::WorkerMain+0xa0 00000000`0135f600 000007fe`fdb07e62 fdwsd!WorkerMainWithComContext+0x4b 00000000`0135f640 000007fe`fdb07b87 ole32!EnterForCallback+0x192 00000000`0135f780 000007fe`fdb3361c ole32!SwitchForCallback+0x387 00000000`0135f9e0 000007fe`fdb33139 ole32!PerformCallback+0x47c 00000000`0135fab0 000007fe`fdb51825 ole32!CObjectContext::InternalContextCallback+0x165 00000000`0135fbd0 000007fe`fdb518c1 ole32!CObjectContext::ContextCallback+0x81 00000000`0135fc60 000007fe`f796d4b4 ole32!CContextSwitcher::ContextCallback+0x6d 00000000`0135fca0 00000000`776cf56d fdwsd!CWsdWorker::WorkerStart+0xec 00000000`0135fcf0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0135fd20 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004acc060 Cid 0384.0a60 Teb: 000007fffff98000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8005092270 SynchronizationEvent fffffa8004fe4150 NotificationEvent fffffa8004cc7fe0 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a444f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 24504 Ticks: 15786 (0:00:04:06.263) Context Switch Count 347 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address fdwsd!CWsdWorker::WorkerStart (0x000007fef796d3c8) Stack Init fffff880048cbdb0 Current fffff880048cafd0 Base fffff880048cc000 Limit fffff880048c6000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`048cb010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`048cb150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`048cb1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`048cb490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`048cb960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`048cbbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`048cbc20) 00000000`0174f3a8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0174f3b0 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0174f4b0 000007fe`f796d6ac kernel32!WaitForMultipleObjects+0xb0 00000000`0174f540 000007fe`f796d5bf fdwsd!CWsdWorker::WorkerMain+0xa0 00000000`0174f5b0 000007fe`fdb07e62 fdwsd!WorkerMainWithComContext+0x4b 00000000`0174f5f0 000007fe`fdb07b87 ole32!EnterForCallback+0x192 00000000`0174f730 000007fe`fdb3361c ole32!SwitchForCallback+0x387 00000000`0174f990 000007fe`fdb33139 ole32!PerformCallback+0x47c 00000000`0174fa60 000007fe`fdb51825 ole32!CObjectContext::InternalContextCallback+0x165 00000000`0174fb80 000007fe`fdb518c1 ole32!CObjectContext::ContextCallback+0x81 00000000`0174fc10 000007fe`f796d4b4 ole32!CContextSwitcher::ContextCallback+0x6d 00000000`0174fc50 00000000`776cf56d fdwsd!CWsdWorker::WorkerStart+0xec 00000000`0174fca0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0174fcd0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004ff7b60 Cid 0384.0be8 Teb: 000007fffff96000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004a46eb0 QueueObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a444f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 40279 Ticks: 11 (0:00:00:00.171) Context Switch Count 809 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880048e7db0 Current fffff880048e77d0 Base fffff880048e8000 Limit fffff880048e2000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`048e7810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`048e7950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`048e79e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`048e7a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`048e7b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`048e7c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`048e7c20) 00000000`024df668 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`024df670 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`024df970 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`024df9a0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005038810 Cid 0384.0908 Teb: 000007fffff94000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80044fc9c0 QueueObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a444f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 23862 Ticks: 16428 (0:00:04:16.278) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880048f5db0 Current fffff880048f57d0 Base fffff880048f6000 Limit fffff880048f0000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`048f5810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`048f5950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`048f59e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`048f5a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`048f5b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`048f5c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`048f5c20) 00000000`01effad8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`01effae0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`01effde0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01effe10 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005064b60 Cid 0384.0b18 Teb: 000007fffff90000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80044fc9c0 QueueObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a444f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 23862 Ticks: 16428 (0:00:04:16.278) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff8800490adb0 Current fffff8800490a7d0 Base fffff8800490b000 Limit fffff88004905000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0490a810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0490a950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0490a9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0490aa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0490ab20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0490ac20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0490ac20) 00000000`0228fab8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0228fac0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0228fdc0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0228fdf0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800501e630 Cid 0384.0990 Teb: 000007fffff8e000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80044fc9c0 QueueObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004a444f0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 24030 Ticks: 16260 (0:00:04:13.657) Context Switch Count 50 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004911db0 Current fffff880049117d0 Base fffff88004912000 Limit fffff8800490c000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04911810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04911950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`049119e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04911a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04911b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04911c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04911c20) 00000000`0260f928 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0260f930 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0260fc30 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0260fc60 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004a57b30 SessionId: 0 Cid: 03d4 Peb: 7fffffd4000 ParentCid: 0210 DirBase: 12360d000 ObjectTable: fffff8a0020c89b0 HandleCount: 294. Image: svchost.exe VadRoot fffffa8004a48950 Vads 149 Clone 0 Private 951. Modified 0. Locked 0. DeviceMap fffff8a000008c10 Token fffff8a0020c27b0 ElapsedTime 00:09:52.421 UserTime 00:00:00.015 KernelTime 00:00:00.093 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (2885, 50, 345) (11540KB, 200KB, 1380KB) PeakWorkingSetSize 2933 VirtualSize 71 Mb PeakVirtualSize 76 Mb PageFaultCount 3272 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 1128 Setting context for this process... .process /p /r fffffa8004a57b30 THREAD fffffa8004a5a060 Cid 03d4.03d8 Teb: 000007fffffde000 Win32Thread: fffff900c1c7e520 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a59940 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a57b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 12627 Ticks: 27663 (0:00:07:11.545) Context Switch Count 61 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address svchost!wmainCRTStartup (0x00000000ffa9246c) Stack Init fffff88004352db0 Current fffff88004352900 Base fffff88004353000 Limit fffff8800434c000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04352940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04352a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04352b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04352bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04352c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04352c20) 00000000`0020f9d8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0020f9e0 000007fe`ff4eaffb KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0020fa80 000007fe`ff4e9d61 sechost!ScSendResponseReceiveControls+0x13b 00000000`0020fb70 000007fe`ff4e9c16 sechost!ScDispatcherLoop+0x121 00000000`0020fc80 00000000`ffa91d3a sechost!StartServiceCtrlDispatcherW+0x14e 00000000`0020fcd0 00000000`ffa9257a svchost!wmain+0x110 00000000`0020fd00 00000000`776cf56d svchost!ScCreateWellKnownSids+0x2fd 00000000`0020fd40 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0020fd70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a5bb60 Cid 03d4.03dc Teb: 000007fffffdc000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004a59690 SynchronizationTimer fffffa8004a5b060 SynchronizationTimer fffffa8004a60790 NotificationEvent fffffa8004a673d0 SynchronizationEvent fffffa8004994e90 NotificationEvent fffffa80047b1aa0 SynchronizationEvent fffffa800493cd30 SynchronizationEvent fffffa800495fe30 SynchronizationEvent fffffa800495fdb0 SynchronizationEvent fffffa8004964830 SynchronizationEvent fffffa8004c288d0 SynchronizationTimer fffffa8004afdbf0 SynchronizationEvent fffffa8004c25470 SynchronizationEvent fffffa8004a0d530 Semaphore Limit 0x7fffffff fffffa8004c28850 SynchronizationEvent fffffa8004c26290 SynchronizationEvent fffffa8004c253f0 SynchronizationEvent fffffa8004c35690 SynchronizationEvent fffffa8004d3ab30 ProcessObject fffffa8004de69d0 SynchronizationEvent fffffa8004ea9d10 SynchronizationEvent fffffa8004e9d960 SynchronizationEvent fffffa8004e89790 SynchronizationEvent fffffa8004a5c060 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a57b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 13886 Ticks: 26404 (0:00:06:51.905) Context Switch Count 65 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff88004331db0 Current fffff88004330fd0 Base fffff88004332000 Limit fffff8800432c000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04331010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04331150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`043311e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04331490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04331960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04331bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04331c20) 00000000`00dcf788 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`00dcf790 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`00dcfa30 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00dcfa60 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a61060 Cid 03d4.03ec Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8004a61420 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a57b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 30879 Ticks: 9411 (0:00:02:26.812) Context Switch Count 40 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address uxsms!CPortBase::PortThread (0x000007fefbb3331c) Stack Init fffff88004367db0 Current fffff88004367790 Base fffff88004368000 Limit fffff88004362000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`043677d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04367910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`043679a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`04367a40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`04367aa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`04367b40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`04367be0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`04367c20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04367c20) 00000000`013cfcb8 000007fe`fbb31076 ntdll!NtReplyWaitReceivePort+0xa 00000000`013cfcc0 000007fe`fbb33325 uxsms!CPortBase::PortThreadInternal+0xbf 00000000`013cfd20 00000000`776cf56d uxsms!CPortBase::PortThread+0x9 00000000`013cfd50 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`013cfd80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a68840 Cid 03d4.0088 Teb: 000007fffffaa000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a68660 NotificationEvent fffffa8004a65290 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a57b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 2404 Ticks: 37886 (0:00:09:51.025) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address WUDFPlatform!CPlatformThread::ThreadStartup (0x000007fefbad31e4) Stack Init fffff88004359db0 Current fffff88004359300 Base fffff8800435a000 Limit fffff88004354000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04359340 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04359480 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04359510 fffff880`037876e2 nt!KeWaitForMultipleObjects+0x271 fffff880`043597c0 fffff880`037860bf WudfPf!LpcControlDevice::GetMessage+0xc2 fffff880`04359840 fffff880`03786de8 WudfPf!LpcDevice::FastIoDeviceIoControl+0x16b fffff880`043598d0 fffff880`03784e15 WudfPf!LpcControlDevice::FastIoDeviceIoControl+0xec fffff880`043599b0 fffff800`01da7473 WudfPf!LpcDriver::s_FastIoDeviceDispatch+0xf9 fffff880`04359a10 fffff800`01da7f66 nt!IopXxxControlFile+0x373 fffff880`04359b40 fffff800`01a8b993 nt!NtDeviceIoControlFile+0x56 fffff880`04359bb0 00000000`7781ff2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04359c20) 00000000`012dfb58 000007fe`fdab53d6 ntdll!NtDeviceIoControlFile+0xa 00000000`012dfb60 00000000`776c610f KERNELBASE!TlsGetValue+0x1a36 00000000`012dfbd0 000007fe`fbaddd94 kernel32!DeviceIoControlImplementation+0x7f 00000000`012dfc20 000007fe`fbade6cd WUDFPlatform!WPP_SF_ssd+0x1e4 00000000`012dfcb0 000007fe`fbadb8af WUDFPlatform!WdfLpcCorePortInterface::GetMessageW+0x119 00000000`012dfe60 000007fe`fbada507 WUDFPlatform!WdfWorkerThread::WorkerThread+0x127 00000000`012dfeb0 000007fe`fbad3241 WUDFPlatform!WdfLpc::s_WorkerThread+0x13 00000000`012dfee0 00000000`776cf56d WUDFPlatform!CPlatformThread::ThreadStartup+0x5d 00000000`012dff10 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`012dff40 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004ac3b60 Cid 03d4.03d0 Teb: 000007fffffac000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Non-Alertable fffffa8004211060 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a57b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 2615 Ticks: 37675 (0:00:09:47.733) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address audiosrv!EventWorkerThread (0x000007fefb15f440) Stack Init fffff8800443adb0 Current fffff8800443a7b0 Base fffff8800443b000 Limit fffff88004435000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0443a7f0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0443a930 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0443a9c0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0443aa70 fffff800`01d479a5 nt!IoRemoveIoCompletion+0x47 fffff880`0443ab00 fffff800`01a8b993 nt!NtRemoveIoCompletion+0x145 fffff880`0443abb0 00000000`7781ff4a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0443ac20) 00000000`0165fb58 000007fe`fda9162d ntdll!ZwRemoveIoCompletion+0xa 00000000`0165fb60 00000000`776bbd81 KERNELBASE!GetQueuedCompletionStatus+0x39 00000000`0165fbc0 000007fe`fb15f48e kernel32!GetQueuedCompletionStatusStub+0x11 00000000`0165fc00 00000000`776cf56d audiosrv!EventWorkerThread+0xb1 00000000`0165fc40 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0165fc70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004ac3060 Cid 03d4.0108 Teb: 000007fffffa6000 Win32Thread: fffff900c1c84010 WAIT: (UserRequest) UserMode Alertable fffffa8004209e10 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a57b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 2747 Ticks: 37543 (0:00:09:45.674) Context Switch Count 26 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address MMDevAPI!CDeviceEnumerator::PnpNotificationThreadWrapper (0x000007fefb8b6204) Stack Init fffff88004498db0 Current fffff88004497fd0 Base fffff88004499000 Limit fffff88004491000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04498010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04498150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`044981e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04498490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04498960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04498bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04498c20) 00000000`0036f5f8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0036f600 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0036f700 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0036f790 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`0036f830 000007fe`fb8b35be USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`0036f870 00000000`776cf56d MMDevAPI!CDeviceEnumerator::PnpNotificationThread+0x3d8 00000000`0036f9c0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0036f9f0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a17b60 Cid 03d4.0298 Teb: 000007fffffa4000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa800493ca20 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a57b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 2650 Ticks: 37640 (0:00:09:47.187) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff8800447edb0 Current fffff8800447e7d0 Base fffff8800447f000 Limit fffff88004479000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0447e810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0447e950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0447e9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0447ea90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0447eb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0447ec20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0447ec20) 00000000`014ff9b8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`014ff9c0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`014ffcc0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`014ffcf0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004aef060 Cid 03d4.0458 Teb: 000007fffffa8000 Win32Thread: fffff900c1c99850 WAIT: (WrQueue) UserMode Alertable fffffa8004a551b0 QueueObject IRP List: fffffa80043ff430: (0006,03a0) Flags: 00060800 Mdl: 00000000 fffffa80043b9500: (0006,03a0) Flags: 00060000 Mdl: 00000000 fffffa8004450010: (0006,03a0) Flags: 00060800 Mdl: 00000000 fffffa8004434c60: (0006,03a0) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a57b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 29663 Ticks: 10627 (0:00:02:45.782) Context Switch Count 583 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.031 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004396db0 Current fffff880043967d0 Base fffff88004397000 Limit fffff88004391000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04396810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04396950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`043969e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04396a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04396b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04396c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04396c20) 00000000`0146fbc8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0146fbd0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0146fed0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0146ff00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004ea0060 Cid 03d4.0874 Teb: 000007fffff9a000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Non-Alertable fffffa8004e71a10 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a57b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 6540 Ticks: 33750 (0:00:08:46.503) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address mswsock!SockAsyncThread (0x000007fefccdda90) Stack Init fffff880051a0db0 Current fffff880051a07b0 Base fffff880051a1000 Limit fffff8800519b000 Call 0 Priority 9 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`051a07f0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`051a0930 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`051a09c0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`051a0a70 fffff800`01d479a5 nt!IoRemoveIoCompletion+0x47 fffff880`051a0b00 fffff800`01a8b993 nt!NtRemoveIoCompletion+0x145 fffff880`051a0bb0 00000000`7781ff4a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`051a0c20) 00000000`0170fcf8 000007fe`fccd5691 ntdll!ZwRemoveIoCompletion+0xa 00000000`0170fd00 00000000`776cf56d mswsock!SockAsyncThread+0xa2 00000000`0170fd60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0170fd90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80050b3b60 Cid 03d4.0260 Teb: 000007fffffda000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa80050ac450 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004a57b30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 11897 Ticks: 28393 (0:00:07:22.933) Context Switch Count 29 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff88005745db0 Current fffff88005745900 Base fffff88005746000 Limit fffff88005740000 Call 0 Priority 9 BasePriority 8 UnusualBoost 1 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05745940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05745a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05745b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05745bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05745c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05745c20) 00000000`00ebf648 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`00ebf650 000007fe`f1d23232 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`00ebf6f0 000007fe`f1d2318f wdi!WdipControlServer+0x26 00000000`00ebf750 000007fe`f1d22fbc wdi!WdipTriggerHost+0x223 00000000`00ebf7a0 00000000`ffa91344 wdi!ServiceMain+0x108 00000000`00ebf7e0 000007fe`ff4ea82d svchost!ServiceStarter+0x1e8 00000000`00ebf870 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`00ebf8a0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00ebf8d0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004a7c590 SessionId: 0 Cid: 012c Peb: 7fffffdf000 ParentCid: 0210 DirBase: 122fd3000 ObjectTable: fffff8a0020ecf90 HandleCount: 457. Image: svchost.exe VadRoot fffffa8004a7ab20 Vads 218 Clone 0 Private 1629. Modified 71. Locked 5. DeviceMap fffff8a001f05400 Token fffff8a0020e1940 ElapsedTime 00:09:51.001 UserTime 00:00:00.062 KernelTime 00:00:00.327 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (4057, 50, 345) (16228KB, 200KB, 1380KB) PeakWorkingSetSize 4080 VirtualSize 118 Mb PeakVirtualSize 121 Mb PageFaultCount 5945 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 2802 Setting context for this process... .process /p /r fffffa8004a7c590 THREAD fffffa8004a718a0 Cid 012c.0128 Teb: 000007fffffdd000 Win32Thread: fffff900c1c81900 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a7fcd0 SynchronizationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004a7c590 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 23870 Ticks: 16420 (0:00:04:16.153) Context Switch Count 57 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address svchost!wmainCRTStartup (0x00000000ffa9246c) Stack Init fffff880043c9db0 Current fffff880043c9900 Base fffff880043ca000 Limit fffff880043c3000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`043c9940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`043c9a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`043c9b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`043c9bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`043c9c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`043c9c20) 00000000`0014f458 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0014f460 000007fe`ff4eaffb KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0014f500 000007fe`ff4e9d61 sechost!ScSendResponseReceiveControls+0x13b 00000000`0014f5f0 000007fe`ff4e9c16 sechost!ScDispatcherLoop+0x121 00000000`0014f700 00000000`ffa91d3a sechost!StartServiceCtrlDispatcherW+0x14e 00000000`0014f750 00000000`ffa9257a svchost!wmain+0x110 00000000`0014f780 00000000`776cf56d svchost!ScCreateWellKnownSids+0x2fd 00000000`0014f7c0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0014f7f0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a7e060 Cid 012c.0130 Teb: 000007fffffdb000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004a7d920 SynchronizationTimer fffffa8004b091e0 SynchronizationEvent fffffa8004a7da90 SynchronizationTimer fffffa8004a89da0 SynchronizationEvent fffffa8004a966d0 SynchronizationEvent fffffa8004a8edd0 SynchronizationEvent fffffa8004b21240 NotificationEvent fffffa8004ac7e60 SynchronizationEvent fffffa8004bdb1f0 NotificationEvent fffffa8004c043f0 NotificationEvent fffffa8004c11910 SynchronizationEvent fffffa8004c12370 SynchronizationEvent fffffa8004c13af0 SynchronizationEvent fffffa8004ab6700 SynchronizationEvent fffffa8004c12b60 SynchronizationEvent fffffa8004c11fe0 SynchronizationEvent fffffa8004a8c670 SynchronizationEvent fffffa8004bf71b0 SynchronizationEvent fffffa8004c0d780 SynchronizationEvent fffffa8004c0eee0 SynchronizationEvent fffffa8004c0ece0 SynchronizationEvent fffffa8004c12d60 SynchronizationEvent fffffa8004c1e280 SynchronizationEvent fffffa8004cbd710 SynchronizationEvent fffffa8004cbd1c0 SynchronizationEvent fffffa8004cbd140 SynchronizationEvent fffffa8004cbd510 SynchronizationEvent fffffa8004cbd410 SynchronizationEvent fffffa8004ab72f0 SynchronizationEvent fffffa8004b21100 SynchronizationEvent fffffa8004a8eab0 SynchronizationEvent fffffa8004ac7f60 SynchronizationEvent fffffa8004a8cc00 SynchronizationEvent fffffa8004b7c7e0 SynchronizationEvent fffffa8004b7ac20 SynchronizationEvent fffffa8005068cb0 SynchronizationEvent fffffa8004fe85f0 SynchronizationEvent fffffa8004cb0420 SynchronizationEvent fffffa8005067d80 SynchronizationEvent fffffa8005067b78 NotificationEvent fffffa8005095e00 SynchronizationEvent fffffa8004c7daa0 SynchronizationEvent fffffa8005052900 SynchronizationEvent fffffa8004dcacd0 SynchronizationEvent fffffa8004c92e00 SynchronizationEvent fffffa8004c0e060 SynchronizationEvent fffffa8004a7d7b0 SynchronizationTimer Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004a7c590 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 40273 Ticks: 17 (0:00:00:00.265) Context Switch Count 1010 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff880043b6db0 Current fffff880043b5fd0 Base fffff880043b7000 Limit fffff880043b1000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`043b6010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`043b6150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`043b61e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`043b6490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`043b6960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`043b6bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`043b6c20) 00000000`00dcfc58 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`00dcfc60 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`00dcff00 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00dcff30 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a88b60 Cid 012c.0140 Teb: 000007fffffd3000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a878c0 NotificationEvent fffffa8004a89ab8 NotificationEvent fffffa8004a89990 SynchronizationEvent fffffa8004a89890 SynchronizationEvent IRP List: fffffa8004441670: (0006,03a0) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004a7c590 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 21696 Ticks: 18594 (0:00:04:50.068) Context Switch Count 18 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address dnsrslvr!NotifyThread (0x000007fefb6c3260) Stack Init fffff880043ecdb0 Current fffff880043ebfd0 Base fffff880043ed000 Limit fffff880043e7000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`043ec010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`043ec150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`043ec1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`043ec490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`043ec960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`043ecbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`043ecc20) 00000000`014ef6a8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`014ef6b0 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`014ef7b0 000007fe`fb6c3530 kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`014ef840 00000000`776cf56d dnsrslvr!NotifyThread+0x3d7 00000000`014efcf0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`014efd20 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a8e400 Cid 012c.0180 Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a91a40 NotificationEvent fffffa8004a878c0 NotificationEvent IRP List: fffffa8004a6f380: (0006,01f0) Flags: 00060030 Mdl: 00000000 Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004a7c590 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 5361 Ticks: 34929 (0:00:09:04.895) Context Switch Count 17 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address dnsrslvr!Ip_NotifyThread (0x000007fefb6c3aac) Stack Init fffff88002f47db0 Current fffff88002f46fd0 Base fffff88002f48000 Limit fffff88002f42000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`02f47010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02f47150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`02f471e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`02f47490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`02f47960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`02f47bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02f47c20) 00000000`0159f918 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0159f920 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0159fa20 000007fe`fb6c3ce6 kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0159fab0 00000000`776cf56d dnsrslvr!Ip_NotifyThread+0x3f4 00000000`0159fb90 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0159fbc0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a91b60 Cid 012c.000c Teb: 000007fffffac000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a8e380 SynchronizationEvent fffffa8004a8e300 SynchronizationEvent fffffa8004a91060 SynchronizationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004a7c590 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3814 Ticks: 36476 (0:00:09:29.029) Context Switch Count 43 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address dnsrslvr!ProcessIpChangeNotificationRequestThread (0x000007fefb6c46d0) Stack Init fffff88002ff8db0 Current fffff88002ff7fd0 Base fffff88002ff9000 Limit fffff88002ff3000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`02ff8010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02ff8150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`02ff81e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`02ff8490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`02ff8960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`02ff8bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02ff8c20) 00000000`0130f7e8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0130f7f0 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0130f8f0 000007fe`fb6c46b7 kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0130f980 00000000`776cf56d dnsrslvr!ProcessIpChangeNotificationRequestThread+0x117 00000000`0130f9e0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0130fa10 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a91270 Cid 012c.01a4 Teb: 000007fffffaa000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a91870 NotificationEvent fffffa8004a917f0 NotificationEvent fffffa8004a91770 NotificationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004a7c590 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3468 Ticks: 36822 (0:00:09:34.426) Context Switch Count 147 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address dnsrslvr!Mcast_Thread (0x000007fefb6c3864) Stack Init fffff88004220db0 Current fffff8800421ffd0 Base fffff88004221000 Limit fffff8800421b000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04220010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04220150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`042201e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04220490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04220960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04220bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04220c20) 00000000`016ef898 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`016ef8a0 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`016ef9a0 000007fe`fb6c38f2 kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`016efa30 00000000`776cf56d dnsrslvr!Mcast_Thread+0x120 00000000`016efaa0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`016efad0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004adba60 Cid 012c.0444 Teb: 000007fffffa8000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004abca40 SynchronizationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004a7c590 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3814 Ticks: 36476 (0:00:09:29.029) Context Switch Count 51 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address dnsrslvr!Areg_RegistrationThread (0x000007fefb6c5cd0) Stack Init fffff88004557db0 Current fffff88004557900 Base fffff88004558000 Limit fffff88004552000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04557940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04557a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04557b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04557bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04557c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04557c20) 00000000`00cffc08 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`00cffc10 000007fe`fb6c5da1 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`00cffcb0 00000000`776cf56d dnsrslvr!Areg_RegistrationThread+0x131 00000000`00cffd30 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00cffd60 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004b24a50 Cid 012c.049c Teb: 000007fffffa4000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004af5de0 QueueObject IRP List: fffffa8004c44010: (0006,03a0) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004a7c590 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 12671 Ticks: 27619 (0:00:07:10.859) Context Switch Count 38 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880044a6db0 Current fffff880044a67d0 Base fffff880044a7000 Limit fffff880044a1000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`044a6810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`044a6950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`044a69e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`044a6a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`044a6b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`044a6c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`044a6c20) 00000000`01b5f958 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`01b5f960 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`01b5fc60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01b5fc90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004b25060 Cid 012c.04a4 Teb: 000007fffffa6000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004a7dd10 QueueObject IRP List: fffffa8003f9e6b0: (0006,0118) Flags: 00060000 Mdl: 00000000 fffffa8004afb8a0: (0006,0118) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004a7c590 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 40273 Ticks: 17 (0:00:00:00.265) Context Switch Count 1160 UserTime 00:00:00.031 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880045d6db0 Current fffff880045d67d0 Base fffff880045d7000 Limit fffff880045d1000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`045d6810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`045d6950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`045d69e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`045d6a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`045d6b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`045d6c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`045d6c20) 00000000`01a5f548 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`01a5f550 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`01a5f850 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01a5f880 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004c12490 Cid 012c.059c Teb: 000007fffff98000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004c12a10 SynchronizationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004a7c590 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3472 Ticks: 36818 (0:00:09:34.364) Context Switch Count 49 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address nlasvc!QueueMonitor (0x000007fefa8af978) Stack Init fffff8800499bdb0 Current fffff8800499b900 Base fffff8800499c000 Limit fffff88004996000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0499b940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0499ba80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0499bb10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`0499bbb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`0499bc20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0499bc20) 00000000`0213fe08 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0213fe10 000007fe`fa8af9ec KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0213feb0 00000000`776cf56d nlasvc!QueueMonitor+0x2bb 00000000`0213ff20 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0213ff50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004c42990 Cid 012c.06c4 Teb: 000007fffffd5000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004c40f60 NotificationEvent fffffa8004b5bea0 NotificationEvent fffffa8004c30f60 NotificationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004a7c590 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 24416 Ticks: 15874 (0:00:04:07.635) Context Switch Count 26 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address dnsrslvr!Responder_Thread (0x000007fefb6c3980) Stack Init fffff88004d30db0 Current fffff88004d2ffd0 Base fffff88004d31000 Limit fffff88004d2b000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04d30010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04d30150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04d301e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04d30490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04d30960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04d30bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04d30c20) 00000000`02bcf798 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`02bcf7a0 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`02bcf8a0 000007fe`fb6c3a40 kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`02bcf930 00000000`776cf56d dnsrslvr!Responder_Thread+0x180 00000000`02bcf970 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`02bcf9a0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004c20b60 Cid 012c.06f4 Teb: 000007fffff8c000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004b7e450 SynchronizationEvent fffffa8004bee300 SynchronizationEvent fffffa8004b7e3d0 NotificationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004a7c590 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3502 Ticks: 36788 (0:00:09:33.896) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address msvcrt!endthreadex (0x000007fefdd173fc) Stack Init fffff880049ccdb0 Current fffff880049cbfd0 Base fffff880049cd000 Limit fffff880049c7000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`049cc010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`049cc150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`049cc1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`049cc490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`049cc960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`049ccbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`049ccc20) 00000000`029af578 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`029af580 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`029af680 000007fe`fa869f36 kernel32!WaitForMultipleObjects+0xb0 00000000`029af710 000007fe`fdd142bf ncsi!CNcsiConfigData::MonitorRegistry+0x28a 00000000`029af780 000007fe`fdd17459 msvcrt!endthreadex+0x47 00000000`029af7b0 00000000`776cf56d msvcrt!endthreadex+0xe0 00000000`029af7e0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`029af810 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004cfd060 Cid 012c.07e8 Teb: 000007fffff88000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Non-Alertable fffffa8004cf2930 QueueObject Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004a7c590 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3770 Ticks: 36520 (0:00:09:29.715) Context Switch Count 25 UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address ESENT!UtilThreadIThreadBase (0x000007fef947fd00) Stack Init fffff88004ff4db0 Current fffff88004ff47b0 Base fffff88004ff5000 Limit fffff88004fef000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04ff47f0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04ff4930 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04ff49c0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04ff4a70 fffff800`01d479a5 nt!IoRemoveIoCompletion+0x47 fffff880`04ff4b00 fffff800`01a8b993 nt!NtRemoveIoCompletion+0x145 fffff880`04ff4bb0 00000000`7781ff4a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04ff4c20) 00000000`04fbf758 000007fe`fda9162d ntdll!ZwRemoveIoCompletion+0xa 00000000`04fbf760 00000000`776bbd81 KERNELBASE!GetQueuedCompletionStatus+0x39 00000000`04fbf7c0 000007fe`f94a8d79 kernel32!GetQueuedCompletionStatusStub+0x11 00000000`04fbf800 000007fe`f947ff31 ESENT!CTaskManager::TMIDispatch+0x185 00000000`04fbf860 000007fe`f947fd25 ESENT!CTaskManager::TMDispatch+0x11 00000000`04fbf890 00000000`776cf56d ESENT!UtilThreadIThreadBase+0x21 00000000`04fbf8d0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`04fbf900 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004c4a500 Cid 012c.0898 Teb: 000007fffff9c000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004efba10 SynchronizationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004a7c590 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 12675 Ticks: 27615 (0:00:07:10.796) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address wsmsvc!ComLifetime_Thread::ThreadExecutionProcedure (0x000007fef1586d90) Stack Init fffff88002fdedb0 Current fffff88002fddfd0 Base fffff88002fdf000 Limit fffff88002fd9000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`02fde010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02fde150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`02fde1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`02fde490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`02fde960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`02fdebb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02fdec20) 00000000`04eaf668 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`04eaf670 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`04eaf770 000007fe`f1586dee kernel32!WaitForMultipleObjects+0xb0 00000000`04eaf800 00000000`776cf56d wsmsvc!ComLifetime_Thread::ThreadExecutionProcedure+0x5e 00000000`04eaf830 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`04eaf860 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004c7e060 Cid 012c.0ab4 Teb: 000007fffff9a000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8005052880 SynchronizationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004a7c590 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 12717 Ticks: 27573 (0:00:07:10.141) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address wevtfwd!RegistryMonitor::WaitThreadRoutine (0x000007fef1941f08) Stack Init fffff88005914db0 Current fffff88005914900 Base fffff88005915000 Limit fffff8800590f000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05914940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05914a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05914b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05914bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05914c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05914c20) 00000000`0545fb58 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0545fb60 000007fe`f1942011 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0545fc00 00000000`776cf56d wevtfwd!RegistryMonitor::WaitThreadRoutine+0x109 00000000`0545fcb0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0545fce0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005368910 Cid 012c.0bd4 Teb: 000007fffffa2000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004a7dd10 QueueObject Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004a7c590 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 40273 Ticks: 17 (0:00:00:00.265) Context Switch Count 174 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880045f9db0 Current fffff880045f97d0 Base fffff880045fa000 Limit fffff880045f4000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`045f9810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`045f9950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`045f99e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`045f9a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`045f9b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`045f9c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`045f9c20) 00000000`0251fb98 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0251fba0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0251fea0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0251fed0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80053e9b60 Cid 012c.0b38 Teb: 000007fffffd9000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004a7dd10 QueueObject Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004a7c590 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 38671 Ticks: 1619 (0:00:00:25.256) Context Switch Count 38 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880043afdb0 Current fffff880043af7d0 Base fffff880043b0000 Limit fffff880043aa000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`043af810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`043af950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`043af9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`043afa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`043afb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`043afc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`043afc20) 00000000`01c3f978 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`01c3f980 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`01c3fc80 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01c3fcb0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004aca060 SessionId: 0 Cid: 040c Peb: 7fffffd3000 ParentCid: 0334 DirBase: 1212b3000 ObjectTable: fffff8a002143510 HandleCount: 141. Image: audiodg.exe VadRoot fffffa8004964690 Vads 91 Clone 0 Private 2593. Modified 92. Locked 0. DeviceMap fffff8a002020e00 Token fffff8a002147060 ElapsedTime 00:09:47.569 UserTime 00:00:00.093 KernelTime 00:00:00.202 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (3960, 2915, 3431) (15840KB, 11660KB, 13724KB) PeakWorkingSetSize 4177 VirtualSize 52 Mb PeakVirtualSize 54 Mb PageFaultCount 14382 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 4003 Setting context for this process... .process /p /r fffffa8004aca060 THREAD fffffa8004acab60 Cid 040c.0410 Teb: 000007fffffde000 Win32Thread: fffff900c1c85c30 WAIT: (UserRequest) UserMode Non-Alertable fffffa800492c1b0 NotificationEvent fffffa8004a1b740 ProcessObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004aca060 Image: audiodg.exe Attached Process N/A Image: N/A Wait Start TickCount 2675 Ticks: 37615 (0:00:09:46.797) Context Switch Count 49 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.046 Win32 Start Address AUDIODG!wWinMainCRTStartup (0x00000000ffe16994) Stack Init fffff880044eddb0 Current fffff880044ecfd0 Base fffff880044ee000 Limit fffff880044e5000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`044ed010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`044ed150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`044ed1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`044ed490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`044ed960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`044edbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`044edc20) 00000000`0026f6a8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0026f6b0 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0026f7b0 00000000`ffe04c0c kernel32!WaitForMultipleObjects+0xb0 00000000`0026f840 00000000`ffe0580d AUDIODG!CAudioDGModule::RunMessageLoop+0xc8 00000000`0026f880 00000000`ffe16822 AUDIODG!wWinMain+0x219 00000000`0026f900 00000000`776cf56d AUDIODG!VPOHANDLE_rundown+0x20a 00000000`0026f9c0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0026f9f0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004acd740 Cid 040c.041c Teb: 000007fffffda000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004928060 SynchronizationTimer fffffa800486ae10 SynchronizationTimer fffffa8004ace060 SynchronizationTimer Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004aca060 Image: audiodg.exe Attached Process N/A Image: N/A Wait Start TickCount 38871 Ticks: 1419 (0:00:00:22.136) Context Switch Count 98 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff880044dadb0 Current fffff880044d9fd0 Base fffff880044db000 Limit fffff880044d5000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`044da010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`044da150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`044da1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`044da490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`044da960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`044dabb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`044dac20) 00000000`00a1f768 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`00a1f770 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`00a1fa10 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00a1fa40 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004fd8930 Cid 040c.0820 Teb: 000007fffffdc000 Win32Thread: fffff900c1cbb520 WAIT: (WrQueue) UserMode Alertable fffffa8004acb390 QueueObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004aca060 Image: audiodg.exe Attached Process N/A Image: N/A Wait Start TickCount 38872 Ticks: 1418 (0:00:00:22.120) Context Switch Count 1771 LargeStack UserTime 00:00:00.078 KernelTime 00:00:00.062 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005518db0 Current fffff880055187d0 Base fffff88005519000 Limit fffff88005512000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05518810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05518950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`055189e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05518a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05518b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05518c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05518c20) 00000000`0205fc28 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0205fc30 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0205ff30 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0205ff60 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800510a490 Cid 040c.0a30 Teb: 000007fffffd6000 Win32Thread: fffff900c1ca5010 WAIT: (WrQueue) UserMode Alertable fffffa8004acb390 QueueObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004aca060 Image: audiodg.exe Attached Process N/A Image: N/A Wait Start TickCount 38774 Ticks: 1516 (0:00:00:23.649) Context Switch Count 1975 LargeStack UserTime 00:00:00.031 KernelTime 00:00:00.109 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff8800521ddb0 Current fffff8800521d7d0 Base fffff8800521e000 Limit fffff88005217000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0521d810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0521d950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0521d9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0521da90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0521db20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0521dc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0521dc20) 00000000`00e6f678 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`00e6f680 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`00e6f980 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00e6f9b0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80050a0060 Cid 040c.0a18 Teb: 000007fffffd4000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa80050a0420 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004aca060 Image: audiodg.exe Attached Process N/A Image: N/A Wait Start TickCount 39286 Ticks: 1004 (0:00:00:15.662) Context Switch Count 9 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ole32!CRpcThreadCache::RpcWorkerThreadEntry (0x000007fefdb23570) Stack Init fffff88004d80db0 Current fffff88004d80970 Base fffff88004d81000 Limit fffff88004d7b000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04d809b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04d80af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`04d80b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`04d80bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`04d80c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04d80c20) 00000000`021af7e8 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`021af7f0 000007fe`fdb1ea00 KERNELBASE!SleepEx+0xab 00000000`021af890 000007fe`fdb22046 ole32!CROIDTable::WorkerThreadLoop+0x10 00000000`021af8c0 000007fe`fdb2358a ole32!CRpcThread::WorkerLoop+0x1e 00000000`021af900 00000000`776cf56d ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1a 00000000`021af930 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`021af960 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004f7a060 Cid 040c.02e0 Teb: 000007fffffae000 Win32Thread: fffff900c1cb8010 WAIT: (WrQueue) UserMode Alertable fffffa8004acb390 QueueObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004aca060 Image: audiodg.exe Attached Process N/A Image: N/A Wait Start TickCount 38896 Ticks: 1394 (0:00:00:21.746) Context Switch Count 491 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005a5edb0 Current fffff88005a5e7d0 Base fffff88005a5f000 Limit fffff88005a58000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05a5e810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05a5e950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`05a5e9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05a5ea90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05a5eb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05a5ec20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05a5ec20) 00000000`0238f5a8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0238f5b0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0238f8b0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0238f8e0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80053ee700 Cid 040c.064c Teb: 000007fffffac000 Win32Thread: fffff900c1c8b720 WAIT: (WrQueue) UserMode Alertable fffffa8004acb390 QueueObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004aca060 Image: audiodg.exe Attached Process N/A Image: N/A Wait Start TickCount 38082 Ticks: 2208 (0:00:00:34.445) Context Switch Count 528 LargeStack UserTime 00:00:00.031 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005bacdb0 Current fffff88005bac7d0 Base fffff88005bad000 Limit fffff88005ba6000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05bac810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05bac950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`05bac9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05baca90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05bacb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05bacc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05bacc20) 00000000`0224f6b8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0224f6c0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0224f9c0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0224f9f0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa800495db30 SessionId: 0 Cid: 042c Peb: 7fffffdf000 ParentCid: 0210 DirBase: 1208ac000 ObjectTable: fffff8a002157140 HandleCount: 307. Image: svchost.exe VadRoot fffffa8004aada10 Vads 141 Clone 0 Private 1410. Modified 290. Locked 0. DeviceMap fffff8a002020e00 Token fffff8a0021768b0 ElapsedTime 00:09:47.242 UserTime 00:00:00.218 KernelTime 00:00:00.171 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (3118, 50, 345) (12472KB, 200KB, 1380KB) PeakWorkingSetSize 3161 VirtualSize 52 Mb PeakVirtualSize 53 Mb PageFaultCount 4316 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 1938 Setting context for this process... .process /p /r fffffa800495db30 THREAD fffffa8004ad3810 Cid 042c.0430 Teb: 000007fffffdd000 Win32Thread: fffff900c1c88c30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004ad41a0 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa800495db30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 23867 Ticks: 16423 (0:00:04:16.200) Context Switch Count 39 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.000 Win32 Start Address svchost!wmainCRTStartup (0x00000000ffa9246c) Stack Init fffff88004549db0 Current fffff88004549900 Base fffff8800454a000 Limit fffff88004544000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04549940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04549a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04549b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04549bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04549c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04549c20) 00000000`001ffac8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`001ffad0 000007fe`ff4eaffb KERNELBASE!WaitForSingleObjectEx+0x79 00000000`001ffb70 000007fe`ff4e9d61 sechost!ScSendResponseReceiveControls+0x13b 00000000`001ffc60 000007fe`ff4e9c16 sechost!ScDispatcherLoop+0x121 00000000`001ffd70 00000000`ffa91d3a sechost!StartServiceCtrlDispatcherW+0x14e 00000000`001ffdc0 00000000`ffa9257a svchost!wmain+0x110 00000000`001ffdf0 00000000`776cf56d svchost!ScCreateWellKnownSids+0x2fd 00000000`001ffe30 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`001ffe60 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004ad46c0 Cid 042c.0434 Teb: 000007fffffdb000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004ad4bc0 SynchronizationTimer fffffa8004ad4d30 SynchronizationTimer fffffa8004a949f0 SynchronizationEvent fffffa8004ae1940 SynchronizationEvent fffffa8004ad8860 SynchronizationEvent fffffa8004935830 SynchronizationEvent fffffa8004aea780 SynchronizationEvent fffffa8004b01e80 SynchronizationEvent fffffa8004aef9b0 SynchronizationEvent fffffa8004b027a0 SynchronizationEvent fffffa8004b04750 SynchronizationEvent fffffa8004b05530 SynchronizationTimer fffffa8004b053c0 SynchronizationTimer fffffa8004b09ee0 SynchronizationEvent fffffa8004b06940 SynchronizationEvent fffffa8004af00f0 SynchronizationEvent fffffa8004b05ee0 SynchronizationEvent fffffa8004b04e10 SynchronizationEvent fffffa8004b03780 SynchronizationEvent fffffa8004b05340 SynchronizationEvent fffffa8004b067c0 SynchronizationEvent fffffa8004ee4160 SynchronizationEvent fffffa8004ad44b0 SynchronizationTimer Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa800495db30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 24671 Ticks: 15619 (0:00:04:03.657) Context Switch Count 107 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff8800452fdb0 Current fffff8800452efd0 Base fffff88004530000 Limit fffff8800452a000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0452f010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0452f150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0452f1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`0452f490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`0452f960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`0452fbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0452fc20) 00000000`00e8f4d8 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`00e8f4e0 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`00e8f780 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00e8f7b0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004ad6950 Cid 042c.043c Teb: 000007fffffd7000 Win32Thread: fffff900c1c99c30 WAIT: (WrQueue) UserMode Alertable fffffa8004ad4fb0 QueueObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa800495db30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 38017 Ticks: 2273 (0:00:00:35.459) Context Switch Count 1664 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.109 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004578db0 Current fffff880045787d0 Base fffff88004579000 Limit fffff88004572000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04578810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04578950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`045789e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04578a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04578b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04578c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04578c20) 00000000`0017fac8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0017fad0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0017fdd0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0017fe00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004ae0610 Cid 042c.0448 Teb: 000007fffffd3000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004956230 NotificationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa800495db30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 2698 Ticks: 37592 (0:00:09:46.438) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address AUTHZ!AuthzpDeQueueThreadWorker (0x000007fefcf01a70) Stack Init fffff880043f3db0 Current fffff880043f3900 Base fffff880043f4000 Limit fffff880043ee000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`043f3940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`043f3a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`043f3b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`043f3bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`043f3c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`043f3c20) 00000000`00d3f7f8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`00d3f800 000007fe`fcf01a99 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`00d3f8a0 00000000`776cf56d AUTHZ!AuthzpDeQueueThreadWorker+0x29 00000000`00d3f8d0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00d3f900 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004aeb740 Cid 042c.0454 Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8003bc7e00 NotificationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa800495db30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 2733 Ticks: 37557 (0:00:09:45.892) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address AUTHZ!AuthzpDeQueueThreadWorker (0x000007fefcf01a70) Stack Init fffff88004565db0 Current fffff88004565900 Base fffff88004566000 Limit fffff88004560000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04565940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04565a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04565b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04565bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04565c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04565c20) 00000000`0161fbc8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0161fbd0 000007fe`fcf01a99 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0161fc70 00000000`776cf56d AUTHZ!AuthzpDeQueueThreadWorker+0x29 00000000`0161fca0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0161fcd0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004aed580 Cid 042c.0464 Teb: 000007fffffac000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004aedb80 NotificationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa800495db30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3608 Ticks: 36682 (0:00:09:32.242) Context Switch Count 124 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address AUTHZ!AuthzpDeQueueThreadWorker (0x000007fefcf01a70) Stack Init fffff88004020db0 Current fffff88004020900 Base fffff88004021000 Limit fffff8800401b000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04020940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04020a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04020b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04020bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04020c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04020c20) 00000000`013cfc88 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`013cfc90 000007fe`fcf01a99 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`013cfd30 00000000`776cf56d AUTHZ!AuthzpDeQueueThreadWorker+0x29 00000000`013cfd60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`013cfd90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004af4960 Cid 042c.046c Teb: 000007fffffd5000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004aef590 SynchronizationEvent fffffa8004afba20 NotificationEvent fffffa8004afb870 NotificationEvent fffffa8004afbaa0 NotificationEvent fffffa8003f9e830 NotificationEvent IRP List: fffffa8004c133d0: (0006,0118) Flags: 00060070 Mdl: 00000000 fffffa8004c16c50: (0006,0118) Flags: 00060070 Mdl: 00000000 fffffa8004c19430: (0006,0118) Flags: 00060070 Mdl: 00000000 fffffa8004b522d0: (0006,0118) Flags: 00060070 Mdl: 00000000 Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa800495db30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3438 Ticks: 36852 (0:00:09:34.894) Context Switch Count 14 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address mpssvc!WPP_SF_qd (0x000007fefad42920) Stack Init fffff88004599db0 Current fffff88004598fd0 Base fffff8800459a000 Limit fffff88004594000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04599010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04599150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`045991e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04599490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04599960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04599bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04599c20) 00000000`0156fb38 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0156fb40 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0156fc40 000007fe`fad42ac6 kernel32!WaitForMultipleObjects+0xb0 00000000`0156fcd0 00000000`776cf56d mpssvc!WPP_SF_qd+0x2e4 00000000`0156fdd0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0156fe00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004aff060 Cid 042c.0470 Teb: 000007fffffa8000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8003f9e2e0 SynchronizationEvent fffffa8003f9e1e0 SynchronizationEvent fffffa8004afff60 SynchronizationEvent fffffa8004affe60 SynchronizationEvent fffffa8004affd60 SynchronizationEvent fffffa8003f9e480 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa800495db30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 2808 Ticks: 37482 (0:00:09:44.722) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address mpssvc!FwPortKeywordRegNotifyThread (0x000007fefad6f130) Stack Init fffff88004550db0 Current fffff8800454ffd0 Base fffff88004551000 Limit fffff8800454b000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04550010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04550150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`045501e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04550490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04550960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04550bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04550c20) 00000000`0105fbe8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0105fbf0 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0105fcf0 000007fe`fad6f1fd kernel32!WaitForMultipleObjects+0xb0 00000000`0105fd80 00000000`776cf56d mpssvc!FwPortKeywordRegNotifyThread+0xd1 00000000`0105fdb0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0105fde0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004b04060 Cid 042c.0474 Teb: 000007fffffa6000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004b02650 NotificationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa800495db30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3556 Ticks: 36734 (0:00:09:33.054) Context Switch Count 38 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address mpssvc!NVNWorkerThread (0x000007fefad55840) Stack Init fffff880045b3db0 Current fffff880045b3900 Base fffff880045b4000 Limit fffff880045ae000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`045b3940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`045b3a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`045b3b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`045b3bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`045b3c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`045b3c20) 00000000`01b2fd18 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`01b2fd20 000007fe`fad55869 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`01b2fdc0 00000000`776cf56d mpssvc!NVNWorkerThread+0x2d 00000000`01b2fdf0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01b2fe20 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004b05740 Cid 042c.0478 Teb: 000007fffffa4000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004b05db0 QueueObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa800495db30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 2832 Ticks: 37458 (0:00:09:44.348) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880045badb0 Current fffff880045ba7d0 Base fffff880045bb000 Limit fffff880045b5000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`045ba810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`045ba950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`045ba9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`045baa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`045bab20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`045bac20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`045bac20) 00000000`018cfa18 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`018cfa20 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`018cfd20 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`018cfd50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004b06b60 Cid 042c.047c Teb: 000007fffffa2000 Win32Thread: fffff900c1c96010 WAIT: (UserRequest) UserMode Alertable fffffa8004b051c0 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa800495db30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3431 Ticks: 36859 (0:00:09:35.004) Context Switch Count 54 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address mpssvc!FwDynDataNotifySinkProc (0x000007fefad5e680) Stack Init fffff88004d29db0 Current fffff88004d29900 Base fffff88004d2a000 Limit fffff88004d23000 Call 0 Priority 9 BasePriority 8 UnusualBoost 1 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04d29940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04d29a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04d29b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04d29bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04d29c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04d29c20) 00000000`01c3fc98 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`01c3fca0 000007fe`fad5e8e5 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`01c3fd40 00000000`776cf56d mpssvc!FwDynDataNotifySinkProc+0x4b0 00000000`01c3fe30 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01c3fe60 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004b07060 Cid 042c.0480 Teb: 000007fffffa0000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004b06a60 SynchronizationEvent fffffa8004b06ae0 NotificationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa800495db30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 5564 Ticks: 34726 (0:00:09:01.729) Context Switch Count 12 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address mpssvc!FwMonitorQuarantineState (0x000007fefad49140) Stack Init fffff880045c8db0 Current fffff880045c7fd0 Base fffff880045c9000 Limit fffff880045c3000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`045c8010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`045c8150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`045c81e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`045c8490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`045c8960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`045c8bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`045c8c20) 00000000`01ccf738 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`01ccf740 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`01ccf840 000007fe`fad49205 kernel32!WaitForMultipleObjects+0xb0 00000000`01ccf8d0 00000000`776cf56d mpssvc!FwMonitorQuarantineState+0xd2 00000000`01ccf910 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01ccf940 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005073060 Cid 042c.0910 Teb: 000007fffffaa000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004fe21c0 SynchronizationEvent fffffa8004f0e170 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa800495db30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 38269 Ticks: 2021 (0:00:00:31.527) Context Switch Count 147 UserTime 00:00:00.015 KernelTime 00:00:00.000 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff8800567cdb0 Current fffff8800567bfd0 Base fffff8800567d000 Limit fffff88005677000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0567c010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0567c150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0567c1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`0567c490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`0567c960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`0567cbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0567cc20) 00000000`01f1f6f8 000007fe`fedf0407 ntdll!NtWaitForMultipleObjects+0xa 00000000`01f1f700 000007fe`fedf0cf4 ADVAPI32!EtwpProcessRealTimeTraces+0x85 00000000`01f1f760 000007fe`f20e7f06 ADVAPI32!ProcessTrace+0x23f 00000000`01f1fbd0 000007fe`f20e7da8 dps!DpsRun+0x102 00000000`01f1fde0 00000000`ffa91344 dps!ServiceMain+0x1f9 00000000`01f1fe20 000007fe`ff4ea82d svchost!ServiceStarter+0x1e8 00000000`01f1feb0 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`01f1fee0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01f1ff10 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005031b60 Cid 042c.05b4 Teb: 000007fffff9e000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa80050b37c0 NotificationEvent fffffa8004dad620 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa800495db30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 11877 Ticks: 28413 (0:00:07:23.245) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address dps!DpspBackgroundControl (0x000007fef20e3060) Stack Init fffff88005269db0 Current fffff88005268fd0 Base fffff8800526a000 Limit fffff88005264000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05269010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05269150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`052691e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05269490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`05269960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`05269bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05269c20) 00000000`022bf978 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`022bf980 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`022bfa80 000007fe`f20e31fa kernel32!WaitForMultipleObjects+0xb0 00000000`022bfb10 00000000`776cf56d dps!DpspBackgroundControl+0x21b 00000000`022bfba0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`022bfbd0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80050e8b60 Cid 042c.0280 Teb: 000007fffff98000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004bbdd30 NotificationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa800495db30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 11897 Ticks: 28393 (0:00:07:22.933) Context Switch Count 14 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address dps!WdipLaunchLocalHost (0x000007fef20e5570) Stack Init fffff8800575fdb0 Current fffff8800575f900 Base fffff88005760000 Limit fffff8800575a000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0575f940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0575fa80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0575fb10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`0575fbb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`0575fc20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0575fc20) 00000000`0247fb68 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0247fb70 000007fe`f1d23232 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0247fc10 000007fe`f1d2318f wdi!WdipControlServer+0x26 00000000`0247fc70 000007fe`f1d23b76 wdi!WdipTriggerHost+0x223 00000000`0247fcc0 00000000`776cf56d wdi!WdipLaunchLocalHost+0x16 00000000`0247fd00 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0247fd30 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004f37060 Cid 042c.09c4 Teb: 000007fffff94000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa80050ac590 NotificationEvent fffffa8003c10880 NotificationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa800495db30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 11935 Ticks: 28355 (0:00:07:22.340) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address radardt!RdrpMonitorResources (0x000007fef1b52888) Stack Init fffff88005446db0 Current fffff88005445fd0 Base fffff88005447000 Limit fffff88005441000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05446010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05446150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`054461e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05446490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`05446960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`05446bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05446c20) 00000000`01dcfb88 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`01dcfb90 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`01dcfc90 000007fe`f1b52a25 kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`01dcfd20 000007fe`f1b529a7 radardt!RdrpWaitForHighCommit+0xa7 00000000`01dcfd60 00000000`776cf56d radardt!RdrpMonitorResources+0x13e 00000000`01dcfe20 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01dcfe50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005114960 Cid 042c.0660 Teb: 000007fffff92000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004fd3b30 NotificationEvent fffffa8004d30850 NotificationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa800495db30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 12006 Ticks: 28284 (0:00:07:21.233) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address wdiasqmmodule!WDIASqmNamespace::CASqmManager::static_UpdateThreadProc (0x000007fef19f2940) Stack Init fffff88004c06db0 Current fffff88004c05fd0 Base fffff88004c07000 Limit fffff88004c01000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04c06010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04c06150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04c061e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04c06490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04c06960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04c06bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04c06c20) 00000000`027dfcb8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`027dfcc0 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`027dfdc0 000007fe`f19f29df kernel32!WaitForMultipleObjects+0xb0 00000000`027dfe50 00000000`776cf56d wdiasqmmodule!WDIASqmNamespace::CASqmManager::static_UpdateThreadProc+0x9f 00000000`027dfea0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`027dfed0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800608e660 Cid 042c.a270 Teb: 000007fffffd9000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004ad4fb0 QueueObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa800495db30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 38017 Ticks: 2273 (0:00:00:35.459) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005b86db0 Current fffff88005b867d0 Base fffff88005b87000 Limit fffff88005b81000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05b86810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05b86950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`05b869e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05b86a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05b86b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05b86c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05b86c20) 00000000`01fff6d8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`01fff6e0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`01fff9e0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01fffa10 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800616fb60 Cid 042c.ad14 Teb: 000007fffff9c000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004ad4fb0 QueueObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa800495db30 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 38023 Ticks: 2267 (0:00:00:35.365) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004fdadb0 Current fffff88004fda7d0 Base fffff88004fdb000 Limit fffff88004fd5000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04fda810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04fda950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04fda9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04fdaa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04fdab20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04fdac20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04fdac20) 00000000`0237f7a8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0237f7b0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0237fab0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0237fae0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004b9eb30 SessionId: 0 Cid: 04e4 Peb: 7fffffdf000 ParentCid: 0210 DirBase: 11ed44000 ObjectTable: fffff8a00220c9d0 HandleCount: 454. Image: spoolsv.exe VadRoot fffffa8004bcf190 Vads 208 Clone 0 Private 2548. Modified 45338. Locked 2. DeviceMap fffff8a000008c10 Token fffff8a00222b4c0 ElapsedTime 00:09:42.281 UserTime 00:00:02.433 KernelTime 00:00:01.903 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (5361, 50, 345) (21444KB, 200KB, 1380KB) PeakWorkingSetSize 5875 VirtualSize 117 Mb PeakVirtualSize 123 Mb PageFaultCount 28966 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 3230 Setting context for this process... .process /p /r fffffa8004b9eb30 THREAD fffffa8004b9fa10 Cid 04e4.04e8 Teb: 000007fffffdd000 Win32Thread: fffff900c1c8dc30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004bc67a0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 4959 Ticks: 35331 (0:00:09:11.167) Context Switch Count 38 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address spoolsv!mainCRTStartup (0x00000000ff36ec10) Stack Init fffff880048a1db0 Current fffff880048a1900 Base fffff880048a2000 Limit fffff8800489b000 Call 0 Priority 9 BasePriority 8 UnusualBoost 1 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`048a1940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`048a1a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`048a1b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`048a1bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`048a1c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`048a1c20) 00000000`0023f528 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0023f530 000007fe`ff4eaffb KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0023f5d0 000007fe`ff4e9d61 sechost!ScSendResponseReceiveControls+0x13b 00000000`0023f6c0 000007fe`ff4e9c16 sechost!ScDispatcherLoop+0x121 00000000`0023f7d0 00000000`ff36e0af sechost!StartServiceCtrlDispatcherW+0x14e 00000000`0023f820 00000000`ff36ed26 spoolsv!main+0x23 00000000`0023f850 00000000`776cf56d spoolsv!TRemoteWinspool::GetEPVEntry+0x6bd 00000000`0023f890 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0023f8c0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004bd1b60 Cid 04e4.051c Teb: 000007fffffd7000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004bd0210 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 3085 Ticks: 37205 (0:00:09:40.401) Context Switch Count 48 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff880048a8db0 Current fffff880048a8900 Base fffff880048a9000 Limit fffff880048a3000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`048a8940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`048a8a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`048a8b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`048a8bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`048a8c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`048a8c20) 00000000`0206fb58 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0206fb60 00000000`ff36f088 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0206fc00 000007fe`ff4ea82d spoolsv!SPOOLER_main+0x247 00000000`0206fc60 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`0206fc90 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0206fcc0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004bd3550 Cid 04e4.0520 Teb: 000007fffffd5000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004bd3a50 SynchronizationTimer fffffa8004bd2310 SynchronizationTimer fffffa8004d25750 SynchronizationEvent fffffa8004d26de0 SynchronizationEvent fffffa8004d3c580 SynchronizationEvent fffffa8004d61e60 SynchronizationEvent fffffa8004d61ba0 SynchronizationEvent fffffa8004d669e0 SynchronizationEvent fffffa8004d69930 SynchronizationEvent fffffa8004d79e00 SynchronizationEvent fffffa8004d799a0 SynchronizationEvent fffffa8004d79920 SynchronizationEvent fffffa8004d7a5c0 SynchronizationEvent fffffa8004d7db30 SynchronizationEvent fffffa8004d7dcb0 SynchronizationEvent fffffa8004d62060 SynchronizationEvent fffffa8004f9f700 SynchronizationEvent fffffa8004fc01c0 SynchronizationEvent fffffa8004f9b190 SynchronizationEvent fffffa8004f9b210 SynchronizationEvent fffffa8004d7c180 SynchronizationEvent fffffa8004fbe698 NotificationEvent fffffa8004fb83f0 SynchronizationEvent fffffa8004fb84f0 SynchronizationEvent fffffa8004fb86f0 SynchronizationEvent fffffa8004fb8060 SynchronizationEvent fffffa8004fa2200 SynchronizationEvent fffffa8004fa2400 SynchronizationEvent fffffa80049bf8d0 SynchronizationEvent fffffa8004fa2860 SynchronizationEvent fffffa8004fb6220 SynchronizationEvent fffffa8004fb6420 SynchronizationEvent fffffa8004fb65a0 SynchronizationEvent fffffa8004fb67a0 SynchronizationEvent fffffa8004f9b410 SynchronizationEvent fffffa8004f9b590 SynchronizationEvent fffffa8004f9b710 SynchronizationEvent fffffa8003c479b0 SynchronizationEvent fffffa8004fb21a0 SynchronizationEvent fffffa8004fac1f0 SynchronizationEvent fffffa8004fbfb30 SynchronizationEvent fffffa8004de28a0 SynchronizationEvent fffffa8004bd3bc0 SynchronizationEvent fffffa8004b7b490 SynchronizationEvent fffffa8004451ef0 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 39914 Ticks: 376 (0:00:00:05.865) Context Switch Count 411 UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff880048afdb0 Current fffff880048aefd0 Base fffff880048b0000 Limit fffff880048aa000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`048af010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`048af150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`048af1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`048af490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`048af960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`048afbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`048afc20) 00000000`0227f788 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`0227f790 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`0227fa30 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0227fa60 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004bd6060 Cid 04e4.0524 Teb: 000007fffffd3000 Win32Thread: fffff900c1cae010 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004bd3e60 SynchronizationEvent fffffa8004d66a60 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 5157 Ticks: 35133 (0:00:09:08.078) Context Switch Count 323 LargeStack UserTime 00:00:00.031 KernelTime 00:00:00.015 Win32 Start Address spoolsv!PreInitializeRouter (0x00000000ff36cc50) Stack Init fffff880050bddb0 Current fffff880050bcfd0 Base fffff880050be000 Limit fffff880050b5000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`050bd010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`050bd150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`050bd1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`050bd490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`050bd960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`050bdbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`050bdc20) 00000000`01f6f288 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`01f6f290 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`01f6f390 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`01f6f420 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`01f6f4c0 00000000`775c8880 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`01f6f500 00000000`ff36ac16 USER32!MsgWaitForMultipleObjects+0x20 00000000`01f6f540 00000000`ff36980a spoolsv!HandlePollNotifications+0x46 00000000`01f6f5c0 00000000`ff36ccab spoolsv!InitializeRouter+0x516 00000000`01f6f7d0 00000000`776cf56d spoolsv!PreInitializeRouter+0x8c 00000000`01f6f800 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01f6f830 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d664e0 Cid 04e4.0728 Teb: 000007fffffac000 Win32Thread: fffff900c1cafc30 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004d663c0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 12625 Ticks: 27665 (0:00:07:11.576) Context Switch Count 34 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address usbmon!CPNPNotifications::WindowMessageThread (0x000007fef97c10c8) Stack Init fffff880050d0db0 Current fffff880050d06f0 Base fffff880050d1000 Limit fffff880050c8000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`050d0730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`050d0870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`050d0900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`050d09a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`050d0a40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`050d0a70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`050d0b50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`050d0b90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`050d0c20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`050d0c20) 00000000`02e1fa78 00000000`775cc95e USER32!NtUserGetMessage+0xa 00000000`02e1fa80 000007fe`f97c11f3 USER32!GetMessageW+0x34 00000000`02e1fab0 00000000`776cf56d usbmon!CPNPNotifications::WindowMessageThread+0x1b2 00000000`02e1fb80 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`02e1fbb0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d73b60 Cid 04e4.0770 Teb: 000007fffffaa000 Win32Thread: fffff900c1caa5b0 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004d69860 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 12625 Ticks: 27665 (0:00:07:11.576) Context Switch Count 29 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address WSDMon!Ncd::TPower::WindowMessageThread (0x000007fef8fb6144) Stack Init fffff880050e3db0 Current fffff880050e36f0 Base fffff880050e4000 Limit fffff880050dc000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`050e3730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`050e3870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`050e3900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`050e39a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`050e3a40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`050e3a70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`050e3b50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`050e3b90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`050e3c20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`050e3c20) 00000000`022bf7e8 00000000`775cc95e USER32!NtUserGetMessage+0xa 00000000`022bf7f0 000007fe`f8fb6223 USER32!GetMessageW+0x34 00000000`022bf820 00000000`776cf56d WSDMon!Ncd::TPower::WindowMessageThread+0xdf 00000000`022bf8c0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`022bf8f0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d74ae0 Cid 04e4.077c Teb: 000007fffffa8000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d74fe0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 5130 Ticks: 35160 (0:00:09:08.499) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address FunDisc!CNotificationQueue::ThreadProc (0x000007fef8ec5fd0) Stack Init fffff88004485db0 Current fffff88004485900 Base fffff88004486000 Limit fffff88004480000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04485940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04485a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04485b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04485bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04485c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04485c20) 00000000`02cff758 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`02cff760 000007fe`f8ec609d KERNELBASE!WaitForSingleObjectEx+0x79 00000000`02cff800 00000000`776cf56d FunDisc!CNotificationQueue::ThreadProc+0x376 00000000`02cff870 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`02cff8a0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d75b60 Cid 04e4.0724 Teb: 000007fffffa6000 Win32Thread: fffff900c1caec30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d739e0 SynchronizationEvent fffffa8004d733d0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 12630 Ticks: 27660 (0:00:07:11.498) Context Switch Count 26 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address fdPnp!CPnpProvider::ListenerThread (0x000007fef8eb3438) Stack Init fffff880050f6db0 Current fffff880050f5fd0 Base fffff880050f7000 Limit fffff880050ef000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`050f6010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`050f6150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`050f61e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`050f6490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`050f6960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`050f6bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`050f6c20) 00000000`02f3f3e8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`02f3f3f0 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`02f3f4f0 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`02f3f580 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`02f3f620 00000000`775c8880 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`02f3f660 000007fe`f8eb3637 USER32!MsgWaitForMultipleObjects+0x20 00000000`02f3f6a0 00000000`776cf56d fdPnp!CPnpProvider::ListenerThread+0x1ff 00000000`02f3f920 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`02f3f950 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d75560 Cid 04e4.0720 Teb: 000007fffffa4000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004d75a60 SynchronizationEvent fffffa8004d75440 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 5131 Ticks: 35159 (0:00:09:08.483) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address FunDisc!CRegProvider::ThreadProc (0x000007fef8ec63ec) Stack Init fffff88004f0adb0 Current fffff88004f09fd0 Base fffff88004f0b000 Limit fffff88004f05000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04f0a010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04f0a150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04f0a1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04f0a490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04f0a960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04f0abb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04f0ac20) 00000000`0344f7e8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0344f7f0 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0344f8f0 000007fe`f8ec6576 kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0344f980 000007fe`f8ec6415 FunDisc!CRegProvider::MemberThreadProc+0x1c0 00000000`0344fe50 00000000`776cf56d FunDisc!CRegProvider::ThreadProc+0x25 00000000`0344fe90 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0344fec0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d78060 Cid 04e4.07b0 Teb: 000007fffffa0000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d15c50 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 10410 Ticks: 29880 (0:00:07:46.130) Context Switch Count 11 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address PrintIsolationProxy!sandbox::ModuleManager::DelayUnloadWorkerThread (0x000007fef97b5e5c) Stack Init fffff88004fd3db0 Current fffff88004fd3900 Base fffff88004fd4000 Limit fffff88004fce000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04fd3940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04fd3a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04fd3b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04fd3bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04fd3c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04fd3c20) 00000000`0366fda8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0366fdb0 000007fe`f97b5dd2 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0366fe50 000007fe`f97b5e68 PrintIsolationProxy!sandbox::ModuleManager::DelayUnloadWorker+0x2e 00000000`0366fe80 00000000`776cf56d PrintIsolationProxy!sandbox::ModuleManager::DelayUnloadWorkerThread+0xc 00000000`0366feb0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0366fee0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d7a060 Cid 04e4.07c8 Teb: 000007fffff9e000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d786f0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 5156 Ticks: 35134 (0:00:09:08.093) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address localspl!SchedulerThread (0x000007fef9834828) Stack Init fffff88004fa6db0 Current fffff88004fa6900 Base fffff88004fa7000 Limit fffff88004fa1000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04fa6940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04fa6a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04fa6b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04fa6bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04fa6c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04fa6c20) 00000000`034afde8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`034afdf0 000007fe`f9834888 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`034afe90 00000000`776cf56d localspl!SchedulerThread+0xc8 00000000`034afed0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`034aff00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d92910 Cid 04e4.0780 Teb: 000007fffff94000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d8f060 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 40246 Ticks: 44 (0:00:00:00.686) Context Switch Count 562 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address msvcrt!endthreadex (0x000007fefdd173fc) Stack Init fffff8800488edb0 Current fffff8800488e900 Base fffff8800488f000 Limit fffff88004889000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0488e940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0488ea80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0488eb10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`0488ebb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`0488ec20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0488ec20) 00000000`03adfbd8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`03adfbe0 000007fe`f8d98948 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`03adfc80 000007fe`fdd142bf wsnmp32!thrTimer+0x2c4 00000000`03adfcd0 000007fe`fdd17459 msvcrt!endthreadex+0x47 00000000`03adfd00 00000000`776cf56d msvcrt!endthreadex+0xe0 00000000`03adfd30 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`03adfd60 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d92310 Cid 04e4.07a8 Teb: 000007fffff92000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d92810 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 5269 Ticks: 35021 (0:00:09:06.331) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address msvcrt!endthreadex (0x000007fefdd173fc) Stack Init fffff88005184db0 Current fffff88005184900 Base fffff88005185000 Limit fffff8800517f000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05184940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05184a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05184b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05184bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05184c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05184c20) 00000000`037ffdf8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`037ffe00 000007fe`f8d982c7 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`037ffea0 000007fe`fdd142bf wsnmp32!thrNotify+0x9b 00000000`037fff00 000007fe`fdd17459 msvcrt!endthreadex+0x47 00000000`037fff30 00000000`776cf56d msvcrt!endthreadex+0xe0 00000000`037fff60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`037fff90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d93060 Cid 04e4.0778 Teb: 000007fffff90000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d921f0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 5264 Ticks: 35026 (0:00:09:06.409) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address msvcrt!endthreadex (0x000007fefdd173fc) Stack Init fffff8800518bdb0 Current fffff8800518b900 Base fffff8800518c000 Limit fffff88005186000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0518b940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0518ba80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0518bb10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`0518bbb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`0518bc20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0518bc20) 00000000`0211fb28 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0211fb30 000007fe`f8d982c7 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0211fbd0 000007fe`fdd142bf wsnmp32!thrNotify+0x9b 00000000`0211fc30 000007fe`fdd17459 msvcrt!endthreadex+0x47 00000000`0211fc60 00000000`776cf56d msvcrt!endthreadex+0xe0 00000000`0211fc90 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0211fcc0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d93830 Cid 04e4.0774 Teb: 000007fffff8e000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d93e30 SynchronizationEvent fffffa8004d93db0 SynchronizationEvent fffffa8004d93d30 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 5264 Ticks: 35026 (0:00:09:06.409) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address tcpmon!TBidiServer::PollingThread (0x000007fef8e68760) Stack Init fffff88005192db0 Current fffff88005191fd0 Base fffff88005193000 Limit fffff8800518d000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05192010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05192150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`051921e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05192490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`05192960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`05192bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05192c20) 00000000`0223fc88 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0223fc90 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0223fd90 000007fe`f8e688b2 kernel32!WaitForMultipleObjects+0xb0 00000000`0223fe20 00000000`776cf56d tcpmon!TBidiServer::PollingThread+0x152 00000000`0223fe90 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0223fec0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d95b60 Cid 04e4.07ac Teb: 000007fffff9c000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d91ae0 NotificationEvent fffffa8004d8f060 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 5267 Ticks: 35023 (0:00:09:06.362) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address msvcrt!endthreadex (0x000007fefdd173fc) Stack Init fffff880051a7db0 Current fffff880051a6fd0 Base fffff880051a8000 Limit fffff880051a2000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`051a7010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`051a7150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`051a71e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`051a7490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`051a7960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`051a7bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`051a7c20) 00000000`039ff548 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`039ff550 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`039ff650 000007fe`ff4116f2 kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`039ff6e0 000007fe`f8d98640 WS2_32!WSAWaitForMultipleEvents+0x12 00000000`039ff720 000007fe`fdd142bf wsnmp32!thrManager+0x1a4 00000000`039ff840 000007fe`fdd17459 msvcrt!endthreadex+0x47 00000000`039ff870 00000000`776cf56d msvcrt!endthreadex+0xe0 00000000`039ff8a0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`039ff8d0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004f33060 Cid 04e4.095c Teb: 000007fffff96000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004f1ad10 QueueObject IRP List: fffffa8004efe330: (0006,03a0) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 10382 Ticks: 29908 (0:00:07:46.567) Context Switch Count 47 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004e7fdb0 Current fffff88004e7f7d0 Base fffff88004e80000 Limit fffff88004e7a000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04e7f810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04e7f950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04e7f9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04e7fa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04e7fb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04e7fc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04e7fc20) 00000000`041ff528 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`041ff530 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`041ff830 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`041ff860 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004545b60 Cid 04e4.0270 Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004bc5810 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 36050 Ticks: 4240 (0:00:01:06.144) Context Switch Count 14 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff8800531cdb0 Current fffff8800531c7d0 Base fffff8800531d000 Limit fffff88005317000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0531c810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0531c950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0531c9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0531ca90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0531cb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0531cc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0531cc20) 00000000`0399f478 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0399f480 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0399f780 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0399f7b0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800516fb60 Cid 04e4.07b4 Teb: 000007fffffd9000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004bc5810 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 39914 Ticks: 376 (0:00:00:05.865) Context Switch Count 11 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005583db0 Current fffff880055837d0 Base fffff88005584000 Limit fffff8800557e000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05583810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05583950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`055839e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05583a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05583b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05583c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05583c20) 00000000`03a9f8a8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`03a9f8b0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`03a9fbb0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`03a9fbe0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800540e660 Cid 04e4.0988 Teb: 000007fffffdb000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004bc5810 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004b9eb30 Image: spoolsv.exe Attached Process N/A Image: N/A Wait Start TickCount 39914 Ticks: 376 (0:00:00:05.865) Context Switch Count 5 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005526db0 Current fffff880055267d0 Base fffff88005527000 Limit fffff88005521000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05526810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05526950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`055269e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05526a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05526b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05526c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05526c20) 00000000`02b3f908 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`02b3f910 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`02b3fc10 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`02b3fc40 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004bdeb30 SessionId: 0 Cid: 0538 Peb: 7efdf000 ParentCid: 0210 DirBase: 11e2a2000 ObjectTable: fffff8a0022865e0 HandleCount: 80. Image: mdm.exe VadRoot fffffa8004a3dd70 Vads 87 Clone 0 Private 449. Modified 0. Locked 0. DeviceMap fffff8a000008c10 Token fffff8a002286780 ElapsedTime 00:09:40.705 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1450, 50, 345) (5800KB, 200KB, 1380KB) PeakWorkingSetSize 1450 VirtualSize 56 Mb PeakVirtualSize 59 Mb PageFaultCount 1677 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 595 Setting context for this process... .process /p /r fffffa8004bdeb30 THREAD fffffa8004be2060 Cid 0538.053c Teb: 000000007efdb000 Win32Thread: fffff900c1c91850 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004bfc6f0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004bdeb30 Image: mdm.exe Attached Process N/A Image: N/A Wait Start TickCount 3196 Ticks: 37094 (0:00:09:38.670) Context Switch Count 217 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.015 Win32 Start Address mdm!WinMainCRTStartup (0x000000000041814f) Stack Init fffff88004960db0 Current fffff88004960900 Base fffff88004961000 Limit fffff88004959000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04960940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04960a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04960b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04960bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04960c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04960c20) 00000000`0008ebf8 00000000`75452bcd wow64cpu!CpupSyscallStub+0x9 00000000`0008ec00 00000000`754cd07e wow64cpu!Thunk0ArgReloadState+0x1a 00000000`0008ecc0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0008ed10 00000000`778184c8 wow64!Wow64LdrpInitialize+0x429 00000000`0008f260 00000000`77817623 ntdll!LdrpInitializeProcess+0x17e2 00000000`0008f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bea0 00000000`0008f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004bfb2b0 Cid 0538.0568 Teb: 000000007efd8000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004bfb7b0 SynchronizationTimer fffffa8004bfb920 SynchronizationTimer fffffa8004bfcde0 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004bdeb30 Image: mdm.exe Attached Process N/A Image: N/A Wait Start TickCount 14734 Ticks: 25556 (0:00:06:38.676) Context Switch Count 5 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a11c7f Stack Init fffff880048d9db0 Current fffff880048d8fd0 Base fffff880048da000 Limit fffff880048d4000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`048d9010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`048d9150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`048d91e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`048d9490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`048d9960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`048d9bb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`048d9c20) 00000000`001ff0f8 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`001ff100 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`001ff1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`001ff210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`001ff760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`001ff7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004bfd400 Cid 0538.0574 Teb: 000000007efaa000 Win32Thread: fffff900c1c94c30 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004c00720 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004bdeb30 Image: mdm.exe Attached Process N/A Image: N/A Wait Start TickCount 39950 Ticks: 340 (0:00:00:05.304) Context Switch Count 388 LargeStack UserTime 00:00:00.031 KernelTime 00:00:00.015 Win32 Start Address 0x0000000075587587 Stack Init fffff8800498ddb0 Current fffff8800498d6f0 Base fffff8800498e000 Limit fffff88004985000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0498d730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0498d870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0498d900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`0498d9a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`0498da40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`0498da70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`0498db50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`0498db90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`0498dc20 00000000`7549fc2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0498dc20) 00000000`0096e7d8 00000000`7547ac48 wow64win!ZwUserGetMessage+0xa 00000000`0096e7e0 00000000`754ccf87 wow64win!whNtUserGetMessage+0x30 00000000`0096e840 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`0096f100 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`0096f1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0096f210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0096f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0096f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004bfeb60 Cid 0538.057c Teb: 000000007efa7000 Win32Thread: fffff900c1c93b40 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004bda360 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004bdeb30 Image: mdm.exe Attached Process N/A Image: N/A Wait Start TickCount 40223 Ticks: 67 (0:00:00:01.045) Context Switch Count 608 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.062 Win32 Start Address mdm!CProcessDetector::Run (0x00000000004180bb) Stack Init fffff8800497adb0 Current fffff8800497a6f0 Base fffff8800497b000 Limit fffff88004974000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0497a730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0497a870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0497a900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`0497a9a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`0497aa40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`0497aa70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`0497ab50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`0497ab90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`0497ac20 00000000`7549fc2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0497ac20) 00000000`009ae7d8 00000000`7547ac48 wow64win!ZwUserGetMessage+0xa 00000000`009ae7e0 00000000`754ccf87 wow64win!whNtUserGetMessage+0x30 00000000`009ae840 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`009af100 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`009af1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`009af210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`009af760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`009af7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004b66630 Cid 0538.05f4 Teb: 000000007efa1000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004c4d528 NotificationEvent IRP List: fffffa8004c348d0: (0006,0118) Flags: 00060800 Mdl: 00000000 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004bdeb30 Image: mdm.exe Attached Process N/A Image: N/A Wait Start TickCount 3372 Ticks: 36918 (0:00:09:35.924) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000075349588 Stack Init fffff8800480ddb0 Current fffff8800480d900 Base fffff8800480e000 Limit fffff88004808000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0480d940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0480da80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0480db10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`0480dbb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`0480dc20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0480dc20) 00000000`0272f0f8 00000000`75452bcd wow64cpu!CpupSyscallStub+0x9 00000000`0272f100 00000000`754cd07e wow64cpu!Thunk0ArgReloadState+0x1a 00000000`0272f1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0272f210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0272f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0272f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800455a060 Cid 0538.0710 Teb: 000000007efad000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004bfbba0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004bdeb30 Image: mdm.exe Attached Process N/A Image: N/A Wait Start TickCount 39337 Ticks: 953 (0:00:00:14.866) Context Switch Count 5 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a12c91 Stack Init fffff88002f40db0 Current fffff88002f407d0 Base fffff88002f41000 Limit fffff88002f3b000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`02f40810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`02f40950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`02f409e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`02f40a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`02f40b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`02f40c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`02f40c20) 00000000`003fe7e8 00000000`754ea2df ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`003fe7f0 00000000`754ccf87 wow64!whNtWaitForWorkViaWorkerFactory+0x23 00000000`003fe840 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`003ff100 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`003ff1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`003ff210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`003ff760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`003ff7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe PROCESS fffffa8004c05790 SessionId: 0 Cid: 0584 Peb: 7fffffd9000 ParentCid: 0210 DirBase: 11dd8f000 ObjectTable: fffff8a0022ac5d0 HandleCount: 46. Image: svchost.exe VadRoot fffffa8004c042f0 Vads 34 Clone 0 Private 187. Modified 0. Locked 0. DeviceMap fffff8a002020e00 Token fffff8a002260ac0 ElapsedTime 00:09:38.537 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (639, 50, 345) (2556KB, 200KB, 1380KB) PeakWorkingSetSize 647 VirtualSize 12 Mb PeakVirtualSize 13 Mb PageFaultCount 664 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 231 Setting context for this process... .process /p /r fffffa8004c05790 THREAD fffffa8004c09710 Cid 0584.0588 Teb: 000007fffffde000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004c03280 SynchronizationEvent Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004c05790 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3238 Ticks: 37052 (0:00:09:38.014) Context Switch Count 11 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address svchost!wmainCRTStartup (0x00000000ffa9246c) Stack Init fffff880048eedb0 Current fffff880048ee900 Base fffff880048ef000 Limit fffff880048e9000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`048ee940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`048eea80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`048eeb10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`048eebb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`048eec20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`048eec20) 00000000`0019fa68 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0019fa70 000007fe`ff4eaffb KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0019fb10 000007fe`ff4e9d61 sechost!ScSendResponseReceiveControls+0x13b 00000000`0019fc00 000007fe`ff4e9c16 sechost!ScDispatcherLoop+0x121 00000000`0019fd10 00000000`ffa91d3a sechost!StartServiceCtrlDispatcherW+0x14e 00000000`0019fd60 00000000`ffa9257a svchost!wmain+0x110 00000000`0019fd90 00000000`776cf56d svchost!ScCreateWellKnownSids+0x2fd 00000000`0019fdd0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0019fe00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004c081c0 Cid 0584.0590 Teb: 000007fffffda000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004c09fb0 QueueObject Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004c05790 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 37613 Ticks: 2677 (0:00:00:41.761) Context Switch Count 11 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004967db0 Current fffff880049677d0 Base fffff88004968000 Limit fffff88004962000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04967810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04967950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`049679e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04967a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04967b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04967c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04967c20) 00000000`006ef908 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`006ef910 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`006efc10 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`006efc40 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004c0f6a0 Cid 0584.0598 Teb: 000007fffffd5000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004c0fba0 SynchronizationTimer fffffa8004c0fd10 SynchronizationTimer fffffa8004c0e400 SynchronizationEvent fffffa8004c0f490 SynchronizationTimer Not impersonating DeviceMap fffff8a002020e00 Owning Process fffffa8004c05790 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3253 Ticks: 37037 (0:00:09:37.780) Context Switch Count 6 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff880049a2db0 Current fffff880049a1fd0 Base fffff880049a3000 Limit fffff8800499d000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`049a2010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`049a2150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`049a21e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`049a2490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`049a2960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`049a2bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`049a2c20) 00000000`0059f528 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`0059f530 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`0059f7d0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0059f800 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004d16060 SessionId: 0 Cid: 0730 Peb: 7fffffd6000 ParentCid: 0210 DirBase: 11b29e000 ObjectTable: fffff8a0023cc800 HandleCount: 102. Image: svchost.exe VadRoot fffffa8004cf6cd0 Vads 77 Clone 0 Private 359. Modified 0. Locked 2. DeviceMap fffff8a001f05400 Token fffff8a002361ac0 ElapsedTime 00:09:32.749 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1326, 50, 345) (5304KB, 200KB, 1380KB) PeakWorkingSetSize 1335 VirtualSize 33 Mb PeakVirtualSize 34 Mb PageFaultCount 1393 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 436 Setting context for this process... .process /p /r fffffa8004d16060 THREAD fffffa8004d02b60 Cid 0730.0734 Teb: 000007fffffde000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004b63ab0 SynchronizationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004d16060 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3608 Ticks: 36682 (0:00:09:32.242) Context Switch Count 21 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address svchost!wmainCRTStartup (0x00000000ffa9246c) Stack Init fffff88004dc9db0 Current fffff88004dc9900 Base fffff88004dca000 Limit fffff88004dc4000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04dc9940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04dc9a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04dc9b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04dc9bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04dc9c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04dc9c20) 00000000`0011f418 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0011f420 000007fe`ff4eaffb KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0011f4c0 000007fe`ff4e9d61 sechost!ScSendResponseReceiveControls+0x13b 00000000`0011f5b0 000007fe`ff4e9c16 sechost!ScDispatcherLoop+0x121 00000000`0011f6c0 00000000`ffa91d3a sechost!StartServiceCtrlDispatcherW+0x14e 00000000`0011f710 00000000`ffa9257a svchost!wmain+0x110 00000000`0011f740 00000000`776cf56d svchost!ScCreateWellKnownSids+0x2fd 00000000`0011f780 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0011f7b0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004cf0b60 Cid 0730.0740 Teb: 000007fffffd8000 Win32Thread: fffff900c1ca0c30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d132b0 NotificationEvent fffffa8004cc9660 NotificationEvent fffffa8004cc6c60 NotificationEvent fffffa8004cc6d00 NotificationEvent fffffa8004cc6fe0 NotificationEvent fffffa8004d13230 NotificationEvent fffffa8004ccc750 SynchronizationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004d16060 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3639 Ticks: 36651 (0:00:09:31.759) Context Switch Count 202 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.031 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff88004ecddb0 Current fffff88004eccfd0 Base fffff88004ece000 Limit fffff88004ec7000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04ecd010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04ecd150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04ecd1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04ecd490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04ecd960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04ecdbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04ecdc20) 00000000`0082f808 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0082f810 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0082f910 000007fe`f9c3134a kernel32!WaitForMultipleObjects+0xb0 00000000`0082f9a0 000007fe`f9c3aa06 ipsecsvc!ServiceWait+0x1ee 00000000`0082fa40 00000000`ffa91344 ipsecsvc!SpdServiceMain+0x3d8 00000000`0082fa80 000007fe`ff4ea82d svchost!ServiceStarter+0x1e8 00000000`0082fb10 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`0082fb40 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0082fb70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004ccc060 Cid 0730.0758 Teb: 000007fffffd4000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004cce260 SynchronizationTimer fffffa8004cce3d0 SynchronizationTimer fffffa8004ccc6d0 SynchronizationEvent fffffa8004cccb70 SynchronizationTimer Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004d16060 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 15169 Ticks: 25121 (0:00:06:31.890) Context Switch Count 8 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff88004ea0db0 Current fffff88004e9ffd0 Base fffff88004ea1000 Limit fffff88004e9b000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04ea0010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04ea0150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04ea01e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04ea0490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04ea0960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04ea0bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04ea0c20) 00000000`00bcf638 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`00bcf640 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`00bcf8e0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00bcf910 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004cc5b60 Cid 0730.075c Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004ccc620 QueueObject Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004d16060 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3630 Ticks: 36660 (0:00:09:31.899) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004ea7db0 Current fffff88004ea77d0 Base fffff88004ea8000 Limit fffff88004ea2000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04ea7810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04ea7950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04ea79e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04ea7a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04ea7b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04ea7c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04ea7c20) 00000000`00d8f7e8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`00d8f7f0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`00d8faf0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00d8fb20 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80050eeb60 Cid 0730.0954 Teb: 000007fffffac000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004cc2370 QueueObject Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8004d16060 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 36644 Ticks: 3646 (0:00:00:56.877) Context Switch Count 7 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff8800413fdb0 Current fffff8800413f7d0 Base fffff88004140000 Limit fffff8800413a000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0413f810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0413f950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0413f9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0413fa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0413fb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0413fc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0413fc20) 00000000`0072fc38 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0072fc40 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0072ff40 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0072ff70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004ce66a0 SessionId: 0 Cid: 0744 Peb: 7fffffdf000 ParentCid: 0210 DirBase: 11b424000 ObjectTable: fffff8a00234cf50 HandleCount: 294. Image: svchost.exe VadRoot fffffa8004cdb4b0 Vads 324 Clone 0 Private 18484. Modified 34628. Locked 0. DeviceMap fffff8a000008c10 Token fffff8a0023cda70 ElapsedTime 00:09:32.749 UserTime 00:00:02.090 KernelTime 00:00:00.265 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (7259, 50, 345) (29036KB, 200KB, 1380KB) PeakWorkingSetSize 27075 VirtualSize 165 Mb PeakVirtualSize 175 Mb PageFaultCount 97579 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 19725 Setting context for this process... .process /p /r fffffa8004ce66a0 THREAD fffffa8004cf7440 Cid 0744.0748 Teb: 000007fffffdd000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004cc8b90 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004ce66a0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 4959 Ticks: 35331 (0:00:09:11.167) Context Switch Count 19 UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address svchost!wmainCRTStartup (0x00000000ffa9246c) Stack Init fffff88004c22db0 Current fffff88004c22900 Base fffff88004c23000 Limit fffff88004c1d000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04c22940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04c22a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04c22b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04c22bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04c22c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04c22c20) 00000000`0029f8f8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0029f900 000007fe`ff4eaffb KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0029f9a0 000007fe`ff4e9d61 sechost!ScSendResponseReceiveControls+0x13b 00000000`0029fa90 000007fe`ff4e9c16 sechost!ScDispatcherLoop+0x121 00000000`0029fba0 00000000`ffa91d3a sechost!StartServiceCtrlDispatcherW+0x14e 00000000`0029fbf0 00000000`ffa9257a svchost!wmain+0x110 00000000`0029fc20 00000000`776cf56d svchost!ScCreateWellKnownSids+0x2fd 00000000`0029fc60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0029fc90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004b605d0 Cid 0744.0760 Teb: 000007fffffd5000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004cc42a0 SynchronizationTimer fffffa8004d12fe0 SynchronizationEvent fffffa8004cd4ae0 SynchronizationEvent fffffa8004abf060 SynchronizationTimer fffffa8004cc75a0 SynchronizationEvent fffffa8004cc7b50 NotificationEvent fffffa8004cffc70 SynchronizationEvent fffffa8004cffcf0 SynchronizationEvent fffffa8004d00450 SynchronizationEvent fffffa8004d004d0 SynchronizationEvent fffffa8004d05838 NotificationEvent fffffa8004ce0c50 SynchronizationEvent fffffa8004cfe640 SynchronizationEvent fffffa8004ce0170 SynchronizationEvent fffffa8004cf4b40 SynchronizationEvent fffffa8004cff9f0 SynchronizationEvent fffffa8004d00fe0 SynchronizationEvent fffffa8004d00e60 SynchronizationEvent fffffa8004d00ce0 SynchronizationEvent fffffa8004d001d0 SynchronizationEvent fffffa8004d05f60 SynchronizationEvent fffffa8004d05de0 SynchronizationEvent fffffa8004d05be0 SynchronizationEvent fffffa8004d059e0 SynchronizationEvent fffffa8004d052a0 SynchronizationEvent fffffa8004d06060 SynchronizationEvent fffffa8004d06e60 SynchronizationEvent fffffa8004d06ce0 SynchronizationEvent fffffa8004d06ae0 SynchronizationEvent fffffa8004d068e0 SynchronizationEvent fffffa8004d067e0 SynchronizationEvent fffffa8004ce66a0 ProcessObject fffffa8004ce1160 NotificationEvent fffffa8004cc72c0 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004ce66a0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 34494 Ticks: 5796 (0:00:01:30.418) Context Switch Count 156 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff880049f6db0 Current fffff880049f5fd0 Base fffff880049f7000 Limit fffff880049f1000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`049f6010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`049f6150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`049f61e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`049f6490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`049f6960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`049f6bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`049f6c20) 00000000`012ff598 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`012ff5a0 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`012ff840 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`012ff870 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004cd4b60 Cid 0744.0764 Teb: 000007fffffd3000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004b7a410 QueueObject IRP List: fffffa8004b76010: (0006,03a0) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004ce66a0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3998 Ticks: 36292 (0:00:09:26.158) Context Switch Count 48 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004e92db0 Current fffff88004e927d0 Base fffff88004e93000 Limit fffff88004e8d000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04e92810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04e92950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04e929e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04e92a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04e92b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04e92c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04e92c20) 00000000`014afb18 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`014afb20 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`014afe20 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`014afe50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004cdd290 Cid 0744.07d4 Teb: 000007fffffac000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004cef060 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004ce66a0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 37454 Ticks: 2836 (0:00:00:44.241) Context Switch Count 16 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address mpsvc!HealthMonitor (0x000007fef99497ec) Stack Init fffff88004ef0db0 Current fffff88004ef0900 Base fffff88004ef1000 Limit fffff88004eeb000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04ef0940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04ef0a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04ef0b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04ef0bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04ef0c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04ef0c20) 00000000`0159f9f8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0159fa00 000007fe`f99498fa KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0159faa0 00000000`776cf56d mpsvc!HealthMonitor+0x10e 00000000`0159fd90 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0159fdc0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004cdd9a0 Cid 0744.07d8 Teb: 000007fffffaa000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004ce5cf8 NotificationEvent fffffa8004cdd210 NotificationEvent IRP List: fffffa8004c7eb10: (0006,03a0) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004ce66a0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 23224 Ticks: 17066 (0:00:04:26.231) Context Switch Count 6 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address mpsvc!UpdateXcopyWorker (0x000007fef99569f4) Stack Init fffff88004f85db0 Current fffff88004f84fd0 Base fffff88004f86000 Limit fffff88004f80000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04f85010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04f85150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04f851e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04f85490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04f85960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04f85bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04f85c20) 00000000`0175fd18 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0175fd20 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0175fe20 000007fe`f9956bbb kernel32!WaitForMultipleObjects+0xb0 00000000`0175feb0 00000000`776cf56d mpsvc!UpdateXcopyWorker+0x1c7 00000000`0175ff20 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0175ff50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004ce4910 Cid 0744.07dc Teb: 000007fffffa8000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004ce77c0 NotificationEvent fffffa8004ce1c70 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004ce66a0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 3728 Ticks: 36562 (0:00:09:30.370) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address mpsvc!EnQueueEvent (0x000007fef994df74) Stack Init fffff88004fb9db0 Current fffff88004fb8fd0 Base fffff88004fba000 Limit fffff88004fb4000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04fb9010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04fb9150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04fb91e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04fb9490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04fb9960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04fb9bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04fb9c20) 00000000`0071f698 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0071f6a0 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0071f7a0 000007fe`f994dfcd kernel32!WaitForMultipleObjects+0xb0 00000000`0071f830 00000000`776cf56d mpsvc!EnQueueEvent+0x235 00000000`0071f880 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0071f8b0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004ce38e0 Cid 0744.07e0 Teb: 000007fffffa6000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004ce7740 NotificationEvent fffffa8004ce7200 NotificationEvent fffffa8004cdb410 NotificationEvent fffffa8004cdb2f0 NotificationEvent fffffa8004ce47f0 NotificationEvent fffffa8004cf5d40 NotificationEvent fffffa8004cf5c20 NotificationEvent fffffa8004cf5b00 NotificationEvent fffffa8004cf59e0 NotificationEvent fffffa8004cefa10 NotificationEvent fffffa8004cef8f0 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004ce66a0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 38942 Ticks: 1348 (0:00:00:21.028) Context Switch Count 299 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address mpsvc!ShutdownWorkHandler (0x000007fef994bc78) Stack Init fffff88004fe6db0 Current fffff88004fe5fd0 Base fffff88004fe7000 Limit fffff88004fe1000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04fe6010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04fe6150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04fe61e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04fe6490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04fe6960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04fe6bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04fe6c20) 00000000`0190fa88 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0190fa90 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0190fb90 000007fe`f8cf88a5 kernel32!WaitForMultipleObjects+0xb0 00000000`0190fc20 000007fe`f994bd12 MpClient!MpUtilsExports::MpWaitForMultipleObjectsImpl+0x75 00000000`0190fc70 00000000`776cf56d mpsvc!ShutdownWorkHandler+0x19a 00000000`0190fd50 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0190fd80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004ccd490 Cid 0744.0398 Teb: 000007fffffa0000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004ce3270 SynchronizationEvent fffffa8004ce32f0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004ce66a0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 40064 Ticks: 226 (0:00:00:03.525) Context Switch Count 2076 UserTime 00:00:00.234 KernelTime 00:00:00.000 Win32 Start Address mprtp!RealtimeProtection::CProcessEtwConsumer::ProcessEventsThread (0x000007fef9439688) Stack Init fffff88004ee2db0 Current fffff88004ee1fd0 Base fffff88004ee3000 Limit fffff88004edd000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04ee2010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04ee2150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04ee21e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04ee2490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04ee2960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04ee2bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04ee2c20) 00000000`07b8f4a8 000007fe`fedf0407 ntdll!NtWaitForMultipleObjects+0xa 00000000`07b8f4b0 000007fe`fedf0cf4 ADVAPI32!EtwpProcessRealTimeTraces+0x85 00000000`07b8f510 000007fe`f94396a6 ADVAPI32!ProcessTrace+0x23f 00000000`07b8f980 00000000`776cf56d mprtp!RealtimeProtection::CProcessEtwConsumer::ProcessEventsThread+0x1e 00000000`07b8f9b0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`07b8f9e0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004f2d060 Cid 0744.094c Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004cdf5e0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004ce66a0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 38942 Ticks: 1348 (0:00:00:21.028) Context Switch Count 7045 UserTime 00:00:08.580 KernelTime 00:00:00.312 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff8800258ddb0 Current fffff8800258d7d0 Base fffff8800258e000 Limit fffff88002588000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0258d810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0258d950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0258d9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0258da90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0258db20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0258dc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0258dc20) 00000000`07c4fa58 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`07c4fa60 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`07c4fd60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`07c4fd90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004f2d6c0 Cid 0744.0950 Teb: 000007fffffa4000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004cdf5e0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004ce66a0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 38942 Ticks: 1348 (0:00:00:21.028) Context Switch Count 3692 UserTime 00:00:08.720 KernelTime 00:00:00.156 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880049c5db0 Current fffff880049c57d0 Base fffff880049c6000 Limit fffff880049c0000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`049c5810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`049c5950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`049c59e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`049c5a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`049c5b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`049c5c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`049c5c20) 00000000`07d2fa68 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`07d2fa70 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`07d2fd70 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`07d2fda0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004bd2760 Cid 0744.0a3c Teb: 000007fffffa2000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004cdf5e0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004ce66a0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 9226 Ticks: 31064 (0:00:08:04.601) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880048d2db0 Current fffff880048d27d0 Base fffff880048d3000 Limit fffff880048cd000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`048d2810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`048d2950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`048d29e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`048d2a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`048d2b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`048d2c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`048d2c20) 00000000`0826fb38 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0826fb40 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0826fe40 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0826fe70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004545660 Cid 0744.0414 Teb: 000007fffffd7000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004ae9b90 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004ce66a0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 38942 Ticks: 1348 (0:00:00:21.028) Context Switch Count 380 UserTime 00:00:00.015 KernelTime 00:00:00.015 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005aaddb0 Current fffff88005aad7d0 Base fffff88005aae000 Limit fffff88005aa8000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05aad810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05aad950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`05aad9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05aada90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05aadb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05aadc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05aadc20) 00000000`07ecf908 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`07ecf910 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`07ecfc10 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`07ecfc40 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80050bab60 Cid 0744.1456c Teb: 000007fffffdb000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004ae9b90 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8004ce66a0 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 38863 Ticks: 1427 (0:00:00:22.261) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88007c52db0 Current fffff88007c527d0 Base fffff88007c53000 Limit fffff88007c4d000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`07c52810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`07c52950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`07c529e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`07c52a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`07c52b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`07c52c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`07c52c20) 00000000`01defa98 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`01defaa0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`01defda0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01defdd0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004d23b30 SessionId: 1 Cid: 0378 Peb: 7fffffd9000 ParentCid: 0210 DirBase: 1122b3000 ObjectTable: fffff8a0031c1690 HandleCount: 183. Image: taskhost.exe VadRoot fffffa8004d207d0 Vads 99 Clone 0 Private 466. Modified 0. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a0031c3060 ElapsedTime 00:09:11.661 UserTime 00:00:00.015 KernelTime 00:00:00.062 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1793, 50, 345) (7172KB, 200KB, 1380KB) PeakWorkingSetSize 1793 VirtualSize 62 Mb PeakVirtualSize 63 Mb PageFaultCount 2400 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 795 Setting context for this process... .process /p /r fffffa8004d23b30 THREAD fffffa8004cda440 Cid 0378.0484 Teb: 000007fffffde000 Win32Thread: fffff900c1f62a10 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004c80230 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d23b30 Image: taskhost.exe Attached Process N/A Image: N/A Wait Start TickCount 4969 Ticks: 35321 (0:00:09:11.011) Context Switch Count 35 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address taskhost!wWinMainCRTStartup (0x00000000ff4e2cc0) Stack Init fffff88004ebadb0 Current fffff88004eba900 Base fffff88004ebb000 Limit fffff88004eb4000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04eba940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04ebaa80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04ebab10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04ebabb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04ebac20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04ebac20) 00000000`0022f708 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0022f710 00000000`ff4e216e KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0022f7b0 00000000`ff4e1fb5 taskhost!UbpmpTaskHostSendResponseReceiveCommand+0xaa 00000000`0022f870 00000000`ff4e2e4e taskhost!UbpmTaskHostWaitForCommands+0x198 00000000`0022f8e0 00000000`776cf56d taskhost!_com_raise_error+0x236 00000000`0022f9a0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0022f9d0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004ce85b0 Cid 0378.0540 Teb: 000007fffffdc000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004d23430 SynchronizationTimer fffffa8004d23060 SynchronizationTimer fffffa8004d4a2e0 SynchronizationEvent fffffa8004d232c0 SynchronizationTimer Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d23b30 Image: taskhost.exe Attached Process N/A Image: N/A Wait Start TickCount 22270 Ticks: 18020 (0:00:04:41.113) Context Switch Count 11 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff88004edbdb0 Current fffff88004edafd0 Base fffff88004edc000 Limit fffff88004ed6000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04edb010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04edb150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04edb1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04edb490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04edb960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04edbbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04edbc20) 00000000`0207f548 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`0207f550 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`0207f7f0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0207f820 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d22060 Cid 0378.0544 Teb: 000007fffffda000 Win32Thread: fffff900c1f61c30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d112d0 NotificationEvent fffffa8004d11130 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d23b30 Image: taskhost.exe Attached Process N/A Image: N/A Wait Start TickCount 23798 Ticks: 16492 (0:00:04:17.276) Context Switch Count 63 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address taskhost!ComTaskMgrWnd::MsgPumpThreadProc (0x00000000ff4e1010) Stack Init fffff88004f03db0 Current fffff88004f02fd0 Base fffff88004f04000 Limit fffff88004efd000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04f03010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04f03150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04f031e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04f03490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04f03960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04f03bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04f03c20) 00000000`0225f438 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0225f440 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0225f540 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0225f5d0 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`0225f670 00000000`775c8880 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`0225f6b0 00000000`ff4e1160 USER32!MsgWaitForMultipleObjects+0x20 00000000`0225f6f0 00000000`776cf56d taskhost!ComTaskMgrWnd::MsgPumpThreadProc+0x196 00000000`0225f7b0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0225f7e0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d3c060 Cid 0378.066c Teb: 000007fffffaa000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d3dd10 NotificationEvent fffffa8004d3b480 NotificationEvent IRP List: fffffa8004d39010: (0006,0118) Flags: 00060070 Mdl: 00000000 fffffa8004d3d390: (0006,0118) Flags: 00060070 Mdl: 00000000 fffffa8004cd57b0: (0006,0118) Flags: 00060070 Mdl: 00000000 fffffa8004b6dee0: (0006,0118) Flags: 00060070 Mdl: 00000000 fffffa8004c325e0: (0006,0118) Flags: 00060070 Mdl: 00000000 fffffa8004c92c10: (0006,0118) Flags: 00060070 Mdl: 00000000 fffffa8004b65730: (0006,0118) Flags: 00060070 Mdl: 00000000 fffffa8004cf02f0: (0006,0118) Flags: 00060070 Mdl: 00000000 fffffa8004cd5550: (0006,0118) Flags: 00060070 Mdl: 00000000 fffffa8004bf0240: (0006,0118) Flags: 00060070 Mdl: 00000000 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d23b30 Image: taskhost.exe Attached Process N/A Image: N/A Wait Start TickCount 4987 Ticks: 35303 (0:00:09:10.730) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address PlaySndSrv!CBeepRedirector::WorkThread (0x000007fef9bc2740) Stack Init fffff88004f18db0 Current fffff88004f17fd0 Base fffff88004f19000 Limit fffff88004f13000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04f18010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04f18150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04f181e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04f18490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04f18960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04f18bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04f18c20) 00000000`0253f6c8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0253f6d0 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0253f7d0 000007fe`f9bc2801 kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0253f860 00000000`776cf56d PlaySndSrv!CBeepRedirector::WorkThread+0xc1 00000000`0253fb30 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0253fb60 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d3e060 Cid 0378.069c Teb: 000007fffffd3000 Win32Thread: fffff900c01d1c30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004c4d690 NotificationEvent fffffa8004befe60 NotificationEvent fffffa8004b5f6b0 NotificationEvent fffffa8004c3d5d0 NotificationEvent fffffa8004b78cd0 NotificationEvent fffffa8004b78a80 NotificationEvent fffffa8004d4f1d0 NotificationEvent fffffa8004cff540 NotificationEvent fffffa8004d41d80 NotificationEvent fffffa8004d32f60 NotificationEvent fffffa8004d45650 NotificationEvent fffffa8004d3de40 NotificationEvent fffffa8004d39250 SynchronizationEvent fffffa8004d3dd90 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d23b30 Image: taskhost.exe Attached Process N/A Image: N/A Wait Start TickCount 40283 Ticks: 7 (0:00:00:00.109) Context Switch Count 4193 LargeStack UserTime 00:00:00.031 KernelTime 00:00:00.015 Win32 Start Address MsCtfMonitor!MsCtfMonitor::ThreadProc (0x000007fef9b81f38) Stack Init fffff88004fccdb0 Current fffff88004fcbfd0 Base fffff88004fcd000 Limit fffff88004fc4000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04fcc010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04fcc150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04fcc1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04fcc490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04fcc960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04fccbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04fccc20) 00000000`0279f5c8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0279f5d0 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0279f6d0 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0279f760 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`0279f800 00000000`775c8880 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`0279f840 000007fe`f9b8119a USER32!MsgWaitForMultipleObjects+0x20 00000000`0279f880 000007fe`f9b8204c MsCtfMonitor!DoMsCtfMonitor+0x43b 00000000`0279fb40 00000000`776cf56d MsCtfMonitor!MsCtfMonitor::ThreadProc+0x12c 00000000`0279fd80 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0279fdb0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d4d060 Cid 0378.06e8 Teb: 000007fffffa8000 Win32Thread: fffff900c01d1850 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8004d4d420 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d23b30 Image: taskhost.exe Attached Process N/A Image: N/A Wait Start TickCount 39706 Ticks: 584 (0:00:00:09.110) Context Switch Count 1801 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.031 Win32 Start Address MSCTF!CCtfServerPort::StaticServerThread (0x000007feff5e9274) Stack Init fffff88004f9fdb0 Current fffff88004f9f750 Base fffff88004fa0000 Limit fffff88004f99000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04f9f790 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04f9f8d0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04f9f960 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`04f9fa00 fffff800`01d8cac7 nt!AlpcpReceiveMessagePort+0x189 fffff880`04f9fa60 fffff800`01d8e006 nt!AlpcpReceiveMessage+0x2d4 fffff880`04f9fb00 fffff800`01a8b993 nt!NtAlpcSendWaitReceivePort+0x1e6 fffff880`04f9fbb0 00000000`7782070a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04f9fc20) 00000000`025ee758 000007fe`ff5d26a9 ntdll!ZwAlpcSendWaitReceivePort+0xa 00000000`025ee760 000007fe`ff5e9417 MSCTF!CCtfServerPort::ServerLoop+0x16c 00000000`025ef880 000007fe`ff5e9296 MSCTF!CCtfServerPort::ServerThread+0x15b 00000000`025efbc0 00000000`776cf56d MSCTF!CCtfServerPort::StaticServerThread+0x28 00000000`025efbf0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`025efc20 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d4e720 Cid 0378.06d8 Teb: 000007fffffa6000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004d52c80 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d23b30 Image: taskhost.exe Attached Process N/A Image: N/A Wait Start TickCount 5061 Ticks: 35229 (0:00:09:09.575) Context Switch Count 6 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004e65db0 Current fffff88004e657d0 Base fffff88004e66000 Limit fffff88004e60000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04e65810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04e65950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04e659e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04e65a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04e65b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04e65c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04e65c20) 00000000`023ef898 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`023ef8a0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`023efba0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`023efbd0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d64b60 Cid 0378.06e0 Teb: 000007fffffa2000 Win32Thread: fffff900c1f69010 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004d64160 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d23b30 Image: taskhost.exe Attached Process N/A Image: N/A Wait Start TickCount 38863 Ticks: 1427 (0:00:00:22.261) Context Switch Count 176 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address WINMM!mciwindow (0x000007fef9741010) Stack Init fffff8800505edb0 Current fffff8800505e6f0 Base fffff8800505f000 Limit fffff88005057000 Call 0 Priority 12 BasePriority 10 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0505e730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0505e870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0505e900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`0505e9a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`0505ea40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`0505ea70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`0505eb50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`0505eb90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`0505ec20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0505ec20) 00000000`0329fb88 00000000`775c899e USER32!NtUserGetMessage+0xa 00000000`0329fb90 000007fe`f97410d5 USER32!GetMessageA+0xc4 00000000`0329fbc0 00000000`776cf56d WINMM!mciwindow+0x174 00000000`0329fc60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0329fc90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800458cb60 Cid 0378.060c Teb: 000007fffffd7000 Win32Thread: fffff900c2134010 WAIT: (WrQueue) UserMode Alertable fffffa8004bcc060 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d23b30 Image: taskhost.exe Attached Process N/A Image: N/A Wait Start TickCount 36813 Ticks: 3477 (0:00:00:54.241) Context Switch Count 103 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880055cadb0 Current fffff880055ca7d0 Base fffff880055cb000 Limit fffff880055c4000 Call 0 Priority 11 BasePriority 8 UnusualBoost 3 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`055ca810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`055ca950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`055ca9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`055caa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`055cab20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`055cac20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`055cac20) 00000000`02c3f478 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`02c3f480 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`02c3f780 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`02c3f7b0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004539060 Cid 0378.09fc Teb: 000007fffffd5000 Win32Thread: fffff900c1a5d010 WAIT: (WrQueue) UserMode Alertable fffffa8004bcc060 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d23b30 Image: taskhost.exe Attached Process N/A Image: N/A Wait Start TickCount 38863 Ticks: 1427 (0:00:00:22.261) Context Switch Count 9 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff8800427adb0 Current fffff8800427a7d0 Base fffff8800427b000 Limit fffff88004274000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0427a810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0427a950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0427a9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0427aa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0427ab20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0427ac20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0427ac20) 00000000`02dbfa48 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`02dbfa50 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`02dbfd50 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`02dbfd80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004d3ab30 SessionId: 1 Cid: 067c Peb: 7fffffdf000 ParentCid: 03d4 DirBase: 111dbc000 ObjectTable: fffff8a0031d6bc0 HandleCount: 75. Image: dwm.exe VadRoot fffffa8004b58450 Vads 66 Clone 0 Private 500. Modified 0. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a0031e0060 ElapsedTime 00:09:11.224 UserTime 00:00:00.015 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1419, 50, 345) (5676KB, 200KB, 1380KB) PeakWorkingSetSize 1530 VirtualSize 55 Mb PeakVirtualSize 56 Mb PageFaultCount 1794 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 586 Setting context for this process... .process /p /r fffffa8004d3ab30 THREAD fffffa8004d3cb60 Cid 067c.02a4 Teb: 000007fffffdd000 Win32Thread: fffff900c018e250 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d32130 SynchronizationEvent fffffa8004d36e20 SynchronizationEvent fffffa8004bdbfe0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d3ab30 Image: dwm.exe Attached Process N/A Image: N/A Wait Start TickCount 23798 Ticks: 16492 (0:00:04:17.276) Context Switch Count 158 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.000 Win32 Start Address Dwm!WinMainStartup (0x00000000ffaf49d4) Stack Init fffff88005038db0 Current fffff88005037fd0 Base fffff88005039000 Limit fffff88005031000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05038010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05038150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`050381e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05038490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`05038960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`05038bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05038c20) 00000000`0019fa78 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0019fa80 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0019fb80 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0019fc10 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`0019fcb0 00000000`ffaf1a79 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`0019fcf0 00000000`ffaf1a17 Dwm!CDwmAppHost::WaitForAndProcessEvent+0x51 00000000`0019fd30 00000000`ffaf4ef9 Dwm!CDwmAppHost::Run+0x7c 00000000`0019fda0 00000000`ffaf4e75 Dwm!WinMain+0x75 00000000`0019fde0 00000000`ffaf49ee Dwm!LocalFree+0x1ec 00000000`0019fea0 00000000`776cf56d Dwm!WinMainStartup+0x1a 00000000`0019fed0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0019ff00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d2a940 Cid 067c.06cc Teb: 000007fffffdb000 Win32Thread: fffff900c1fbcc30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004cf9d80 Semaphore Limit 0x7fffffff Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d3ab30 Image: dwm.exe Attached Process N/A Image: N/A Wait Start TickCount 37094 Ticks: 3196 (0:00:00:49.857) Context Switch Count 41 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address Dwm!CPortBase::PortThread (0x00000000ffaf5ea0) Stack Init fffff88005097db0 Current fffff88005096fd0 Base fffff88005098000 Limit fffff88005092000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05097010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05097150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`050971e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05097490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`05097960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`05097bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05097c20) 00000000`01fffb98 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`01fffba0 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`01fffca0 000007fe`f978685d kernel32!WaitForMultipleObjects+0xb0 00000000`01fffd30 00000000`ffaf1041 dwmredir!CMilWindowManager::WaitForMultipleObjects+0x116 00000000`01fffdd0 00000000`ffaf10a7 Dwm!CSessionPort::WaitForMultipleObjects+0x21 00000000`01fffe10 00000000`ffaf5ea9 Dwm!CPortBase::PortThreadInternal+0x49 00000000`01fffe70 00000000`776cf56d Dwm!CPortBase::PortThread+0x9 00000000`01fffea0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01fffed0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d6db60 Cid 067c.06c8 Teb: 000007fffffd9000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004d27500 SynchronizationTimer fffffa8004a57b30 ProcessObject fffffa8004d45060 SynchronizationTimer fffffa8004d2bef0 SynchronizationTimer Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d3ab30 Image: dwm.exe Attached Process N/A Image: N/A Wait Start TickCount 16622 Ticks: 23668 (0:00:06:09.223) Context Switch Count 8 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff880048c4db0 Current fffff880048c3fd0 Base fffff880048c5000 Limit fffff880048bf000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`048c4010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`048c4150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`048c41e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`048c4490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`048c4960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`048c4bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`048c4c20) 00000000`022bfb98 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`022bfba0 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`022bfe40 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`022bfe70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800519db60 Cid 067c.07cc Teb: 000007fffffd7000 Win32Thread: fffff900c1ab16f0 WAIT: (WrQueue) UserMode Alertable fffffa8004d27450 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d3ab30 Image: dwm.exe Attached Process N/A Image: N/A Wait Start TickCount 37094 Ticks: 3196 (0:00:00:49.857) Context Switch Count 4 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004592db0 Current fffff880045927d0 Base fffff88004593000 Limit fffff8800458c000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04592810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04592950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`045929e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04592a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04592b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04592c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04592c20) 00000000`0235fa58 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0235fa60 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0235fd60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0235fd90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800519d660 Cid 067c.0bdc Teb: 000007fffffd5000 Win32Thread: fffff900c1bd6c30 WAIT: (UserRequest) UserMode Alertable fffffa8004950650 SynchronizationEvent fffffa8004a85bc0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d3ab30 Image: dwm.exe Attached Process N/A Image: N/A Wait Start TickCount 37445 Ticks: 2845 (0:00:00:44.382) Context Switch Count 80 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address Dwm!CGhostThread::s_ThreadProc (0x00000000ffafa494) Stack Init fffff88004e02db0 Current fffff88004e01fd0 Base fffff88004e03000 Limit fffff88004dfa000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04e02010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04e02150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04e021e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04e02490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04e02960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04e02bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04e02c20) 00000000`023df628 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`023df630 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`023df730 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`023df7c0 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`023df860 00000000`ffafa370 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`023df8a0 00000000`ffafa507 Dwm!CGhostThread::PumpGhostWindowMsgs+0x7c 00000000`023df920 00000000`ffafa4a6 Dwm!CGhostThread::WorkerThreadProc+0x3b 00000000`023df950 00000000`776cf56d Dwm!CGhostThread::s_ThreadProc+0x12 00000000`023df980 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`023df9b0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004d4bb30 SessionId: 1 Cid: 06ac Peb: 7fffffd6000 ParentCid: 0648 DirBase: 111e49000 ObjectTable: fffff8a0031e0a50 HandleCount: 1177. Image: explorer.exe VadRoot fffffa8004d47240 Vads 511 Clone 0 Private 7702. Modified 5633. Locked 4. DeviceMap fffff8a001e84c00 Token fffff8a0031a7060 ElapsedTime 00:09:10.802 UserTime 00:00:00.343 KernelTime 00:00:00.639 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (15951, 50, 345) (63804KB, 200KB, 1380KB) PeakWorkingSetSize 16236 VirtualSize 299 Mb PeakVirtualSize 318 Mb PageFaultCount 40420 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 11444 Setting context for this process... .process /p /r fffffa8004d4bb30 THREAD fffffa8004d49700 Cid 06ac.05c0 Teb: 000007fffffde000 Win32Thread: fffff900c279a010 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004d50c50 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 39402 Ticks: 888 (0:00:00:13.852) Context Switch Count 6274 LargeStack UserTime 00:00:00.202 KernelTime 00:00:00.234 Win32 Start Address Explorer!wWinMainCRTStartup (0x00000000ffb4c138) Stack Init fffff88005025db0 Current fffff88005025870 Base fffff88005026000 Limit fffff8800501b000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`050258b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`050259f0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05025a80 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`05025b20 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`05025bc0 fffff960`0012e22e win32k!xxxSleepThread+0x59 fffff880`05025bf0 fffff800`01a8b993 win32k!NtUserWaitMessage+0x46 fffff880`05025c20 00000000`775cbf5a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05025c20) 00000000`001ff1d8 000007fe`fdfa435e USER32!ZwUserWaitMessage+0xa 00000000`001ff1e0 000007fe`fdf17a5d SHELL32!CDesktopBrowser::_MessageLoop+0x51 00000000`001ff220 00000000`ffb50e97 SHELL32!SHDesktopMessageLoop+0x7e 00000000`001ff260 00000000`ffb4c2b9 Explorer!wWinMain+0xb08 00000000`001ff910 00000000`776cf56d Explorer!DelayLoadFailureHook+0x208 00000000`001ff9d0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`001ffa00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d6c060 Cid 06ac.0790 Teb: 000007fffffdc000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004d685e0 SynchronizationTimer fffffa8004d68750 SynchronizationTimer fffffa8004e1bcc0 NotificationEvent fffffa8004a473d0 SynchronizationEvent fffffa8004e044c0 SynchronizationEvent fffffa8004d402f0 SynchronizationEvent fffffa8004a29b40 SynchronizationEvent fffffa8004a15de0 SynchronizationEvent fffffa8004c7c350 SynchronizationEvent fffffa8004dec1f0 NotificationEvent fffffa8003c43f60 SynchronizationEvent fffffa8004f4d9e0 SynchronizationEvent fffffa80049977a0 SynchronizationEvent fffffa8005054fe0 SynchronizationEvent fffffa8004f37bb0 SynchronizationEvent fffffa8004ed6c00 SynchronizationEvent fffffa8004e5e1c0 SynchronizationEvent fffffa80045005c8 NotificationEvent fffffa8004e8f280 SynchronizationEvent fffffa8004e3fe90 SynchronizationEvent fffffa8004d1eae0 SynchronizationEvent fffffa8004eaf3d0 SynchronizationEvent fffffa8004ee2e80 SynchronizationEvent fffffa8004fe83f0 SynchronizationEvent fffffa8004e152f0 SynchronizationEvent fffffa8004d8e8f0 SynchronizationEvent fffffa8003c2c900 SynchronizationEvent fffffa80043c7e90 SynchronizationEvent fffffa8004f41390 SynchronizationEvent fffffa8004d2f760 SynchronizationEvent fffffa8004fa2380 SynchronizationEvent fffffa8004e46e90 SynchronizationEvent fffffa8003c53780 SynchronizationEvent fffffa8004352c30 SynchronizationEvent fffffa8004f37aa0 SynchronizationEvent fffffa8004fb63a0 SynchronizationEvent fffffa8004b581b0 SynchronizationEvent fffffa8004d683d0 SynchronizationTimer Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 39712 Ticks: 578 (0:00:00:09.016) Context Switch Count 1316 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff8800450edb0 Current fffff8800450dfd0 Base fffff8800450f000 Limit fffff88004509000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0450e010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0450e150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0450e1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`0450e490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`0450e960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`0450ebb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0450ec20) 00000000`0293f928 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`0293f930 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`0293fbd0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0293fc00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d788c0 Cid 06ac.07c0 Teb: 000007fffffda000 Win32Thread: fffff900c2035ab0 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004e1dbc0 NotificationEvent fffffa80045708d0 Semaphore Limit 0xffff fffffa8004cf9410 SynchronizationEvent IRP List: fffffa8004fd3010: (0006,03a0) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 39776 Ticks: 514 (0:00:00:08.018) Context Switch Count 3463 LargeStack UserTime 00:00:01.014 KernelTime 00:00:00.374 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005084db0 Current fffff88005083fd0 Base fffff88005085000 Limit fffff8800507c000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05084010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05084150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`050841e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05084490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`05084960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`05084bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05084c20) 00000000`02b9f448 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`02b9f450 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`02b9f550 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`02b9f5e0 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`02b9f680 00000000`775c8880 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`02b9f6c0 000007fe`fdfa301d USER32!MsgWaitForMultipleObjects+0x20 00000000`02b9f700 000007fe`fdfa30e0 SHELL32!CShellTaskScheduler::_TT_MsgWaitForMultipleObjects+0x51 00000000`02b9f780 000007fe`fdf9fdeb SHELL32!CShellTaskScheduler::TT_TransitionThreadToRunningOrTerminating+0xac 00000000`02b9f800 000007fe`fdf9e3ca SHELL32!CShellTaskThread::ThreadProc+0x257 00000000`02b9f8a0 000007fe`ff473a7f SHELL32!CShellTaskThread::s_ThreadProc+0x22 00000000`02b9f8d0 00000000`777ef8eb SHLWAPI!ExecuteWorkItemThreadProc+0xf 00000000`02b9f900 00000000`777e9d9f ntdll!RtlpTpWorkCallback+0x16b 00000000`02b9f9e0 00000000`776cf56d ntdll!TppWorkerThread+0x5ff 00000000`02b9fce0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`02b9fd10 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d88930 Cid 06ac.0784 Teb: 000007fffffd8000 Win32Thread: fffff900c201ac30 WAIT: (WrResource) KernelMode Non-Alertable fffffa80050625e0 Semaphore Limit 0x7fffffff IRP List: fffffa8004fd1e10: (0006,01f0) Flags: 00060030 Mdl: fffffa8005727f40 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 40272 Ticks: 18 (0:00:00:00.280) Context Switch Count 1742 LargeStack UserTime 00:00:00.312 KernelTime 00:00:00.390 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004e38db0 Current fffff88004e38450 Base fffff88004e39000 Limit fffff88004e30000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04e38490 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04e385d0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04e38660 fffff800`01a55242 nt!KeWaitForSingleObject+0x19f fffff880`04e38700 fffff800`01a830a1 nt!ExpWaitForResource+0xae fffff880`04e38770 fffff880`037eaee5 nt!ExAcquireResourceSharedLite+0x2c6 fffff880`04e387e0 fffff880`037e97da bowser!GetBrowserServerList+0x1d1 fffff880`04e38890 fffff880`037db130 bowser!BowserCommonDeviceIoControlFile+0x742 fffff880`04e389e0 fffff800`01da7707 bowser!BowserFsdDispatch+0xa8 fffff880`04e38a10 fffff800`01da7f66 nt!IopXxxControlFile+0x607 fffff880`04e38b40 fffff800`01a8b993 nt!NtDeviceIoControlFile+0x56 fffff880`04e38bb0 00000000`7781ff2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04e38c20) 00000000`0204e958 000007fe`f6f97db5 ntdll!NtDeviceIoControlFile+0xa 00000000`0204e960 000007fe`f6f98037 browcli!DeviceControlGetInfo+0xe1 00000000`0204e9f0 000007fe`f6f933cb browcli!GetBrowserServerList+0x10f 00000000`0204ea60 000007fe`f6f93187 browcli!EnumServersForTransport+0x7b 00000000`0204eb20 000007fe`f6f92d10 browcli!NetServerEnumEx+0x45b 00000000`0204ecd0 000007fe`fafb49cc browcli!NetServerEnum+0x40 00000000`0204ed30 000007fe`fafb2d18 ntlanman!SERVER_ENUMNODE::GetInfo+0x40 00000000`0204ed90 000007fe`fd72a317 ntlanman!NPOpenEnum+0x495 00000000`0204ee00 000007fe`fd72246f MPR!CProviderOpenEnum::TestProvider+0x43 00000000`0204ee40 000007fe`fd72a33f MPR!CRoutedOperation::GetResult+0x145 00000000`0204eec0 000007fe`fd72254d MPR!CProviderOpenEnum::GetResult+0x17 00000000`0204eef0 000007fe`fd7224f9 MPR!CMprOperation::Perform+0x3f 00000000`0204ef30 000007fe`fd72605c MPR!CRoutedOperation::Perform+0x29 00000000`0204ef60 000007fe`f800371b MPR!WNetOpenEnumW+0x12f 00000000`0204f030 000007fe`f8003d42 fdWNet!CWNetProvider::EnumerateFunc+0x8b 00000000`0204f530 00000000`777ef8eb fdWNet!CWNetProvider::ThreadProc+0x66 00000000`0204f570 00000000`777e9d9f ntdll!RtlpTpWorkCallback+0x16b 00000000`0204f650 00000000`776cf56d ntdll!TppWorkerThread+0x5ff 00000000`0204f950 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0204f980 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d882a0 Cid 06ac.07a0 Teb: 000007fffffd4000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa8004d88660 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 39834 Ticks: 456 (0:00:00:07.113) Context Switch Count 23 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ole32!CRpcThreadCache::RpcWorkerThreadEntry (0x000007fefdb23570) Stack Init fffff88005104db0 Current fffff88005104970 Base fffff88005105000 Limit fffff880050ff000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`051049b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05104af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`05104b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05104bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05104c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05104c20) 00000000`0285f798 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`0285f7a0 000007fe`fdb1ea00 KERNELBASE!SleepEx+0xab 00000000`0285f840 000007fe`fdb22046 ole32!CROIDTable::WorkerThreadLoop+0x10 00000000`0285f870 000007fe`fdb2358a ole32!CRpcThread::WorkerLoop+0x1e 00000000`0285f8b0 00000000`776cf56d ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1a 00000000`0285f8e0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0285f910 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d897b0 Cid 06ac.07f0 Teb: 000007fffffae000 Win32Thread: fffff900c1fb0010 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d89ee0 SynchronizationEvent fffffa8004d87c10 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 40286 Ticks: 4 (0:00:00:00.062) Context Switch Count 20732 LargeStack UserTime 00:00:00.920 KernelTime 00:00:01.232 Win32 Start Address SHLWAPI!WrapperThreadProc (0x000007feff46c7d4) Stack Init fffff8800516a770 Current fffff88005169990 Base fffff8800516b000 Limit fffff8800515f000 Call fffff8800516a9e0 Priority 13 BasePriority 9 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`051699d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05169b10 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`05169ba0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05169e50 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`0516a320 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`0516a570 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0516a5e0) 00000000`034df3d8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`034df3e0 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`034df4e0 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`034df570 000007fe`fba714e6 USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`034df610 000007fe`fba715ef DUser!CoreSC::Wait+0x62 00000000`034df660 000007fe`fba71565 DUser!CoreSC::WaitMessage+0x6f 00000000`034df6a0 00000000`775cbfce DUser!MphWaitMessageEx+0x5c 00000000`034df6d0 00000000`7781fdf5 USER32!_ClientWaitMessageExMPH+0x1a 00000000`034df720 00000000`775cbf5a ntdll!KiUserCallbackDispatcherContinue (TrapFrame @ 00000000`034df5e8) 00000000`034df788 00000000`ffb21083 USER32!ZwUserWaitMessage+0xa 00000000`034df790 00000000`ffb50411 Explorer!CTray::_MessageLoop+0x4dc 00000000`034df820 000007fe`ff46c8ea Explorer!CTray::MainThreadProc+0x8a 00000000`034df850 00000000`776cf56d SHLWAPI!WrapperThreadProc+0x19b 00000000`034df950 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`034df980 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d8a340 Cid 06ac.07d0 Teb: 000007fffffac000 Win32Thread: fffff900c1fb0c30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d891d0 SynchronizationEvent fffffa8004d89250 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 5212 Ticks: 35078 (0:00:09:07.220) Context Switch Count 2 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address msvcrt!endthreadex (0x000007fefdd173fc) Stack Init fffff8800517ddb0 Current fffff8800517cfd0 Base fffff8800517e000 Limit fffff88005177000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0517d010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0517d150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0517d1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`0517d490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`0517d960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`0517dbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0517dc20) 00000000`0342f608 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0342f610 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0342f710 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0342f7a0 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`0342f840 000007fe`fba809a4 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`0342f880 000007fe`fba716b2 DUser!CoreSC::Wait+0x6a 00000000`0342f8d0 000007fe`fba805dd DUser!CoreSC::xwProcessNL+0xed 00000000`0342f940 000007fe`fba80500 DUser!GetMessageExA+0x7b 00000000`0342f990 000007fe`fdd142bf DUser!ResourceManager::SharedThreadProc+0xe8 00000000`0342fa20 000007fe`fdd17459 msvcrt!endthreadex+0x47 00000000`0342fa50 00000000`776cf56d msvcrt!endthreadex+0xe0 00000000`0342fa80 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0342fab0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d0f640 Cid 06ac.0754 Teb: 000007fffffaa000 Win32Thread: fffff900c1fc2a10 WAIT: (UserRequest) UserMode Alertable fffffa8004e68570 NotificationEvent fffffa8005359e60 NotificationEvent fffffa80045417f0 NotificationEvent fffffa8004516480 NotificationEvent fffffa8004cd1a10 NotificationEvent fffffa8004bd0450 NotificationEvent fffffa8005167e20 NotificationEvent fffffa8004a8c170 NotificationEvent fffffa80050f8a20 NotificationEvent fffffa8004f8eac0 NotificationEvent fffffa8004e3e600 NotificationEvent fffffa8004f4c310 NotificationEvent fffffa8004ad52d0 NotificationEvent fffffa8004b3a9d0 NotificationEvent fffffa800493da10 NotificationEvent fffffa8004fdf6f0 NotificationEvent fffffa8003c3add0 NotificationEvent fffffa8004e40c00 NotificationEvent fffffa8004ae9700 NotificationEvent fffffa80048f5d40 NotificationEvent fffffa8004efdd80 NotificationEvent fffffa8004f0ffe0 NotificationEvent fffffa8005119620 NotificationEvent fffffa8004a95c50 NotificationEvent fffffa8004d591b0 NotificationEvent fffffa80043eb920 NotificationEvent fffffa8004eab9c0 NotificationEvent fffffa8005011d50 NotificationEvent fffffa80050dc550 NotificationEvent fffffa8005128ee0 NotificationEvent fffffa8004ee2210 NotificationEvent fffffa8004fe8d60 NotificationEvent fffffa80051315e0 NotificationEvent fffffa800490d700 NotificationEvent fffffa8004e18ac0 NotificationEvent fffffa8004c24470 NotificationEvent fffffa8005115560 NotificationEvent fffffa80045330f0 NotificationEvent fffffa8004ee9570 NotificationEvent fffffa8004ff5550 NotificationEvent fffffa8004b3e1c0 NotificationEvent fffffa8004e24500 NotificationEvent fffffa80050d5b00 NotificationEvent fffffa8004e2ade0 NotificationEvent fffffa8004f3fb90 NotificationEvent fffffa8004eba750 NotificationEvent fffffa8004e21c40 NotificationEvent fffffa8004df2fe0 NotificationEvent fffffa8004eff560 NotificationEvent fffffa800503e7e0 NotificationEvent fffffa8003c391e0 NotificationEvent fffffa8004eaf060 NotificationEvent fffffa8004a09800 NotificationEvent fffffa80044007b0 NotificationEvent fffffa8004a2c8d0 NotificationEvent fffffa8004d67c10 NotificationEvent fffffa8004544840 NotificationEvent fffffa8003c402b0 NotificationEvent fffffa8003c43060 NotificationEvent fffffa8004ac0c10 NotificationEvent fffffa8004dde0e0 NotificationEvent fffffa8004e01660 NotificationEvent fffffa8003c295d0 NotificationEvent fffffa800496e5a0 SynchronizationEvent IRP List: fffffa8004578c60: (0006,03a0) Flags: 00060000 Mdl: 00000000 fffffa80050b8010: (0006,03a0) Flags: 00060000 Mdl: 00000000 fffffa80050a1410: (0006,03a0) Flags: 00060000 Mdl: 00000000 fffffa800458ac60: (0006,03a0) Flags: 00060000 Mdl: 00000000 fffffa800510d280: (0006,03a0) Flags: 00060000 Mdl: 00000000 fffffa80051a8010: (0006,03a0) Flags: 00060000 Mdl: 00000000 fffffa8004580260: (0006,03a0) Flags: 00060000 Mdl: 00000000 fffffa8004569c60: (0006,03a0) Flags: 00060000 Mdl: 00000000 fffffa80050f67d0: (0006,03a0) Flags: 00060000 Mdl: 00000000 fffffa800456e580: (0006,03a0) Flags: 00060000 Mdl: 00000000 fffffa8004549a30: (0006,03a0) Flags: 00060000 Mdl: 00000000 fffffa80044f2c60: (0006,03a0) Flags: 00060000 Mdl: 00000000 fffffa800456e010: (0006,03a0) Flags: 00060000 Mdl: 00000000 fffffa8004587010: (0006,03a0) Flags: 00060000 Mdl: 00000000 fffffa800456e930: (0006,03a0) Flags: 00060000 Mdl: 00000000 fffffa800458e8b0: (0006,03a0) Flags: 00060000 Mdl: 00000000 fffffa800458ec60: (0006,03a0) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 39809 Ticks: 481 (0:00:00:07.503) Context Switch Count 4660 LargeStack UserTime 00:00:00.530 KernelTime 00:00:00.124 Win32 Start Address SHLWAPI!WrapperThreadProc (0x000007feff46c7d4) Stack Init fffff880051e9db0 Current fffff880051e8fd0 Base fffff880051ea000 Limit fffff880051e1000 Call 0 Priority 13 BasePriority 8 UnusualBoost 2 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`051e9010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`051e9150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`051e91e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`051e9490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`051e9960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`051e9bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`051e9c20) 00000000`0369f3f8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0369f400 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0369f500 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0369f590 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`0369f630 000007fe`fdfb3752 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`0369f670 000007fe`fdfb3682 SHELL32!CMsgWaitForManyObjects::Wait+0xbd 00000000`0369f6d0 000007fe`fdf1366b SHELL32!CChangeNotify::_MessagePump+0xb0 00000000`0369f780 000007fe`ff46c8ea SHELL32!CChangeNotify::s_ThreadProc+0xc7 00000000`0369f7e0 00000000`776cf56d SHLWAPI!WrapperThreadProc+0x19b 00000000`0369f8e0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0369f910 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d6d660 Cid 06ac.078c Teb: 000007fffff9e000 Win32Thread: fffff900c2065010 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004dd7bb0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 23798 Ticks: 16492 (0:00:04:17.276) Context Switch Count 22 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address SHLWAPI!WrapperThreadProc (0x000007feff46c7d4) Stack Init fffff88004e4bdb0 Current fffff88004e4b6f0 Base fffff88004e4c000 Limit fffff88004e45000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04e4b730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04e4b870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04e4b900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`04e4b9a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`04e4ba40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`04e4ba70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`04e4bb50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`04e4bb90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`04e4bc20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04e4bc20) 00000000`049cfa08 00000000`775cc95e USER32!NtUserGetMessage+0xa 00000000`049cfa10 00000000`ffb2d479 USER32!GetMessageW+0x34 00000000`049cfa40 000007fe`ff46c8ea Explorer!CSoundWnd::s_ThreadProc+0x3b 00000000`049cfaa0 00000000`776cf56d SHLWAPI!WrapperThreadProc+0x19b 00000000`049cfba0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`049cfbd0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a0db60 Cid 06ac.04ac Teb: 000007fffff94000 Win32Thread: fffff900c279b6f0 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004a0f180 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 39809 Ticks: 481 (0:00:00:07.503) Context Switch Count 131 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address SHLWAPI!WrapperThreadProc (0x000007feff46c7d4) Stack Init fffff8800545edb0 Current fffff8800545e6f0 Base fffff8800545f000 Limit fffff88005457000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0545e730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0545e870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0545e900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`0545e9a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`0545ea40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`0545ea70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`0545eb50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`0545eb90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`0545ec20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0545ec20) 00000000`04c5f688 00000000`775cc95e USER32!NtUserGetMessage+0xa 00000000`04c5f690 000007fe`fdfb6cc0 USER32!GetMessageW+0x34 00000000`04c5f6c0 000007fe`ff46c8ea SHELL32!MessagePumpThreadProc+0x3e 00000000`04c5f730 00000000`776cf56d SHLWAPI!WrapperThreadProc+0x19b 00000000`04c5f830 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`04c5f860 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004e105a0 Cid 06ac.07e4 Teb: 000007fffff92000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004cbf240 NotificationEvent fffffa8004b1f300 NotificationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 5925 Ticks: 34365 (0:00:08:56.097) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address msiltcfg!WorkerThread (0x000007fefb212154) Stack Init fffff88004ce2db0 Current fffff88004ce1fd0 Base fffff88004ce3000 Limit fffff88004cdd000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04ce2010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04ce2150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04ce21e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04ce2490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04ce2960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04ce2bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04ce2c20) 00000000`0480f688 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0480f690 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0480f790 000007fe`fb2121d6 kernel32!WaitForMultipleObjects+0xb0 00000000`0480f820 00000000`776cf56d msiltcfg!WorkerThread+0x82 00000000`0480f8b0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0480f8e0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004dc5380 Cid 06ac.027c Teb: 000007fffff90000 Win32Thread: fffff900c01e1010 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004de01d0 SynchronizationEvent fffffa8004a56800 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 29100 Ticks: 11190 (0:00:02:54.565) Context Switch Count 912 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address SHLWAPI!WrapperThreadProc (0x000007feff46c7d4) Stack Init fffff880054716b0 Current fffff880054708d0 Base fffff88005472000 Limit fffff8800546a000 Call fffff88005471920 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05470910 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05470a50 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`05470ae0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05470d90 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`05471260 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`054714b0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05471520) 00000000`052ef268 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`052ef270 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`052ef370 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`052ef400 000007fe`fba714e6 USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`052ef4a0 000007fe`fba716b2 DUser!CoreSC::Wait+0x62 00000000`052ef4f0 000007fe`fba711fa DUser!CoreSC::xwProcessNL+0xed 00000000`052ef560 00000000`775cbf21 DUser!MphProcessMessage+0xbd 00000000`052ef5c0 00000000`7781fdf5 USER32!_ClientGetMessageMPH+0x3d 00000000`052ef650 00000000`775cc92a ntdll!KiUserCallbackDispatcherContinue (TrapFrame @ 00000000`052ef518) 00000000`052ef6c8 00000000`775cc95e USER32!NtUserGetMessage+0xa 00000000`052ef6d0 000007fe`fb011700 USER32!GetMessageW+0x34 00000000`052ef700 000007fe`ff46c8ea stobject!SysTrayMain+0x40e 00000000`052ef9e0 00000000`776cf56d SHLWAPI!WrapperThreadProc+0x19b 00000000`052efae0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`052efb10 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004e25060 Cid 06ac.0124 Teb: 000007fffff88000 Win32Thread: fffff900c275d010 WAIT: (UserRequest) UserMode Alertable fffffa8004d2f860 NotificationEvent fffffa8004dbd9b0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 31641 Ticks: 8649 (0:00:02:14.925) Context Switch Count 487 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address SHLWAPI!WrapperThreadProc (0x000007feff46c7d4) Stack Init fffff88005497db0 Current fffff88005496fd0 Base fffff88005498000 Limit fffff8800548f000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05497010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05497150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`054971e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05497490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`05497960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`05497bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05497c20) 00000000`055bf718 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`055bf720 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`055bf820 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`055bf8b0 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`055bf950 000007fe`fb011264 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`055bf990 000007fe`ff46c8ea stobject!CSSOSharedThread::ThreadProc+0xb6 00000000`055bfe00 00000000`776cf56d SHLWAPI!WrapperThreadProc+0x19b 00000000`055bff00 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`055bff30 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004e2b060 Cid 06ac.0804 Teb: 000007fffff86000 Win32Thread: fffff900c2067c30 WAIT: (UserRequest) UserMode Alertable fffffa8004dca4d0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 29596 Ticks: 10694 (0:00:02:46.827) Context Switch Count 526 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.031 Win32 Start Address SHLWAPI!WrapperThreadProc (0x000007feff46c7d4) Stack Init fffff880054aadb0 Current fffff880054a9fd0 Base fffff880054ab000 Limit fffff880054a5000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`054aa010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`054aa150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`054aa1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`054aa490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`054aa960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`054aabb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`054aac20) 00000000`0520f478 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0520f480 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0520f580 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0520f610 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`0520f6b0 000007fe`fb011264 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`0520f6f0 000007fe`ff46c8ea stobject!CSSOSharedThread::ThreadProc+0xb6 00000000`0520fb60 00000000`776cf56d SHLWAPI!WrapperThreadProc+0x19b 00000000`0520fc60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0520fc90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004d25060 Cid 06ac.0808 Teb: 000007fffff84000 Win32Thread: fffff900c279cc30 WAIT: (UserRequest) UserMode Alertable fffffa8004e2a920 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 38781 Ticks: 1509 (0:00:00:23.540) Context Switch Count 137 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address MMDevApi!CDeviceEnumerator::PnpNotificationThreadWrapper (0x000007fefb8b6204) Stack Init fffff880054bddb0 Current fffff880054bcfd0 Base fffff880054be000 Limit fffff880054b6000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`054bd010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`054bd150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`054bd1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`054bd490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`054bd960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`054bdbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`054bdc20) 00000000`0568fa08 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0568fa10 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0568fb10 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0568fba0 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`0568fc40 000007fe`fb8b35be USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`0568fc80 00000000`776cf56d MMDevApi!CDeviceEnumerator::PnpNotificationThread+0x3d8 00000000`0568fdd0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0568fe00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004e39770 Cid 06ac.0810 Teb: 000007fffff82000 Win32Thread: fffff900c01e6010 WAIT: (UserRequest) UserMode Alertable fffffa8004ce98a0 SynchronizationEvent IRP List: fffffa80050c5010: (0006,03a0) Flags: 00060000 Mdl: 00000000 fffffa80050db010: (0006,03a0) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 20620 Ticks: 19670 (0:00:05:06.853) Context Switch Count 230 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.046 Win32 Start Address SHLWAPI!WrapperThreadProc (0x000007feff46c7d4) Stack Init fffff880054e4db0 Current fffff880054e3fd0 Base fffff880054e5000 Limit fffff880054dc000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`054e4010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`054e4150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`054e41e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`054e4490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`054e4960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`054e4bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`054e4c20) 00000000`059bf088 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`059bf090 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`059bf190 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`059bf220 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`059bf2c0 000007fe`fb011264 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`059bf300 000007fe`ff46c8ea stobject!CSSOSharedThread::ThreadProc+0xb6 00000000`059bf770 00000000`776cf56d SHLWAPI!WrapperThreadProc+0x19b 00000000`059bf870 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`059bf8a0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004e50660 Cid 06ac.0838 Teb: 000007fffff80000 Win32Thread: fffff900c2063010 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004e43800 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 23798 Ticks: 16492 (0:00:04:17.276) Context Switch Count 135 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.000 Win32 Start Address SHLWAPI!WrapperThreadProc (0x000007feff46c7d4) Stack Init fffff88005569db0 Current fffff880055696f0 Base fffff8800556a000 Limit fffff88005560000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05569730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05569870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05569900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`055699a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`05569a40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`05569a70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`05569b50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`05569b90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`05569c20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05569c20) 00000000`0585f978 00000000`775cc95e USER32!NtUserGetMessage+0xa 00000000`0585f980 000007fe`fb102f50 USER32!GetMessageW+0x34 00000000`0585f9b0 000007fe`ff46c8ea AltTab!CAltTabSSO::_ThreadProc+0x124 00000000`0585fa50 00000000`776cf56d SHLWAPI!WrapperThreadProc+0x19b 00000000`0585fb50 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0585fb80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004e6b580 Cid 06ac.0850 Teb: 000007fffff8e000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004a85060 QueueObject IRP List: fffffa80050e68b0: (0006,03a0) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 25270 Ticks: 15020 (0:00:03:54.313) Context Switch Count 48 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff8800444fdb0 Current fffff8800444f7d0 Base fffff88004450000 Limit fffff8800444a000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0444f810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0444f950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0444f9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0444fa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0444fb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0444fc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0444fc20) 00000000`04bcf848 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`04bcf850 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`04bcfb50 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`04bcfb80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004e2e060 Cid 06ac.0864 Teb: 000007fffff7e000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa80049246d0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 25700 Ticks: 14590 (0:00:03:47.605) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ole32!CRpcThreadCache::RpcWorkerThreadEntry (0x000007fefdb23570) Stack Init fffff880051f7db0 Current fffff880051f7900 Base fffff880051f8000 Limit fffff880051f2000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`051f7940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`051f7a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`051f7b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`051f7bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`051f7c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`051f7c20) 00000000`05c6f8b8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`05c6f8c0 000007fe`fdb0bde5 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`05c6f960 000007fe`fdc635c0 ole32!CDllHost::MTAWorkerLoop+0x23 00000000`05c6f990 000007fe`fdb22046 ole32!CDllHost::WorkerThread+0xd0 00000000`05c6f9d0 000007fe`fdb2358a ole32!CRpcThread::WorkerLoop+0x1e 00000000`05c6fa10 00000000`776cf56d ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1a 00000000`05c6fa40 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`05c6fa70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005065b60 Cid 06ac.09f4 Teb: 000007fffffa8000 Win32Thread: fffff900c202f850 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004ea3970 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 37026 Ticks: 3264 (0:00:00:50.918) Context Switch Count 24 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ole32!CRpcThreadCache::RpcWorkerThreadEntry (0x000007fefdb23570) Stack Init fffff88005553db0 Current fffff880055536f0 Base fffff88005554000 Limit fffff8800554d000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05553730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05553870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05553900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`055539a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`05553a40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`05553a70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`05553b50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`05553b90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`05553c20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05553c20) 00000000`04cef998 00000000`775cc95e USER32!NtUserGetMessage+0xa 00000000`04cef9a0 000007fe`fdb1ca7e USER32!GetMessageW+0x34 00000000`04cef9d0 000007fe`fdc635c7 ole32!CDllHost::STAWorkerLoop+0x8a 00000000`04cefa30 000007fe`fdb22046 ole32!CDllHost::WorkerThread+0xd7 00000000`04cefa70 000007fe`fdb2358a ole32!CRpcThread::WorkerLoop+0x1e 00000000`04cefab0 00000000`776cf56d ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1a 00000000`04cefae0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`04cefb10 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a09880 Cid 06ac.0bfc Teb: 000007fffffa6000 Win32Thread: fffff900c1ea6530 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004e1dbc0 NotificationEvent fffffa80045708d0 Semaphore Limit 0xffff fffffa8005067a50 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 38855 Ticks: 1435 (0:00:00:22.386) Context Switch Count 3108 LargeStack UserTime 00:00:00.202 KernelTime 00:00:00.062 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004d9fdb0 Current fffff88004d9efd0 Base fffff88004da0000 Limit fffff88004d97000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04d9f010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04d9f150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04d9f1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04d9f490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04d9f960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04d9fbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04d9fc20) 00000000`0552f198 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0552f1a0 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0552f2a0 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0552f330 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`0552f3d0 00000000`775c8880 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`0552f410 000007fe`fdfa301d USER32!MsgWaitForMultipleObjects+0x20 00000000`0552f450 000007fe`fdfa30e0 SHELL32!CShellTaskScheduler::_TT_MsgWaitForMultipleObjects+0x51 00000000`0552f4d0 000007fe`fdf9fdeb SHELL32!CShellTaskScheduler::TT_TransitionThreadToRunningOrTerminating+0xac 00000000`0552f550 000007fe`fdf9e3ca SHELL32!CShellTaskThread::ThreadProc+0x257 00000000`0552f5f0 000007fe`ff473a7f SHELL32!CShellTaskThread::s_ThreadProc+0x22 00000000`0552f620 00000000`777ef8eb SHLWAPI!ExecuteWorkItemThreadProc+0xf 00000000`0552f650 00000000`777e9d9f ntdll!RtlpTpWorkCallback+0x16b 00000000`0552f730 00000000`776cf56d ntdll!TppWorkerThread+0x5ff 00000000`0552fa30 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0552fa60 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a5eb60 Cid 06ac.0ae8 Teb: 000007fffffa4000 Win32Thread: fffff900c21cc250 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004e1dbc0 NotificationEvent fffffa80045708d0 Semaphore Limit 0xffff fffffa80044f1410 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 39776 Ticks: 514 (0:00:00:08.018) Context Switch Count 2574 LargeStack UserTime 00:00:00.187 KernelTime 00:00:00.218 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004e1cdb0 Current fffff88004e1bfd0 Base fffff88004e1d000 Limit fffff88004e14000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04e1c010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04e1c150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`04e1c1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04e1c490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04e1c960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04e1cbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04e1cc20) 00000000`0466f088 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0466f090 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0466f190 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0466f220 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`0466f2c0 00000000`775c8880 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`0466f300 000007fe`fdfa301d USER32!MsgWaitForMultipleObjects+0x20 00000000`0466f340 000007fe`fdfa30e0 SHELL32!CShellTaskScheduler::_TT_MsgWaitForMultipleObjects+0x51 00000000`0466f3c0 000007fe`fdf9fdeb SHELL32!CShellTaskScheduler::TT_TransitionThreadToRunningOrTerminating+0xac 00000000`0466f440 000007fe`fdf9e3ca SHELL32!CShellTaskThread::ThreadProc+0x257 00000000`0466f4e0 000007fe`ff473a7f SHELL32!CShellTaskThread::s_ThreadProc+0x22 00000000`0466f510 00000000`777ef8eb SHLWAPI!ExecuteWorkItemThreadProc+0xf 00000000`0466f540 00000000`777e9d9f ntdll!RtlpTpWorkCallback+0x16b 00000000`0466f620 00000000`776cf56d ntdll!TppWorkerThread+0x5ff 00000000`0466f920 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0466f950 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004fd27c0 Cid 06ac.0a94 Teb: 000007fffffa2000 Win32Thread: fffff900c1ed0c30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004e1dbc0 NotificationEvent fffffa80045708d0 Semaphore Limit 0xffff fffffa8004bf15f0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 38855 Ticks: 1435 (0:00:00:22.386) Context Switch Count 3279 LargeStack UserTime 00:00:00.078 KernelTime 00:00:00.093 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880059c3db0 Current fffff880059c2fd0 Base fffff880059c4000 Limit fffff880059bc000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`059c3010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`059c3150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`059c31e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`059c3490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`059c3960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`059c3bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`059c3c20) 00000000`08a5ef38 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`08a5ef40 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`08a5f040 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`08a5f0d0 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`08a5f170 00000000`775c8880 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`08a5f1b0 000007fe`fdfa301d USER32!MsgWaitForMultipleObjects+0x20 00000000`08a5f1f0 000007fe`fdfa30e0 SHELL32!CShellTaskScheduler::_TT_MsgWaitForMultipleObjects+0x51 00000000`08a5f270 000007fe`fdf9fdeb SHELL32!CShellTaskScheduler::TT_TransitionThreadToRunningOrTerminating+0xac 00000000`08a5f2f0 000007fe`fdf9e3ca SHELL32!CShellTaskThread::ThreadProc+0x257 00000000`08a5f390 000007fe`ff473a7f SHELL32!CShellTaskThread::s_ThreadProc+0x22 00000000`08a5f3c0 00000000`777ef8eb SHLWAPI!ExecuteWorkItemThreadProc+0xf 00000000`08a5f3f0 00000000`777e9d9f ntdll!RtlpTpWorkCallback+0x16b 00000000`08a5f4d0 00000000`776cf56d ntdll!TppWorkerThread+0x5ff 00000000`08a5f7d0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`08a5f800 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004fec660 Cid 06ac.0964 Teb: 000007fffff9a000 Win32Thread: fffff900c214e510 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004e1dbc0 NotificationEvent fffffa80045708d0 Semaphore Limit 0xffff fffffa8004ec3c90 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 39776 Ticks: 514 (0:00:00:08.018) Context Switch Count 2868 LargeStack UserTime 00:00:00.156 KernelTime 00:00:00.140 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880059b0db0 Current fffff880059affd0 Base fffff880059b1000 Limit fffff880059a8000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`059b0010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`059b0150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`059b01e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`059b0490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`059b0960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`059b0bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`059b0c20) 00000000`05daef88 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`05daef90 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`05daf090 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`05daf120 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`05daf1c0 00000000`775c8880 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`05daf200 000007fe`fdfa301d USER32!MsgWaitForMultipleObjects+0x20 00000000`05daf240 000007fe`fdfa30e0 SHELL32!CShellTaskScheduler::_TT_MsgWaitForMultipleObjects+0x51 00000000`05daf2c0 000007fe`fdf9fdeb SHELL32!CShellTaskScheduler::TT_TransitionThreadToRunningOrTerminating+0xac 00000000`05daf340 000007fe`fdf9e3ca SHELL32!CShellTaskThread::ThreadProc+0x257 00000000`05daf3e0 000007fe`ff473a7f SHELL32!CShellTaskThread::s_ThreadProc+0x22 00000000`05daf410 00000000`777ef8eb SHLWAPI!ExecuteWorkItemThreadProc+0xf 00000000`05daf440 00000000`777e9d9f ntdll!RtlpTpWorkCallback+0x16b 00000000`05daf520 00000000`776cf56d ntdll!TppWorkerThread+0x5ff 00000000`05daf820 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`05daf850 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005129810 Cid 06ac.0a80 Teb: 000007fffff98000 Win32Thread: fffff900c2144010 WAIT: (Executive) KernelMode Alertable fffffa8004af4178 SynchronizationEvent IRP List: fffffa8004d9f940: (0006,01f0) Flags: 00000884 Mdl: 00000000 Impersonation token: fffff8a00000a6f0 (Level Impersonation) Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 38670 Ticks: 1620 (0:00:00:25.272) Context Switch Count 977 LargeStack UserTime 00:00:00.031 KernelTime 00:00:00.031 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff8800595bdb0 Current fffff8800595aba0 Base fffff8800595c000 Limit fffff88005955000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0595abe0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0595ad20 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0595adb0 fffff800`01d2cdde nt!KeWaitForSingleObject+0x19f fffff880`0595ae50 fffff800`01d2cd73 nt!FsRtlCancellableWaitForMultipleObjects+0x5e fffff880`0595aeb0 fffff880`029bc739 nt!FsRtlCancellableWaitForSingleObject+0x27 fffff880`0595aef0 fffff880`029c8506 rdbss!RxWaitForStableCondition+0x11d fffff880`0595af30 fffff880`029c930e rdbss!RxFindOrCreateConnections+0x55e fffff880`0595b010 fffff880`029c2c4c rdbss!RxConstructVirtualNetRoot+0xb6 fffff880`0595b0b0 fffff880`029d6902 rdbss!RxFindOrConstructVirtualNetRoot+0x6b8 fffff880`0595b250 fffff880`029bf0bc rdbss!RxCreateTreeConnect+0x13e fffff880`0595b2e0 fffff880`0299eaa0 rdbss!RxCommonCreate+0x1ec fffff880`0595b3a0 fffff880`029bc614 rdbss!RxFsdCommonDispatch+0x870 fffff880`0595b490 fffff880`02de22c4 rdbss!RxFsdDispatch+0x224 fffff880`0595b500 fffff880`017bc271 mrxsmb!MRxSmbFsdDispatch+0xc0 fffff880`0595b540 fffff880`017ba138 mup!MupiCallUncProvider+0x161 fffff880`0595b5b0 fffff880`017bb64b mup!MupStateMachine+0x128 fffff880`0595b600 fffff880`0107a0b6 mup!MupCreate+0x2bf fffff880`0595b690 fffff800`01d8f807 fltmgr!FltpCreate+0xa6 fffff880`0595b740 fffff800`01d85e84 nt!IopParseDevice+0x5a7 fffff880`0595b8d0 fffff800`01d8ae4d nt!ObpLookupObjectName+0x585 fffff880`0595b9d0 fffff800`01d91917 nt!ObOpenObjectByName+0x1cd fffff880`0595ba80 fffff800`01d9b520 nt!IopCreateFile+0x2b7 fffff880`0595bb20 fffff800`01a8b993 nt!NtCreateFile+0x78 fffff880`0595bbb0 00000000`7782040a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0595bc20) 00000000`05a5e278 000007fe`f6f9b533 ntdll!ZwCreateFile+0xa 00000000`05a5e280 000007fe`f6f96dd7 browcli!NetpRdrFsControlTreeEx+0x343 00000000`05a5e3f0 000007fe`f6f95eaa browcli!RxpTransactSmb+0x26f 00000000`05a5e480 000007fe`f6f94aff browcli!RxRemoteApi+0x2b6 00000000`05a5e740 000007fe`f6f9509e browcli!RxNetServerEnumWorker+0x23b 00000000`05a5e880 000007fe`f6f934af browcli!RxNetServerEnum+0x1da 00000000`05a5e9b0 000007fe`f6f93187 browcli!EnumServersForTransport+0x15f 00000000`05a5ea70 000007fe`f6f92d10 browcli!NetServerEnumEx+0x45b 00000000`05a5ec20 000007fe`fafb49cc browcli!NetServerEnum+0x40 00000000`05a5ec80 000007fe`fafb2d18 ntlanman!SERVER_ENUMNODE::GetInfo+0x40 00000000`05a5ece0 000007fe`fd72a317 ntlanman!NPOpenEnum+0x495 00000000`05a5ed50 000007fe`fd72246f MPR!CProviderOpenEnum::TestProvider+0x43 00000000`05a5ed90 000007fe`fd72a33f MPR!CRoutedOperation::GetResult+0x145 00000000`05a5ee10 000007fe`fd72254d MPR!CProviderOpenEnum::GetResult+0x17 00000000`05a5ee40 000007fe`fd7224f9 MPR!CMprOperation::Perform+0x3f 00000000`05a5ee80 000007fe`fd72605c MPR!CRoutedOperation::Perform+0x29 THREAD fffffa8005119a00 Cid 06ac.0604 Teb: 000007fffff8c000 Win32Thread: fffff900c2138010 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004fb5880 SynchronizationEvent fffffa8004ff85a0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 40060 Ticks: 230 (0:00:00:03.588) Context Switch Count 24478 LargeStack UserTime 00:00:04.258 KernelTime 00:00:06.208 Win32 Start Address SHLWAPI!WrapperThreadProc (0x000007feff46c7d4) Stack Init fffff8800596e770 Current fffff8800596d990 Base fffff8800596f000 Limit fffff88005961000 Call fffff8800596e9e0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0596d9d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0596db10 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0596dba0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`0596de50 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`0596e320 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`0596e570 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0596e5e0) 00000000`0489f618 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0489f620 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0489f720 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0489f7b0 000007fe`fba714e6 USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`0489f850 000007fe`fba715ef DUser!CoreSC::Wait+0x62 00000000`0489f8a0 000007fe`fba71565 DUser!CoreSC::WaitMessage+0x6f 00000000`0489f8e0 00000000`775cbfce DUser!MphWaitMessageEx+0x5c 00000000`0489f910 00000000`7781fdf5 USER32!_ClientWaitMessageExMPH+0x1a 00000000`0489f960 00000000`775cbf5a ntdll!KiUserCallbackDispatcherContinue (TrapFrame @ 00000000`0489f828) 00000000`0489f9c8 000007fe`f8afba81 USER32!ZwUserWaitMessage+0xa 00000000`0489f9d0 000007fe`f8b29d91 EXPLORERFRAME!CExplorerFrame::FrameMessagePump+0x468 00000000`0489fa50 000007fe`f8b29f33 EXPLORERFRAME!BrowserThreadProc+0x180 00000000`0489fad0 000007fe`f8b29ec2 EXPLORERFRAME!BrowserNewThreadProc+0x53 00000000`0489fb00 000007fe`f8afb70c EXPLORERFRAME!CExplorerTask::InternalResumeRT+0x12 00000000`0489fb30 000007fe`fe2283fc EXPLORERFRAME!CRunnableTask::Run+0xda 00000000`0489fb60 000007fe`fe0ef0a1 SHELL32!CShellTask::TT_Run+0x124 00000000`0489fb90 000007fe`fdf9e3ca SHELL32!CShellTaskThread::ThreadProc+0x1d2 00000000`0489fc30 000007fe`ff46c8ea SHELL32!CShellTaskThread::s_ThreadProc+0x22 00000000`0489fc60 00000000`776cf56d SHLWAPI!WrapperThreadProc+0x19b 00000000`0489fd60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0489fd90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80049c1b60 Cid 06ac.0a24 Teb: 000007fffffa0000 Win32Thread: fffff900c2162250 WAIT: (WrQueue) UserMode Alertable fffffa8004d689d0 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 39826 Ticks: 464 (0:00:00:07.238) Context Switch Count 615 LargeStack UserTime 00:00:00.093 KernelTime 00:00:00.046 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880059d6db0 Current fffff880059d67d0 Base fffff880059d7000 Limit fffff880059d0000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`059d6810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`059d6950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`059d69e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`059d6a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`059d6b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`059d6c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`059d6c20) 00000000`0995f638 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0995f640 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0995f940 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0995f970 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004fb5060 Cid 06ac.0b90 Teb: 000007fffff96000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa800508ad40 NotificationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 23841 Ticks: 16449 (0:00:04:16.606) Context Switch Count 22 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address SHLWAPI!WrapperThreadProc (0x000007feff46c7d4) Stack Init fffff88005732db0 Current fffff88005732900 Base fffff88005733000 Limit fffff8800572d000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05732940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05732a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05732b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05732bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05732c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05732c20) 00000000`0a5ef7e8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0a5ef7f0 000007fe`f8015e45 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0a5ef890 000007fe`ff46c8ea NetworkItemFactory!BackgroundInitializeHandler+0x79 00000000`0a5ef8d0 00000000`776cf56d SHLWAPI!WrapperThreadProc+0x19b 00000000`0a5ef9d0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0a5efa00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005117b60 Cid 06ac.0a0c Teb: 000007fffff8a000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004fef210 NotificationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 23865 Ticks: 16425 (0:00:04:16.231) Context Switch Count 34 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address SHLWAPI!WrapperThreadProc (0x000007feff46c7d4) Stack Init fffff880045f2db0 Current fffff880045f2900 Base fffff880045f3000 Limit fffff880045ed000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`045f2940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`045f2a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`045f2b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`045f2bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`045f2c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`045f2c20) 00000000`0a6af8a8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0a6af8b0 000007fe`f80140cc KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0a6af950 000007fe`f8014133 NetworkItemFactory!CNetworkItemFactory::s_StartFDInMTA+0x100 00000000`0a6af9a0 000007fe`ff46c8ea NetworkItemFactory!FDBackgroundThreadHandler+0x1f 00000000`0a6af9d0 00000000`776cf56d SHLWAPI!WrapperThreadProc+0x19b 00000000`0a6afad0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0a6afb00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004550620 Cid 06ac.0958 Teb: 000007fffff7c000 Win32Thread: fffff900c213fc30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004ccfa60 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 38696 Ticks: 1594 (0:00:00:24.866) Context Switch Count 284 LargeStack UserTime 00:00:00.202 KernelTime 00:00:00.015 Win32 Start Address FunDisc!CNotificationQueue::ThreadProc (0x000007fef8ec5fd0) Stack Init fffff88004c9cdb0 Current fffff88004c9c900 Base fffff88004c9d000 Limit fffff88004c96000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04c9c940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04c9ca80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04c9cb10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04c9cbb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04c9cc20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04c9cc20) 00000000`0a77f958 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0a77f960 000007fe`f8ec609d KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0a77fa00 00000000`776cf56d FunDisc!CNotificationQueue::ThreadProc+0x376 00000000`0a77fa70 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0a77faa0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800504d060 Cid 06ac.01e8 Teb: 000007fffff78000 Win32Thread: fffff900c1eeac30 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004a12410 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 38781 Ticks: 1509 (0:00:00:23.540) Context Switch Count 623 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address WINMM!mciwindow (0x000007fef9741010) Stack Init fffff88004d4adb0 Current fffff88004d4a6f0 Base fffff88004d4b000 Limit fffff88004d43000 Call 0 Priority 13 BasePriority 10 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04d4a730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04d4a870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04d4a900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`04d4a9a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`04d4aa40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`04d4aa70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`04d4ab50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`04d4ab90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`04d4ac20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04d4ac20) 00000000`09c6fc28 00000000`775c899e USER32!NtUserGetMessage+0xa 00000000`09c6fc30 000007fe`f97410d5 USER32!GetMessageA+0xc4 00000000`09c6fc60 00000000`776cf56d WINMM!mciwindow+0x174 00000000`09c6fd00 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`09c6fd30 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004f72b60 Cid 06ac.0ac4 Teb: 000007fffff74000 Win32Thread: fffff900c21efc30 WAIT: (Executive) KernelMode Non-Alertable fffffa8004b0ed90 NotificationEvent IRP List: fffffa800518e8c0: (0006,01f0) Flags: 00060030 Mdl: fffffa80049514e0 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 40239 Ticks: 51 (0:00:00:00.795) Context Switch Count 1457 LargeStack UserTime 00:00:00.109 KernelTime 00:00:00.046 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880051c1db0 Current fffff880051c1460 Base fffff880051c2000 Limit fffff880051bb000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`051c14a0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`051c15e0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`051c1670 fffff880`037e7fa7 nt!KeWaitForSingleObject+0x19f fffff880`051c1710 fffff880`037eb00d bowser!BowserGetBrowserServerList+0x1bf fffff880`051c17e0 fffff880`037e97da bowser!GetBrowserServerList+0x2f9 fffff880`051c1890 fffff880`037db130 bowser!BowserCommonDeviceIoControlFile+0x742 fffff880`051c19e0 fffff800`01da7707 bowser!BowserFsdDispatch+0xa8 fffff880`051c1a10 fffff800`01da7f66 nt!IopXxxControlFile+0x607 fffff880`051c1b40 fffff800`01a8b993 nt!NtDeviceIoControlFile+0x56 fffff880`051c1bb0 00000000`7781ff2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`051c1c20) 00000000`08d8eb58 000007fe`f6f97db5 ntdll!NtDeviceIoControlFile+0xa 00000000`08d8eb60 000007fe`f6f98037 browcli!DeviceControlGetInfo+0xe1 00000000`08d8ebf0 000007fe`f6f934e7 browcli!GetBrowserServerList+0x10f 00000000`08d8ec60 000007fe`f6f93187 browcli!EnumServersForTransport+0x197 00000000`08d8ed20 000007fe`f6f92d10 browcli!NetServerEnumEx+0x45b 00000000`08d8eed0 000007fe`fafb49cc browcli!NetServerEnum+0x40 00000000`08d8ef30 000007fe`fafb2d18 ntlanman!SERVER_ENUMNODE::GetInfo+0x40 00000000`08d8ef90 000007fe`fd72a317 ntlanman!NPOpenEnum+0x495 00000000`08d8f000 000007fe`fd72246f MPR!CProviderOpenEnum::TestProvider+0x43 00000000`08d8f040 000007fe`fd72a33f MPR!CRoutedOperation::GetResult+0x145 00000000`08d8f0c0 000007fe`fd72254d MPR!CProviderOpenEnum::GetResult+0x17 00000000`08d8f0f0 000007fe`fd7224f9 MPR!CMprOperation::Perform+0x3f 00000000`08d8f130 000007fe`fd72605c MPR!CRoutedOperation::Perform+0x29 00000000`08d8f160 000007fe`f800371b MPR!WNetOpenEnumW+0x12f 00000000`08d8f230 000007fe`f8003d42 fdWNet!CWNetProvider::EnumerateFunc+0x8b 00000000`08d8f730 00000000`777ef8eb fdWNet!CWNetProvider::ThreadProc+0x66 00000000`08d8f770 00000000`777e9d9f ntdll!RtlpTpWorkCallback+0x16b 00000000`08d8f850 00000000`776cf56d ntdll!TppWorkerThread+0x5ff 00000000`08d8fb50 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`08d8fb80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005051060 Cid 06ac.0aa8 Teb: 000007fffff72000 Win32Thread: fffff900c21dc010 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d97540 NotificationEvent fffffa8005040bf0 NotificationEvent fffffa8003c2d2c0 NotificationEvent fffffa8004c56970 NotificationEvent fffffa800486ad90 NotificationEvent fffffa8004b49750 NotificationEvent fffffa800505d1b0 NotificationEvent fffffa8004fb6720 NotificationEvent fffffa8005163cb0 NotificationEvent fffffa8004e8ec70 NotificationEvent fffffa8004e999e0 NotificationEvent fffffa8004a66250 NotificationEvent fffffa8004e633e0 NotificationEvent fffffa8004dcd470 NotificationEvent fffffa8004a87a40 NotificationEvent fffffa8003c368e0 NotificationEvent fffffa8004f9ebe0 NotificationEvent fffffa8003c3c060 NotificationEvent fffffa8004f48d40 NotificationEvent fffffa8004a0b220 NotificationEvent fffffa8004dbdad0 NotificationEvent fffffa8004dc8490 NotificationEvent fffffa8004dc2b20 NotificationEvent fffffa8004ce6dc0 NotificationEvent fffffa80049d4aa0 NotificationEvent fffffa8004da3930 NotificationEvent fffffa8004da2250 NotificationEvent fffffa8004d94de0 NotificationEvent fffffa8004d94c10 NotificationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 39809 Ticks: 481 (0:00:00:07.503) Context Switch Count 795 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.062 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880056c8db0 Current fffff880056c7fd0 Base fffff880056c9000 Limit fffff880056c2000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`056c8010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`056c8150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`056c81e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`056c8490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`056c8960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`056c8bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`056c8c20) 00000000`0b52f758 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0b52f760 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0b52f860 000007fe`fe31f33d kernel32!WaitForMultipleObjects+0xb0 00000000`0b52f8f0 000007fe`fdf7919c SHELL32!CWaitTask::InternalResumeRT+0x1d 00000000`0b52f920 000007fe`fe2283fc SHELL32!CRunnableTask::Run+0xda 00000000`0b52f950 000007fe`fe0ef0a1 SHELL32!CShellTask::TT_Run+0x124 00000000`0b52f980 000007fe`fdf9e3ca SHELL32!CShellTaskThread::ThreadProc+0x1d2 00000000`0b52fa20 000007fe`ff473a7f SHELL32!CShellTaskThread::s_ThreadProc+0x22 00000000`0b52fa50 00000000`777ef8eb SHLWAPI!ExecuteWorkItemThreadProc+0xf 00000000`0b52fa80 00000000`777e9d9f ntdll!RtlpTpWorkCallback+0x16b 00000000`0b52fb60 00000000`776cf56d ntdll!TppWorkerThread+0x5ff 00000000`0b52fe60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0b52fe90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8003c2b060 Cid 06ac.0b4c Teb: 000007fffff70000 Win32Thread: fffff900c278bc30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004de7bd0 NotificationEvent fffffa8004ded2b0 Semaphore Limit 0xffff fffffa8004f0a560 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 39739 Ticks: 551 (0:00:00:08.595) Context Switch Count 572 LargeStack UserTime 00:00:00.046 KernelTime 00:00:00.015 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880058f9db0 Current fffff880058f8fd0 Base fffff880058fa000 Limit fffff880058f3000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`058f9010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`058f9150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`058f91e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`058f9490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`058f9960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`058f9bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`058f9c20) 00000000`0c4ff668 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0c4ff670 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0c4ff770 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0c4ff800 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`0c4ff8a0 00000000`775c8880 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`0c4ff8e0 000007fe`fdfa301d USER32!MsgWaitForMultipleObjects+0x20 00000000`0c4ff920 000007fe`fdfa30e0 SHELL32!CShellTaskScheduler::_TT_MsgWaitForMultipleObjects+0x51 00000000`0c4ff9a0 000007fe`fdf9fdeb SHELL32!CShellTaskScheduler::TT_TransitionThreadToRunningOrTerminating+0xac 00000000`0c4ffa20 000007fe`fdf9e3ca SHELL32!CShellTaskThread::ThreadProc+0x257 00000000`0c4ffac0 000007fe`ff473a7f SHELL32!CShellTaskThread::s_ThreadProc+0x22 00000000`0c4ffaf0 00000000`777ef8eb SHLWAPI!ExecuteWorkItemThreadProc+0xf 00000000`0c4ffb20 00000000`777e9d9f ntdll!RtlpTpWorkCallback+0x16b 00000000`0c4ffc00 00000000`776cf56d ntdll!TppWorkerThread+0x5ff 00000000`0c4fff00 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0c4fff30 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80050a6b60 Cid 06ac.0844 Teb: 000007fffff6c000 Win32Thread: fffff900c2036430 WAIT: (WrQueue) UserMode Alertable fffffa8004d689d0 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 39712 Ticks: 578 (0:00:00:09.016) Context Switch Count 917 LargeStack UserTime 00:00:00.031 KernelTime 00:00:00.015 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff8800504bdb0 Current fffff8800504b7d0 Base fffff8800504c000 Limit fffff88005045000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0504b810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0504b950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0504b9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0504ba90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0504bb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0504bc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0504bc20) 00000000`0a91f678 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0a91f680 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0a91f980 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0a91f9b0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005404060 Cid 06ac.08ac Teb: 000007fffff9c000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004d689d0 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004d4bb30 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 38760 Ticks: 1530 (0:00:00:23.868) Context Switch Count 192 UserTime 00:00:00.015 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff8800540ddb0 Current fffff8800540d7d0 Base fffff8800540e000 Limit fffff88005408000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0540d810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0540d950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0540d9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0540da90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0540db20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0540dc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0540dc20) 00000000`0b3ff998 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0b3ff9a0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0b3ffca0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0b3ffcd0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004e7db30 SessionId: 1 Cid: 0890 Peb: 7efdf000 ParentCid: 079c DirBase: 10935c000 ObjectTable: fffff8a002947420 HandleCount: 119. Image: concentr.exe VadRoot fffffa8004e94ce0 Vads 88 Clone 0 Private 328. Modified 3. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a002938060 ElapsedTime 00:08:46.263 UserTime 00:00:00.015 KernelTime 00:00:00.015 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1488, 50, 345) (5952KB, 200KB, 1380KB) PeakWorkingSetSize 1522 VirtualSize 66 Mb PeakVirtualSize 71 Mb PageFaultCount 1882 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 414 Setting context for this process... .process /p /r fffffa8004e7db30 THREAD fffffa8004e8d060 Cid 0890.0894 Teb: 000000007efdb000 Win32Thread: fffff900c2043660 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004eadc10 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004e7db30 Image: concentr.exe Attached Process N/A Image: N/A Wait Start TickCount 40193 Ticks: 97 (0:00:00:01.513) Context Switch Count 697 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.015 *** ERROR: Module load completed but symbols could not be loaded for concentr.exe Win32 Start Address concentr (0x0000000000a36a2b) Stack Init fffff8800442cdb0 Current fffff8800442c6f0 Base fffff8800442d000 Limit fffff88004424000 Call 0 Priority 13 BasePriority 8 UnusualBoost 3 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0442c730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0442c870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0442c900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`0442c9a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`0442ca40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`0442ca70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`0442cb50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`0442cb90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`0442cc20 00000000`7549fc2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0442cc20) 00000000`0018dbe8 00000000`7547ac48 wow64win!ZwUserGetMessage+0xa 00000000`0018dbf0 00000000`754ccf87 wow64win!whNtUserGetMessage+0x30 00000000`0018dc50 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`0018e510 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`0018e5d0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0018e620 00000000`778184c8 wow64!Wow64LdrpInitialize+0x429 00000000`0018eb70 00000000`77817623 ntdll!LdrpInitializeProcess+0x17e2 00000000`0018f070 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bea0 00000000`0018f0e0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004eee060 Cid 0890.08d4 Teb: 000000007efd5000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004eb89a0 SynchronizationTimer fffffa8004e0db00 SynchronizationTimer fffffa8004ebfb40 SynchronizationTimer Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004e7db30 Image: concentr.exe Attached Process N/A Image: N/A Wait Start TickCount 24166 Ticks: 16124 (0:00:04:11.536) Context Switch Count 6 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a11c7f Stack Init fffff880044d3db0 Current fffff880044d2fd0 Base fffff880044d4000 Limit fffff880044ce000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`044d3010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`044d3150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`044d31e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`044d3490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`044d3960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`044d3bb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`044d3c20) 00000000`00b9e9c8 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`00b9e9d0 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`00b9ea90 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`00b9eae0 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`00b9f030 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`00b9f0a0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004c778d0 Cid 0890.0b74 Teb: 000000007efd8000 Win32Thread: fffff900c212b010 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004de5380 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004e7db30 Image: concentr.exe Attached Process N/A Image: N/A Wait Start TickCount 17435 Ticks: 22855 (0:00:05:56.540) Context Switch Count 21 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x000000007454e980 Stack Init fffff880057e0db0 Current fffff880057e0900 Base fffff880057e1000 Limit fffff880057da000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`057e0940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`057e0a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`057e0b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`057e0bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`057e0c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`057e0c20) 00000000`00c1ef98 00000000`75452bcd wow64cpu!CpupSyscallStub+0x9 00000000`00c1efa0 00000000`754cd07e wow64cpu!Thunk0ArgReloadState+0x1a 00000000`00c1f060 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`00c1f0b0 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`00c1f600 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`00c1f670 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004a54060 Cid 0890.044c Teb: 000000007efa4000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8005079e90 Semaphore Limit 0x7fffffff fffffa8005026ab0 NotificationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004e7db30 Image: concentr.exe Attached Process N/A Image: N/A Wait Start TickCount 17435 Ticks: 22855 (0:00:05:56.540) Context Switch Count 5 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000074542fc0 Stack Init fffff8800592edb0 Current fffff8800592dfd0 Base fffff8800592f000 Limit fffff88005929000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0592e010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0592e150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0592e1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`0592e490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`0592e960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`0592ebb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0592ec20) 00000000`009cf008 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`009cf010 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`009cf0d0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`009cf120 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`009cf670 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`009cf6e0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800508f060 Cid 0890.0a7c Teb: 000000007efa1000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004df3d00 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004e7db30 Image: concentr.exe Attached Process N/A Image: N/A Wait Start TickCount 37051 Ticks: 3239 (0:00:00:50.528) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a12c91 Stack Init fffff880052dadb0 Current fffff880052da7d0 Base fffff880052db000 Limit fffff880052d5000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`052da810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`052da950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`052da9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`052daa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`052dab20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`052dac20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`052dac20) 00000000`024be208 00000000`754ea2df ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`024be210 00000000`754ccf87 wow64!whNtWaitForWorkViaWorkerFactory+0x23 00000000`024be260 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`024beb20 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`024bebe0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`024bec30 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`024bf180 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`024bf1f0 00000000`00000000 ntdll!LdrInitializeThunk+0xe PROCESS fffffa8004e97060 SessionId: 1 Cid: 08a0 Peb: 7efdf000 ParentCid: 079c DirBase: 108c3e000 ObjectTable: fffff8a002059010 HandleCount: 213. Image: jusched.exe VadRoot fffffa8004e95160 Vads 142 Clone 0 Private 537. Modified 4. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a002964a50 ElapsedTime 00:08:45.013 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (2435, 50, 345) (9740KB, 200KB, 1380KB) PeakWorkingSetSize 2472 VirtualSize 96 Mb PeakVirtualSize 102 Mb PageFaultCount 2832 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 667 Setting context for this process... .process /p /r fffffa8004e97060 THREAD fffffa8004d9e640 Cid 08a0.08a4 Teb: 000000007efdb000 Win32Thread: fffff900c2058c30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004eb5bc0 NotificationEvent fffffa8004e422e0 NotificationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004e97060 Image: jusched.exe Attached Process N/A Image: N/A Wait Start TickCount 26259 Ticks: 14031 (0:00:03:38.885) Context Switch Count 123 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.062 *** ERROR: Module load completed but symbols could not be loaded for jusched.exe Win32 Start Address jusched (0x000000000040bf9f) Stack Init fffff880040c3db0 Current fffff880040c2fd0 Base fffff880040c4000 Limit fffff880040bb000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`040c3010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`040c3150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`040c31e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`040c3490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`040c3960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`040c3bb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`040c3c20) 00000000`0008ebf8 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`0008ec00 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`0008ecc0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0008ed10 00000000`778184c8 wow64!Wow64LdrpInitialize+0x429 00000000`0008f260 00000000`77817623 ntdll!LdrpInitializeProcess+0x17e2 00000000`0008f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bea0 00000000`0008f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004c68060 Cid 08a0.0594 Teb: 000000007efd5000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004a237e0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004e97060 Image: jusched.exe Attached Process N/A Image: N/A Wait Start TickCount 25978 Ticks: 14312 (0:00:03:43.268) Context Switch Count 8 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00000000746f32fb Stack Init fffff88005224db0 Current fffff88005224900 Base fffff88005225000 Limit fffff8800521f000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05224940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05224a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05224b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05224bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05224c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05224c20) 00000000`003af0f8 00000000`75452bcd wow64cpu!CpupSyscallStub+0x9 00000000`003af100 00000000`754cd07e wow64cpu!Thunk0ArgReloadState+0x1a 00000000`003af1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`003af210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`003af760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`003af7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8003c29060 Cid 08a0.0aa0 Teb: 000000007efad000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004f10e60 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004e97060 Image: jusched.exe Attached Process N/A Image: N/A Wait Start TickCount 37517 Ticks: 2773 (0:00:00:43.259) Context Switch Count 8 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a12c91 Stack Init fffff8800522bdb0 Current fffff8800522b7d0 Base fffff8800522c000 Limit fffff88005226000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0522b810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0522b950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0522b9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0522ba90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0522bb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0522bc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0522bc20) 00000000`003ee7e8 00000000`754ea2df ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`003ee7f0 00000000`754ccf87 wow64!whNtWaitForWorkViaWorkerFactory+0x23 00000000`003ee840 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`003ef100 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`003ef1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`003ef210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`003ef760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`003ef7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa80050b1b60 Cid 08a0.05b8 Teb: 000000007efa7000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004556320 SynchronizationTimer fffffa8004556060 SynchronizationTimer fffffa8004def720 SynchronizationEvent fffffa80050dc9b0 SynchronizationTimer Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004e97060 Image: jusched.exe Attached Process N/A Image: N/A Wait Start TickCount 37517 Ticks: 2773 (0:00:00:43.259) Context Switch Count 5 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a11c7f Stack Init fffff88005302db0 Current fffff88005301fd0 Base fffff88005303000 Limit fffff880052fd000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05302010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05302150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`053021e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05302490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`05302960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`05302bb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05302c20) 00000000`02a7f0f8 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`02a7f100 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`02a7f1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`02a7f210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`02a7f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`02a7f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800455db60 Cid 08a0.07f8 Teb: 000000007efa4000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004f26360 NotificationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004e97060 Image: jusched.exe Attached Process N/A Image: N/A Wait Start TickCount 26045 Ticks: 14245 (0:00:03:42.223) Context Switch Count 30 UserTime 00:00:00.000 KernelTime 00:00:00.031 Win32 Start Address 0x0000000076c29493 Stack Init fffff88005323db0 Current fffff88005323900 Base fffff88005324000 Limit fffff8800531e000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05323940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05323a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05323b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05323bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05323c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05323c20) 00000000`02b2f0f8 00000000`75452bcd wow64cpu!CpupSyscallStub+0x9 00000000`02b2f100 00000000`754cd07e wow64cpu!Thunk0ArgReloadState+0x1a 00000000`02b2f1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`02b2f210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`02b2f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`02b2f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8005092b60 Cid 08a0.09ec Teb: 000000007efa1000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Non-Alertable fffffa800453b520 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004e97060 Image: jusched.exe Attached Process N/A Image: N/A Wait Start TickCount 26091 Ticks: 14199 (0:00:03:41.505) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000074356f14 Stack Init fffff8800532adb0 Current fffff8800532a7b0 Base fffff8800532b000 Limit fffff88005325000 Call 0 Priority 11 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0532a7f0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0532a930 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0532a9c0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0532aa70 fffff800`01d479a5 nt!IoRemoveIoCompletion+0x47 fffff880`0532ab00 fffff800`01a8b993 nt!NtRemoveIoCompletion+0x145 fffff880`0532abb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0532ac20) 00000000`031af0f8 00000000`75452a76 wow64cpu!CpupSyscallStub+0x9 00000000`031af100 00000000`754cd07e wow64cpu!RemoveIoCompletionFault+0x3d 00000000`031af1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`031af210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`031af760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`031af7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800540cb60 Cid 08a0.0940 Teb: 000000007efd8000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004dcf5f0 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004e97060 Image: jusched.exe Attached Process N/A Image: N/A Wait Start TickCount 37517 Ticks: 2773 (0:00:00:43.259) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a12c91 Stack Init fffff8800559fdb0 Current fffff8800559f7d0 Base fffff880055a0000 Limit fffff8800559a000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0559f810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0559f950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0559f9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0559fa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0559fb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0559fc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0559fc20) 00000000`0036e7e8 00000000`754ea2df ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0036e7f0 00000000`754ccf87 wow64!whNtWaitForWorkViaWorkerFactory+0x23 00000000`0036e840 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`0036f100 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`0036f1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0036f210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0036f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0036f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800540c660 Cid 08a0.0380 Teb: 000000007efaa000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004f10e60 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004e97060 Image: jusched.exe Attached Process N/A Image: N/A Wait Start TickCount 37517 Ticks: 2773 (0:00:00:43.259) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a12c91 Stack Init fffff88005598db0 Current fffff880055987d0 Base fffff88005599000 Limit fffff88005593000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05598810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05598950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`055989e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05598a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05598b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05598c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05598c20) 00000000`02a3e7e8 00000000`754ea2df ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`02a3e7f0 00000000`754ccf87 wow64!whNtWaitForWorkViaWorkerFactory+0x23 00000000`02a3e840 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`02a3f100 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`02a3f1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`02a3f210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`02a3f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`02a3f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe PROCESS fffffa8004ed62f0 SessionId: 1 Cid: 08ec Peb: 7fffffdb000 ParentCid: 01cc DirBase: 107cf8000 ObjectTable: 00000000 HandleCount: 0. Image: wlrmdr.exe VadRoot 0000000000000000 Vads 0 Clone 0 Private 1. Modified 2. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a00322c320 ElapsedTime 00:08:40.905 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (5, 50, 345) (20KB, 200KB, 1380KB) PeakWorkingSetSize 989 VirtualSize 37 Mb PeakVirtualSize 58 Mb PageFaultCount 1030 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 0 Setting context for this process... .process /p /r fffffa8004ed62f0 No active threads PROCESS fffffa8005094060 SessionId: 0 Cid: 0828 Peb: 7efdf000 ParentCid: 0210 DirBase: b2091000 ObjectTable: fffff8a00338b8a0 HandleCount: 102. Image: mscorsvw.exe VadRoot fffffa8004e01ce0 Vads 98 Clone 0 Private 497. Modified 59. Locked 0. DeviceMap fffff8a000008c10 Token fffff8a00365b240 ElapsedTime 00:07:35.566 UserTime 00:00:00.000 KernelTime 00:00:00.140 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1616, 50, 345) (6464KB, 200KB, 1380KB) PeakWorkingSetSize 2125 VirtualSize 46 Mb PeakVirtualSize 47 Mb PageFaultCount 4844 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 600 Setting context for this process... .process /p /r fffffa8005094060 THREAD fffffa80050d53f0 Cid 0828.02d4 Teb: 000000007efdb000 Win32Thread: fffff900c1c95010 WAIT: (UserRequest) UserMode Non-Alertable fffffa80051321b0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005094060 Image: mscorsvw.exe Attached Process N/A Image: N/A Wait Start TickCount 11127 Ticks: 29163 (0:00:07:34.945) Context Switch Count 37 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address mscorsvw!WinMainCRTStartup (0x000000001000c004) Stack Init fffff880053ecdb0 Current fffff880053ec900 Base fffff880053ed000 Limit fffff880053e5000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`053ec940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`053eca80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`053ecb10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`053ecbb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`053ecc20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`053ecc20) 00000000`0008ebf8 00000000`75452bcd wow64cpu!CpupSyscallStub+0x9 00000000`0008ec00 00000000`754cd07e wow64cpu!Thunk0ArgReloadState+0x1a 00000000`0008ecc0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0008ed10 00000000`778184c8 wow64!Wow64LdrpInitialize+0x429 00000000`0008f260 00000000`77817623 ntdll!LdrpInitializeProcess+0x17e2 00000000`0008f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bea0 00000000`0008f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa80050d4810 Cid 0828.020c Teb: 000000007efad000 Win32Thread: fffff900c1c9c010 WAIT: (UserRequest) UserMode Non-Alertable fffffa800501dfe0 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005094060 Image: mscorsvw.exe Attached Process N/A Image: N/A Wait Start TickCount 36528 Ticks: 3762 (0:00:00:58.687) Context Switch Count 2269 LargeStack UserTime 00:00:00.327 KernelTime 00:00:00.358 Win32 Start Address 0x0000000075587587 Stack Init fffff88005638db0 Current fffff88005637fd0 Base fffff88005639000 Limit fffff88005630000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05638010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05638150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`056381e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05638490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`05638960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`05638bb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05638c20) 00000000`0081f0f8 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`0081f100 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`0081f1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0081f210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0081f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0081f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa80050a44c0 Cid 0828.0840 Teb: 000000007efaa000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa800501dfe0 NotificationEvent fffffa8004f9b510 NotificationEvent fffffa8004c4b5a0 NotificationEvent fffffa8004e1d9c0 NotificationEvent fffffa8004f15c10 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005094060 Image: mscorsvw.exe Attached Process N/A Image: N/A Wait Start TickCount 21140 Ticks: 19150 (0:00:04:58.741) Context Switch Count 188 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x000000006405c066 Stack Init fffff880055fedb0 Current fffff880055fdfd0 Base fffff880055ff000 Limit fffff880055f9000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`055fe010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`055fe150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`055fe1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`055fe490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`055fe960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`055febb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`055fec20) 00000000`0087f0f8 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`0087f100 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`0087f1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0087f210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0087f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0087f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa80050ff060 Cid 0828.086c Teb: 000000007efa7000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8005026060 SynchronizationTimer fffffa8005043060 SynchronizationTimer fffffa8004f4aa80 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005094060 Image: mscorsvw.exe Attached Process N/A Image: N/A Wait Start TickCount 40069 Ticks: 221 (0:00:00:03.447) Context Switch Count 8 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a11c7f Stack Init fffff880051aedb0 Current fffff880051adfd0 Base fffff880051af000 Limit fffff880051a9000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`051ae010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`051ae150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`051ae1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`051ae490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`051ae960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`051aebb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`051aec20) 00000000`00def0f8 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`00def100 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`00def1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`00def210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`00def760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`00def7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004e1fb60 Cid 0828.0794 Teb: 000000007efd5000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8005044c60 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005094060 Image: mscorsvw.exe Attached Process N/A Image: N/A Wait Start TickCount 40069 Ticks: 221 (0:00:00:03.447) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a12c91 Stack Init fffff8800402edb0 Current fffff8800402e7d0 Base fffff8800402f000 Limit fffff88004029000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0402e810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0402e950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0402e9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0402ea90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0402eb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0402ec20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0402ec20) 00000000`0068e7e8 00000000`754ea2df ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0068e7f0 00000000`754ccf87 wow64!whNtWaitForWorkViaWorkerFactory+0x23 00000000`0068e840 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`0068f100 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`0068f1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0068f210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0068f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0068f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004f87700 Cid 0828.145ac Teb: 000000007efd8000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80050ff570 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005094060 Image: mscorsvw.exe Attached Process N/A Image: N/A Wait Start TickCount 40069 Ticks: 221 (0:00:00:03.447) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a12c91 Stack Init fffff8800451adb0 Current fffff8800451a7d0 Base fffff8800451b000 Limit fffff88004515000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0451a810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0451a950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0451a9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0451aa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0451ab20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0451ac20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0451ac20) 00000000`0050e7e8 00000000`754ea2df ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0050e7f0 00000000`754ccf87 wow64!whNtWaitForWorkViaWorkerFactory+0x23 00000000`0050e840 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`0050f100 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`0050f1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0050f210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0050f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0050f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004ecc060 Cid 0828.145b0 Teb: 000000007efa4000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8005044c60 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005094060 Image: mscorsvw.exe Attached Process N/A Image: N/A Wait Start TickCount 40069 Ticks: 221 (0:00:00:03.447) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a12c91 Stack Init fffff880025dadb0 Current fffff880025da7d0 Base fffff880025db000 Limit fffff880025d5000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`025da810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`025da950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`025da9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`025daa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`025dab20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`025dac20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`025dac20) 00000000`018ee7e8 00000000`754ea2df ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`018ee7f0 00000000`754ccf87 wow64!whNtWaitForWorkViaWorkerFactory+0x23 00000000`018ee840 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`018ef100 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`018ef1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`018ef210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`018ef760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`018ef7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe PROCESS fffffa80050a2060 SessionId: 0 Cid: 071c Peb: 7fffffdb000 ParentCid: 0210 DirBase: b0fa4000 ObjectTable: fffff8a003687d70 HandleCount: 98. Image: mscorsvw.exe VadRoot fffffa8004eea6e0 Vads 86 Clone 0 Private 713. Modified 52. Locked 0. DeviceMap fffff8a000008c10 Token fffff8a0028adc50 ElapsedTime 00:07:33.941 UserTime 00:00:00.015 KernelTime 00:00:00.015 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1935, 50, 345) (7740KB, 200KB, 1380KB) PeakWorkingSetSize 2509 VirtualSize 47 Mb PeakVirtualSize 47 Mb PageFaultCount 5114 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 821 Setting context for this process... .process /p /r fffffa80050a2060 THREAD fffffa800506d6d0 Cid 071c.0788 Teb: 000007fffffde000 Win32Thread: fffff900c1c9a190 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004ae2310 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80050a2060 Image: mscorsvw.exe Attached Process N/A Image: N/A Wait Start TickCount 11224 Ticks: 29066 (0:00:07:33.432) Context Switch Count 37 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address mscorsvw!WinMainCRTStartup (0x0000000010007840) Stack Init fffff88005625db0 Current fffff88005625900 Base fffff88005626000 Limit fffff8800561e000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05625940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05625a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05625b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05625bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05625c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05625c20) 00000000`0012f118 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0012f120 000007fe`ff4eaffb KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0012f1c0 000007fe`ff4e9d61 sechost!ScSendResponseReceiveControls+0x13b 00000000`0012f2b0 000007fe`ff4e9c16 sechost!ScDispatcherLoop+0x121 00000000`0012f3c0 00000642`ffb6171e sechost!StartServiceCtrlDispatcherW+0x14e 00000000`0012f410 00000642`ffb73b0b mscorsvc!CLRStartServiceCtrlDispatcher+0x2e 00000000`0012f440 00000000`1000b43f mscorsvc!NGENService::ServiceEntryPoint+0x10b 00000000`0012f6d0 00000000`10008dc2 mscorsvw!Service+0x12f 00000000`0012f750 00000000`1000767c mscorsvw!CxxThrowException+0xca6 00000000`0012feb0 00000000`776cf56d mscorsvw!GetRequestedRuntimeInfo+0x1ee 00000000`0012ff60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0012ff90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004e68790 Cid 071c.0700 Teb: 000007fffffd7000 Win32Thread: fffff900c1ca5470 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004fda950 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80050a2060 Image: mscorsvw.exe Attached Process N/A Image: N/A Wait Start TickCount 37492 Ticks: 2798 (0:00:00:43.649) Context Switch Count 3588 LargeStack UserTime 00:00:00.296 KernelTime 00:00:00.280 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff880056f0db0 Current fffff880056effd0 Base fffff880056f1000 Limit fffff880056e9000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`056f0010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`056f0150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`056f01e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`056f0490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`056f0960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`056f0bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`056f0c20) 00000000`00eff948 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`00eff950 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`00effa50 00000642`ffb706a7 kernel32!WaitForMultipleObjects+0xb0 00000000`00effae0 00000642`ffb72552 mscorsvc!NGENService::WaitForNextStateMachineCheck+0x37 00000000`00effb10 00000642`ffb72c51 mscorsvc!NGENService::ControlStateMachineWaitHelper+0x82 00000000`00effb90 00000642`ffb734f5 mscorsvc!NGENService::ExecuteControllerStateMachine+0x131 00000000`00effbf0 00000642`ffb73764 mscorsvc!NGENService::ControllerRun+0xa5 00000000`00effea0 00000642`ffb739ab mscorsvc!NGENService::ServiceWorker+0x64 00000000`00effed0 000007fe`ff4ea82d mscorsvc!NGENService::ServiceMain+0x22b 00000000`00efff30 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`00efff60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00efff90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800512b060 Cid 071c.0170 Teb: 000007fffffd5000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004fda950 NotificationEvent fffffa800511a320 NotificationEvent fffffa800511a060 NotificationEvent fffffa8004e04590 NotificationEvent fffffa8004f062c0 NotificationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80050a2060 Image: mscorsvw.exe Attached Process N/A Image: N/A Wait Start TickCount 37492 Ticks: 2798 (0:00:00:43.649) Context Switch Count 620 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address mscorsvc!NGENService::Listener (0x00000642ffb729c0) Stack Init fffff880040cadb0 Current fffff880040c9fd0 Base fffff880040cb000 Limit fffff880040c5000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`040ca010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`040ca150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`040ca1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`040ca490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`040ca960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`040cabb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`040cac20) 00000000`00fffcf8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`00fffd00 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`00fffe00 00000642`ffb70887 kernel32!WaitForMultipleObjects+0xb0 00000000`00fffe90 00000642`ffb72ad6 mscorsvc!NGENService::WaitForNextListenerCheck+0x57 00000000`00ffff00 00000000`776cf56d mscorsvc!NGENService::Listener+0x116 00000000`00ffff60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00ffff90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005104240 Cid 071c.0888 Teb: 000007fffffd3000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004d10600 SynchronizationTimer fffffa8004f0ec60 SynchronizationTimer fffffa8004ef8060 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80050a2060 Image: mscorsvw.exe Attached Process N/A Image: N/A Wait Start TickCount 40244 Ticks: 46 (0:00:00:00.717) Context Switch Count 8 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff880056cfdb0 Current fffff880056cefd0 Base fffff880056d0000 Limit fffff880056ca000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`056cf010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`056cf150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`056cf1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`056cf490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`056cf960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`056cfbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`056cfc20) 00000000`010ffcb8 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`010ffcc0 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`010fff60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`010fff90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800454f6d0 Cid 071c.0450 Teb: 000007fffffac000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa800454fa90 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80050a2060 Image: mscorsvw.exe Attached Process N/A Image: N/A Wait Start TickCount 36529 Ticks: 3761 (0:00:00:58.671) Context Switch Count 10 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ole32!CRpcThreadCache::RpcWorkerThreadEntry (0x000007fefdb23570) Stack Init fffff8800510bdb0 Current fffff8800510b970 Base fffff8800510c000 Limit fffff88005106000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0510b9b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0510baf0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`0510bb80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`0510bbf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`0510bc20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0510bc20) 00000000`01cbfe18 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`01cbfe20 000007fe`fdb1ea00 KERNELBASE!SleepEx+0xab 00000000`01cbfec0 000007fe`fdb22046 ole32!CROIDTable::WorkerThreadLoop+0x10 00000000`01cbfef0 000007fe`fdb2358a ole32!CRpcThread::WorkerLoop+0x1e 00000000`01cbff30 00000000`776cf56d ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x1a 00000000`01cbff60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01cbff90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800540eb60 Cid 071c.09a8 Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8003c452e0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80050a2060 Image: mscorsvw.exe Attached Process N/A Image: N/A Wait Start TickCount 40244 Ticks: 46 (0:00:00:00.717) Context Switch Count 158 UserTime 00:00:00.000 KernelTime 00:00:00.046 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004814db0 Current fffff880048147d0 Base fffff88004815000 Limit fffff8800480f000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04814810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04814950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`048149e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04814a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04814b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04814c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04814c20) 00000000`018efc58 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`018efc60 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`018eff60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`018eff90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005108b60 Cid 071c.145b4 Teb: 000007fffffdc000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa80049d1c30 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80050a2060 Image: mscorsvw.exe Attached Process N/A Image: N/A Wait Start TickCount 40244 Ticks: 46 (0:00:00:00.717) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005675db0 Current fffff880056757d0 Base fffff88005676000 Limit fffff88005670000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05675810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05675950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`056759e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05675a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05675b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05675c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05675c20) 00000000`00cffc58 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`00cffc60 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`00cfff60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00cfff90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004f56060 Cid 071c.145b8 Teb: 000007fffffd9000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8003c452e0 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa80050a2060 Image: mscorsvw.exe Attached Process N/A Image: N/A Wait Start TickCount 40244 Ticks: 46 (0:00:00:00.717) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88007bbfdb0 Current fffff88007bbf7d0 Base fffff88007bc0000 Limit fffff88007bba000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`07bbf810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`07bbf950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`07bbf9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`07bbfa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`07bbfb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`07bbfc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`07bbfc20) 00000000`00dffc58 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`00dffc60 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`00dfff60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00dfff90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8005101060 SessionId: 0 Cid: 081c Peb: 7fffffdf000 ParentCid: 0210 DirBase: b5fec000 ObjectTable: fffff8a00350e3f0 HandleCount: 129. Image: TrustedInstaller.exe VadRoot fffffa8004e702f0 Vads 90 Clone 0 Private 995. Modified 700. Locked 0. DeviceMap fffff8a000008c10 Token fffff8a0038b73d0 ElapsedTime 00:07:33.379 UserTime 00:00:07.363 KernelTime 00:00:01.575 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (2526, 50, 345) (10104KB, 200KB, 1380KB) PeakWorkingSetSize 4145 VirtualSize 66 Mb PeakVirtualSize 72 Mb PageFaultCount 89236 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 1398 Setting context for this process... .process /p /r fffffa8005101060 THREAD fffffa8004f3a700 Cid 081c.080c Teb: 000007fffffdd000 Win32Thread: fffff900c1ca6010 WAIT: (UserRequest) UserMode Non-Alertable fffffa800515a0f0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005101060 Image: TrustedInstaller.exe Attached Process N/A Image: N/A Wait Start TickCount 11252 Ticks: 29038 (0:00:07:32.995) Context Switch Count 21 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address TrustedInstaller!wmainCRTStartup (0x00000000ff12d8c4) Stack Init fffff88005667db0 Current fffff88005667900 Base fffff88005668000 Limit fffff88005661000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05667940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05667a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05667b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05667bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05667c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05667c20) 00000000`001ef9f8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`001efa00 000007fe`ff4eaffb KERNELBASE!WaitForSingleObjectEx+0x79 00000000`001efaa0 000007fe`ff4e9d61 sechost!ScSendResponseReceiveControls+0x13b 00000000`001efb90 000007fe`ff4e9c16 sechost!ScDispatcherLoop+0x121 00000000`001efca0 00000000`ff11dd16 sechost!StartServiceCtrlDispatcherW+0x14e 00000000`001efcf0 00000000`ff12d775 TrustedInstaller!wmain+0xc2 00000000`001efd50 00000000`776cf56d TrustedInstaller!TextizeJetErrorHresult+0x193d 00000000`001efd90 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`001efdc0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80050f9b60 Cid 081c.079c Teb: 000007fffffd7000 Win32Thread: fffff900c1cabc30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8005026b30 NotificationEvent fffffa8004f163a0 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005101060 Image: TrustedInstaller.exe Attached Process N/A Image: N/A Wait Start TickCount 20158 Ticks: 20132 (0:00:05:14.061) Context Switch Count 84530 LargeStack UserTime 00:00:00.062 KernelTime 00:00:00.499 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff880056a2db0 Current fffff880056a1fd0 Base fffff880056a3000 Limit fffff88005699000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`056a2010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`056a2150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`056a21e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`056a2490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`056a2960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`056a2bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`056a2c20) 00000000`00c6f5f8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`00c6f600 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`00c6f700 00000000`ff11d183 kernel32!WaitForMultipleObjects+0xb0 00000000`00c6f790 00000000`ff11db27 TrustedInstaller!TiRunIdleProcessingAndWait+0x417 00000000`00c6f800 000007fe`ff4ea82d TrustedInstaller!TiMain+0x313 00000000`00c6f8a0 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`00c6f8d0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00c6f900 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800516bb60 Cid 081c.0648 Teb: 000007fffffd3000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8005050d10 SynchronizationTimer fffffa800504c800 SynchronizationTimer fffffa8004fa70e0 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005101060 Image: TrustedInstaller.exe Attached Process N/A Image: N/A Wait Start TickCount 22799 Ticks: 17491 (0:00:04:32.861) Context Switch Count 5 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff8800566edb0 Current fffff8800566dfd0 Base fffff8800566f000 Limit fffff88005669000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0566e010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0566e150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0566e1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`0566e490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`0566e960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`0566ebb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0566ec20) 00000000`00e2f8e8 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`00e2f8f0 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`00e2fb90 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00e2fbc0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004fef2c0 Cid 081c.04b0 Teb: 000007fffffd5000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004d23a80 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005101060 Image: TrustedInstaller.exe Attached Process N/A Image: N/A Wait Start TickCount 39647 Ticks: 643 (0:00:00:10.030) Context Switch Count 7 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88004cb8db0 Current fffff88004cb87d0 Base fffff88004cb9000 Limit fffff88004cb3000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04cb8810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04cb8950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04cb89e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04cb8a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04cb8b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04cb8c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04cb8c20) 00000000`01effc38 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`01effc40 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`01efff40 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01efff70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800519ab60 Cid 081c.06a0 Teb: 000007fffffdb000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004d23a80 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa8005101060 Image: TrustedInstaller.exe Attached Process N/A Image: N/A Wait Start TickCount 39647 Ticks: 643 (0:00:00:10.030) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880054fedb0 Current fffff880054fe7d0 Base fffff880054ff000 Limit fffff880054f9000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`054fe810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`054fe950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`054fe9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`054fea90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`054feb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`054fec20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`054fec20) 00000000`00f4f948 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`00f4f950 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`00f4fc50 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00f4fc80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8005175a60 SessionId: 0 Cid: 0438 Peb: 7fffffda000 ParentCid: 0210 DirBase: aacb6000 ObjectTable: fffff8a0037d76a0 HandleCount: 148. Image: msdtc.exe VadRoot fffffa8004f1e970 Vads 148 Clone 0 Private 711. Modified 2. Locked 0. DeviceMap fffff8a001f05400 Token fffff8a0037c2250 ElapsedTime 00:07:23.413 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1841, 50, 345) (7364KB, 200KB, 1380KB) PeakWorkingSetSize 1866 VirtualSize 60 Mb PeakVirtualSize 61 Mb PageFaultCount 2085 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 851 Setting context for this process... .process /p /r fffffa8005175a60 THREAD fffffa80051678c0 Cid 0438.05e4 Teb: 000007fffffde000 Win32Thread: fffff900c1c9a6e0 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004e984d0 SynchronizationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8005175a60 Image: msdtc.exe Attached Process N/A Image: N/A Wait Start TickCount 12088 Ticks: 28202 (0:00:07:19.954) Context Switch Count 81 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address msdtc!wWinMainCRTStartup (0x000000013f1284a4) Stack Init fffff88005812db0 Current fffff88005812900 Base fffff88005813000 Limit fffff8800580b000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05812940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05812a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05812b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05812bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05812c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05812c20) 00000000`000bf2e8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`000bf2f0 000007fe`ff4eaffb KERNELBASE!WaitForSingleObjectEx+0x79 00000000`000bf390 000007fe`ff4e9d61 sechost!ScSendResponseReceiveControls+0x13b 00000000`000bf480 000007fe`ff4e9c16 sechost!ScDispatcherLoop+0x121 00000000`000bf590 000007fe`f1bf7a1a sechost!StartServiceCtrlDispatcherW+0x14e 00000000`000bf5e0 000007fe`f1bf34ff MSDTCTM!CDtcService::Start+0x72 00000000`000bf670 00000001`3f123cec MSDTCTM!DtcMainExt+0x10bb 00000000`000bf7a0 00000001`3f128332 msdtc!wWinMain+0x1b0 00000000`000bf7e0 00000000`776cf56d msdtc!operator delete+0x206 00000000`000bf8a0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`000bf8d0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a4a120 Cid 0438.09b4 Teb: 000007fffffd8000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8005094860 QueueObject Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8005175a60 Image: msdtc.exe Attached Process N/A Image: N/A Wait Start TickCount 36969 Ticks: 3321 (0:00:00:51.807) Context Switch Count 16 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff8800523adb0 Current fffff8800523a7d0 Base fffff8800523b000 Limit fffff88005235000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0523a810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0523a950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0523a9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0523aa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0523ab20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0523ac20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0523ac20) 00000000`0237f7a8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0237f7b0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0237fab0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0237fae0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80050afb60 Cid 0438.0994 Teb: 000007fffffd6000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8003c4cb60 Thread Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8005175a60 Image: msdtc.exe Attached Process N/A Image: N/A Wait Start TickCount 12615 Ticks: 27675 (0:00:07:11.732) Context Switch Count 196 UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address sechost!ScSvcctrlThreadW (0x000007feff4ea808) Stack Init fffff880042d3db0 Current fffff880042d3900 Base fffff880042d4000 Limit fffff880042ce000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`042d3940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`042d3a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`042d3b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`042d3bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`042d3c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`042d3c20) 00000000`020af798 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`020af7a0 000007fe`f1bf8679 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`020af840 000007fe`ff4ea82d MSDTCTM!ServiceMain+0x641 00000000`020af900 00000000`776cf56d sechost!ScSvcctrlThreadW+0x25 00000000`020af930 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`020af960 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8003c4cb60 Cid 0438.0934 Teb: 000007fffffd4000 Win32Thread: fffff900c1cbec30 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004f20b10 SynchronizationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8005175a60 Image: msdtc.exe Attached Process N/A Image: N/A Wait Start TickCount 12603 Ticks: 27687 (0:00:07:11.919) Context Switch Count 270 LargeStack UserTime 00:00:00.031 KernelTime 00:00:00.015 Win32 Start Address MSDTCTM!DTCDummy (0x000007fef1bf7ffc) Stack Init fffff880058e6db0 Current fffff880058e66f0 Base fffff880058e7000 Limit fffff880058e0000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`058e6730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`058e6870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`058e6900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`058e69a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`058e6a40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`058e6a70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`058e6b50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`058e6b90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`058e6c20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`058e6c20) 00000000`0247fdf8 00000000`775c899e USER32!NtUserGetMessage+0xa 00000000`0247fe00 000007fe`f1bf4c4f USER32!GetMessageA+0xc4 00000000`0247fe30 000007fe`f1bf8016 MSDTCTM!DtcMain+0x5e3 00000000`0247ff20 00000000`776cf56d MSDTCTM!DTCDummy+0x1a 00000000`0247ff50 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0247ff80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80050a1810 Cid 0438.08cc Teb: 000007fffffac000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004b373c0 SynchronizationEvent fffffa8004e69c30 SynchronizationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8005175a60 Image: msdtc.exe Attached Process N/A Image: N/A Wait Start TickCount 12532 Ticks: 27758 (0:00:07:13.027) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address MSDTCTM!ThreadProc (0x000007fef1c12948) Stack Init fffff88005862db0 Current fffff88005861fd0 Base fffff88005863000 Limit fffff8800585d000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05862010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05862150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`058621e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05862490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`05862960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`05862bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05862c20) 00000000`0229fc68 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0229fc70 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0229fd70 000007fe`f1c12a13 kernel32!WaitForMultipleObjects+0xb0 00000000`0229fe00 00000000`776cf56d MSDTCTM!ThreadProc+0xcb 00000000`0229fe70 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0229fea0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80050d2b60 Cid 0438.08c8 Teb: 000007fffffaa000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8005083bb0 NotificationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8005175a60 Image: msdtc.exe Attached Process N/A Image: N/A Wait Start TickCount 16132 Ticks: 24158 (0:00:06:16.867) Context Switch Count 513 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address MSDTCPRX!CConnectionManager::TimerProc (0x000007fef1ac8b20) Stack Init fffff88005869db0 Current fffff88005869900 Base fffff8800586a000 Limit fffff88005864000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05869940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05869a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05869b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05869bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05869c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05869c20) 00000000`02c2fa58 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`02c2fa60 000007fe`f1ac904f KERNELBASE!WaitForSingleObjectEx+0x79 00000000`02c2fb00 000007fe`f1ac8b34 MSDTCPRX!CConnectionManager::TimerProcForGuardedUser+0x3a3 00000000`02c2fbb0 00000000`776cf56d MSDTCPRX!CConnectionManager::TimerProc+0x14 00000000`02c2fbe0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`02c2fc10 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005169060 Cid 0438.0a8c Teb: 000007fffffa8000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004bd7740 NotificationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8005175a60 Image: msdtc.exe Attached Process N/A Image: N/A Wait Start TickCount 12542 Ticks: 27748 (0:00:07:12.871) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address MSDTCPRX!CConnectionManager::TimerProc (0x000007fef1ac8b20) Stack Init fffff88005896db0 Current fffff88005896900 Base fffff88005897000 Limit fffff88005891000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05896940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05896a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05896b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05896bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05896c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05896c20) 00000000`01aefb68 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`01aefb70 000007fe`f1ac8c5e KERNELBASE!WaitForSingleObjectEx+0x79 00000000`01aefc10 000007fe`f1ac8b3b MSDTCPRX!CConnectionManager::TimerProcForNonGuardedUser+0x116 00000000`01aefc70 00000000`776cf56d MSDTCPRX!CConnectionManager::TimerProc+0x1b 00000000`01aefca0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01aefcd0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80050d3b60 Cid 0438.0914 Teb: 000007fffffa6000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d5cee0 NotificationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8005175a60 Image: msdtc.exe Attached Process N/A Image: N/A Wait Start TickCount 12876 Ticks: 27414 (0:00:07:07.661) Context Switch Count 32 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address MSDTCTM!UIServerThread (0x000007fef1c28a4c) Stack Init fffff8800589ddb0 Current fffff8800589d900 Base fffff8800589e000 Limit fffff88005898000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0589d940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0589da80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0589db10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`0589dbb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`0589dc20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0589dc20) 00000000`0305fbf8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0305fc00 000007fe`f1c29037 KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0305fca0 00000000`776cf56d MSDTCTM!UIServerThread+0x5eb 00000000`0305fd60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0305fd90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005075060 Cid 0438.09a4 Teb: 000007fffffa4000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8005165ba0 SynchronizationTimer fffffa8004dc94f0 SynchronizationTimer fffffa8005165a30 SynchronizationTimer Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8005175a60 Image: msdtc.exe Attached Process N/A Image: N/A Wait Start TickCount 24084 Ticks: 16206 (0:00:04:12.815) Context Switch Count 9 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff880058abdb0 Current fffff880058aafd0 Base fffff880058ac000 Limit fffff880058a6000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`058ab010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`058ab150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`058ab1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`058ab490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`058ab960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`058abbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`058abc20) 00000000`02fdfc28 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`02fdfc30 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`02fdfed0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`02fdff00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005062b60 Cid 0438.091c Teb: 000007fffffa2000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d61060 NotificationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8005175a60 Image: msdtc.exe Attached Process N/A Image: N/A Wait Start TickCount 12548 Ticks: 27742 (0:00:07:12.777) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address MSDTCPRX!CConnectionManager::TimerProc (0x000007fef1ac8b20) Stack Init fffff880058a4db0 Current fffff880058a4900 Base fffff880058a5000 Limit fffff8800589f000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`058a4940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`058a4a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`058a4b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`058a4bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`058a4c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`058a4c20) 00000000`0310f638 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`0310f640 000007fe`f1ac8c5e KERNELBASE!WaitForSingleObjectEx+0x79 00000000`0310f6e0 000007fe`f1ac8b3b MSDTCPRX!CConnectionManager::TimerProcForNonGuardedUser+0x116 00000000`0310f740 00000000`776cf56d MSDTCPRX!CConnectionManager::TimerProc+0x1b 00000000`0310f770 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0310f7a0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005062660 Cid 0438.0900 Teb: 000007fffffa0000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004d61270 NotificationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8005175a60 Image: msdtc.exe Attached Process N/A Image: N/A Wait Start TickCount 12548 Ticks: 27742 (0:00:07:12.777) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address MSDTCPRX!CConnectionManager::TimerProc (0x000007fef1ac8b20) Stack Init fffff880058b2db0 Current fffff880058b2900 Base fffff880058b3000 Limit fffff880058ad000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`058b2940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`058b2a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`058b2b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`058b2bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`058b2c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`058b2c20) 00000000`02abf968 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`02abf970 000007fe`f1ac904f KERNELBASE!WaitForSingleObjectEx+0x79 00000000`02abfa10 000007fe`f1ac8b34 MSDTCPRX!CConnectionManager::TimerProcForGuardedUser+0x3a3 00000000`02abfac0 00000000`776cf56d MSDTCPRX!CConnectionManager::TimerProc+0x14 00000000`02abfaf0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`02abfb20 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80050bc8b0 Cid 0438.0928 Teb: 000007fffff9e000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa800507b380 SynchronizationEvent fffffa8004f20a90 SynchronizationEvent fffffa8004f20980 SynchronizationEvent fffffa8004f20900 SynchronizationEvent Not impersonating DeviceMap fffff8a001f05400 Owning Process fffffa8005175a60 Image: msdtc.exe Attached Process N/A Image: N/A Wait Start TickCount 13583 Ticks: 26707 (0:00:06:56.631) Context Switch Count 1071 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address MSDTCLOG!_FlushThread (0x000007fef1a08b48) Stack Init fffff880058b9db0 Current fffff880058b8fd0 Base fffff880058ba000 Limit fffff880058b4000 Call 0 Priority 10 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`058b9010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`058b9150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`058b91e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`058b9490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`058b9960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`058b9bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`058b9c20) 00000000`032eef58 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`032eef60 00000000`776bf190 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`032ef060 000007fe`f1a08c64 kernel32!WaitForMultipleObjects+0xb0 00000000`032ef0f0 00000000`776cf56d MSDTCLOG!_FlushThread+0x11c 00000000`032ef960 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`032ef990 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa80044fab30 SessionId: 1 Cid: 05f8 Peb: 7fffffdc000 ParentCid: 0354 DirBase: 8153b000 ObjectTable: fffff8a003637d30 HandleCount: 95. Image: wuauclt.exe VadRoot fffffa8004fea4c0 Vads 79 Clone 0 Private 367. Modified 0. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a00af52a50 ElapsedTime 00:06:30.117 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1492, 50, 345) (5968KB, 200KB, 1380KB) PeakWorkingSetSize 1517 VirtualSize 72 Mb PeakVirtualSize 92 Mb PageFaultCount 1661 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 451 Setting context for this process... .process /p /r fffffa80044fab30 THREAD fffffa800517d770 Cid 05f8.06bc Teb: 000007fffffde000 Win32Thread: fffff900c0192c30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004e63ee0 SynchronizationEvent fffffa8005012980 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80044fab30 Image: wuauclt.exe Attached Process N/A Image: N/A Wait Start TickCount 38461 Ticks: 1829 (0:00:00:28.532) Context Switch Count 133 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address wuauclt!wWinMainCRTStartup (0x000000013f89a138) Stack Init fffff88005927db0 Current fffff88005926fd0 Base fffff88005928000 Limit fffff88005922000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05927010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05927150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`059271e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05927490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`05927960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`05927bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05927c20) 00000000`0022f7a8 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0022f7b0 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0022f8b0 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0022f940 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`0022f9e0 00000000`775c8880 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`0022fa20 000007fe`f10ef23c USER32!MsgWaitForMultipleObjects+0x20 00000000`0022fa60 000007fe`f10eed19 wucltux!CAUClientUI::Run+0x48 00000000`0022fae0 000007fe`f10f1fe5 wucltux!RunAUClientUI+0x8d 00000000`0022fb10 00000001`3f89446e wucltux!CWUClientUIExport::RunAUClientUI+0x14d 00000000`0022fb40 00000001`3f894d71 wuauclt!RunAUClientUIWrapper+0x122 00000000`0022fba0 00000001`3f899fc6 wuauclt!wWinMain+0x72d 00000000`0022fc60 00000000`776cf56d wuauclt!SafeCreateFile+0x31e 00000000`0022fd20 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0022fd50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004e8c3c0 Cid 05f8.0b2c Teb: 000007fffffda000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004e24380 SynchronizationTimer fffffa80044d89f0 SynchronizationTimer fffffa80050ef5d0 SynchronizationTimer Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80044fab30 Image: wuauclt.exe Attached Process N/A Image: N/A Wait Start TickCount 26868 Ticks: 13422 (0:00:03:29.384) Context Switch Count 5 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff88005981db0 Current fffff88005980fd0 Base fffff88005982000 Limit fffff8800597c000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05981010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05981150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`059811e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05981490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`05981960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`05981bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05981c20) 00000000`0234f728 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`0234f730 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`0234f9d0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0234fa00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80050e0b60 Cid 05f8.0b48 Teb: 000007fffffd8000 Win32Thread: fffff900c1bf55f0 WAIT: (WrQueue) UserMode Alertable fffffa8004865790 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80044fab30 Image: wuauclt.exe Attached Process N/A Image: N/A Wait Start TickCount 38461 Ticks: 1829 (0:00:00:28.532) Context Switch Count 27 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88007a39db0 Current fffff88007a397d0 Base fffff88007a3a000 Limit fffff88007a33000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`07a39810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`07a39950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`07a399e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`07a39a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`07a39b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`07a39c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`07a39c20) 00000000`025af6d8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`025af6e0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`025af9e0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`025afa10 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004544060 Cid 05f8.144f4 Teb: 000007fffffd6000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004865790 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80044fab30 Image: wuauclt.exe Attached Process N/A Image: N/A Wait Start TickCount 38461 Ticks: 1829 (0:00:00:28.532) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff880093b8db0 Current fffff880093b87d0 Base fffff880093b9000 Limit fffff880093b3000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`093b8810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`093b8950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`093b89e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`093b8a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`093b8b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`093b8c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`093b8c20) 00000000`026cf7d8 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`026cf7e0 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`026cfae0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`026cfb10 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004eceb30 SessionId: 1 Cid: 0bbc Peb: 7efdf000 ParentCid: 0288 DirBase: 5ce43000 ObjectTable: fffff8a0036530a0 HandleCount: 178. Image: wfcrun32.exe VadRoot fffffa8004ee1860 Vads 135 Clone 0 Private 463. Modified 1. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a00af30a50 ElapsedTime 00:05:56.846 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (2106, 50, 345) (8424KB, 200KB, 1380KB) PeakWorkingSetSize 2141 VirtualSize 85 Mb PeakVirtualSize 90 Mb PageFaultCount 2332 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 602 Setting context for this process... .process /p /r fffffa8004eceb30 THREAD fffffa8003c43a60 Cid 0bbc.0bc4 Teb: 000000007efdb000 Win32Thread: fffff900c1f61010 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004f2dde0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004eceb30 Image: wfcrun32.exe Attached Process N/A Image: N/A Wait Start TickCount 38598 Ticks: 1692 (0:00:00:26.395) Context Switch Count 128 LargeStack UserTime 00:00:00.031 KernelTime 00:00:00.031 *** ERROR: Symbol file could not be found. Defaulted to export symbols for wfcrun32.exe - Win32 Start Address wfcrun32!TUICITransformSI::operator= (0x00000000013e698f) Stack Init fffff880057f3db0 Current fffff880057f36f0 Base fffff880057f4000 Limit fffff880057eb000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`057f3730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`057f3870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`057f3900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`057f39a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`057f3a40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`057f3a70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`057f3b50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`057f3b90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`057f3c20 00000000`7549fc2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`057f3c20) 00000000`0018e1e8 00000000`7547ac48 wow64win!ZwUserGetMessage+0xa 00000000`0018e1f0 00000000`754ccf87 wow64win!whNtUserGetMessage+0x30 00000000`0018e250 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`0018eb10 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`0018ebd0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0018ec20 00000000`778184c8 wow64!Wow64LdrpInitialize+0x429 00000000`0018f170 00000000`77817623 ntdll!LdrpInitializeProcess+0x17e2 00000000`0018f670 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bea0 00000000`0018f6e0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004feeb60 Cid 0bbc.0bcc Teb: 000000007efd5000 Win32Thread: fffff900c1ea25f0 WAIT: (DelayExecution) UserMode Non-Alertable fffffa8004e2ffc0 Mutant - owning thread 0 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004eceb30 Image: wfcrun32.exe Attached Process N/A Image: N/A Wait Start TickCount 40258 Ticks: 32 (0:00:00:00.499) Context Switch Count 367 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00000000747129e1 Stack Init fffff88005825db0 Current fffff88005825970 Base fffff88005826000 Limit fffff8800581f000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`058259b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05825af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`05825b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05825bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05825c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05825c20) 00000000`0058eb28 00000000`75452c87 wow64cpu!CpupSyscallStub+0x9 00000000`0058eb30 00000000`754cd07e wow64cpu!Thunk2ArgNSpNSpReloadState+0x21 00000000`0058ebf0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0058ec40 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0058f190 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0058f200 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004280b60 Cid 0bbc.0bc0 Teb: 000000007efad000 Win32Thread: fffff900c202fc30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8003c45c50 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004eceb30 Image: wfcrun32.exe Attached Process N/A Image: N/A Wait Start TickCount 17434 Ticks: 22856 (0:00:05:56.555) Context Switch Count 4 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00000000747129e1 Stack Init fffff88005838db0 Current fffff88005838900 Base fffff88005839000 Limit fffff88005832000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05838940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05838a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05838b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05838bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05838c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05838c20) 00000000`0132eb38 00000000`75452bcd wow64cpu!CpupSyscallStub+0x9 00000000`0132eb40 00000000`754cd07e wow64cpu!Thunk0ArgReloadState+0x1a 00000000`0132ec00 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0132ec50 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0132f1a0 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0132f210 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004c79160 Cid 0bbc.05a8 Teb: 000000007efaa000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa800506cb40 SynchronizationTimer fffffa8004f2b060 SynchronizationTimer fffffa80050bfef0 SynchronizationTimer Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004eceb30 Image: wfcrun32.exe Attached Process N/A Image: N/A Wait Start TickCount 28973 Ticks: 11317 (0:00:02:56.546) Context Switch Count 5 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a11c7f Stack Init fffff880056dddb0 Current fffff880056dcfd0 Base fffff880056de000 Limit fffff880056d8000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`056dd010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`056dd150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`056dd1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`056dd490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`056dd960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`056ddbb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`056ddc20) 00000000`0137e9f8 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`0137ea00 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`0137eac0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0137eb10 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0137f060 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0137f0d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004fdd7e0 Cid 0bbc.0bf8 Teb: 000000007ef98000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa800503d8b0 Semaphore Limit 0x7fffffff fffffa8004c457b0 NotificationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004eceb30 Image: wfcrun32.exe Attached Process N/A Image: N/A Wait Start TickCount 17435 Ticks: 22855 (0:00:05:56.540) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address wfcrun32!TUICITransformSI::operator= (0x0000000001401380) Stack Init fffff880058cedb0 Current fffff880058cdfd0 Base fffff880058cf000 Limit fffff880058c9000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`058ce010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`058ce150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`058ce1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`058ce490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`058ce960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`058cebb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`058cec20) 00000000`013bef58 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`013bef60 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`013bf020 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`013bf070 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`013bf5c0 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`013bf630 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8005390060 Cid 0bbc.0b5c Teb: 000000007efd8000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004f36f30 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004eceb30 Image: wfcrun32.exe Attached Process N/A Image: N/A Wait Start TickCount 36678 Ticks: 3612 (0:00:00:56.347) Context Switch Count 11 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a12c91 Stack Init fffff88004c58db0 Current fffff88004c587d0 Base fffff88004c59000 Limit fffff88004c53000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04c58810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04c58950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04c589e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04c58a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04c58b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04c58c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04c58c20) 00000000`00fae598 00000000`754ea2df ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`00fae5a0 00000000`754ccf87 wow64!whNtWaitForWorkViaWorkerFactory+0x23 00000000`00fae5f0 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`00faeeb0 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`00faef70 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`00faefc0 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`00faf510 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`00faf580 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004f55b60 Cid 0bbc.068c Teb: 000000007efa7000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004f36f30 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004eceb30 Image: wfcrun32.exe Attached Process N/A Image: N/A Wait Start TickCount 39565 Ticks: 725 (0:00:00:11.310) Context Switch Count 6 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a12c91 Stack Init fffff88005427db0 Current fffff880054277d0 Base fffff88005428000 Limit fffff88005422000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05427810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05427950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`054279e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05427a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05427b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05427c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05427c20) 00000000`0100e528 00000000`754ea2df ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0100e530 00000000`754ccf87 wow64!whNtWaitForWorkViaWorkerFactory+0x23 00000000`0100e580 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`0100ee40 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`0100ef00 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0100ef50 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0100f4a0 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0100f510 00000000`00000000 ntdll!LdrInitializeThunk+0xe PROCESS fffffa80050fcb30 SessionId: 1 Cid: 09e0 Peb: 7efdf000 ParentCid: 08a0 DirBase: 32114000 ObjectTable: fffff8a0032faa20 HandleCount: 198. Image: jucheck.exe VadRoot fffffa8004e44aa0 Vads 132 Clone 0 Private 495. Modified 6. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a0095e8a50 ElapsedTime 00:03:40.936 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (2232, 50, 345) (8928KB, 200KB, 1380KB) PeakWorkingSetSize 2251 VirtualSize 95 Mb PeakVirtualSize 96 Mb PageFaultCount 2557 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 621 Setting context for this process... .process /p /r fffffa80050fcb30 THREAD fffffa8004cb9060 Cid 09e0.0930 Teb: 000000007efdb000 Win32Thread: fffff900c205a010 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004a44b00 NotificationEvent fffffa8004eb5bc0 NotificationEvent fffffa800512c2d0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80050fcb30 Image: jucheck.exe Attached Process N/A Image: N/A Wait Start TickCount 26261 Ticks: 14029 (0:00:03:38.853) Context Switch Count 84 LargeStack UserTime 00:00:00.046 KernelTime 00:00:00.015 *** ERROR: Module load completed but symbols could not be loaded for jucheck.exe Win32 Start Address jucheck (0x0000000000414af9) Stack Init fffff88005352db0 Current fffff88005351fd0 Base fffff88005353000 Limit fffff8800534b000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05352010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05352150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`053521e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05352490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`05352960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`05352bb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05352c20) 00000000`0008ebf8 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`0008ec00 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`0008ecc0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0008ed10 00000000`778184c8 wow64!Wow64LdrpInitialize+0x429 00000000`0008f260 00000000`77817623 ntdll!LdrpInitializeProcess+0x17e2 00000000`0008f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bea0 00000000`0008f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa80050cd610 Cid 09e0.0610 Teb: 000000007efd8000 Win32Thread: fffff900c1e7ec30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004b494d0 NotificationEvent fffffa8004ef4c60 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80050fcb30 Image: jucheck.exe Attached Process N/A Image: N/A Wait Start TickCount 26385 Ticks: 13905 (0:00:03:36.919) Context Switch Count 15 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address jucheck (0x000000000040b363) Stack Init fffff8800536edb0 Current fffff8800536dfd0 Base fffff8800536f000 Limit fffff88005367000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0536e010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0536e150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0536e1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`0536e490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`0536e960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`0536ebb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0536ec20) 00000000`0027f0f8 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`0027f100 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`0027f1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0027f210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0027f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0027f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa80050beb60 Cid 09e0.05bc Teb: 000000007efad000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8005035a50 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80050fcb30 Image: jucheck.exe Attached Process N/A Image: N/A Wait Start TickCount 26140 Ticks: 14150 (0:00:03:40.741) Context Switch Count 10 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00000000746f32fb Stack Init fffff88005338db0 Current fffff88005338900 Base fffff88005339000 Limit fffff88005333000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05338940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05338a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05338b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05338bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05338c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05338c20) 00000000`0050f0f8 00000000`75452bcd wow64cpu!CpupSyscallStub+0x9 00000000`0050f100 00000000`754cd07e wow64cpu!Thunk0ArgReloadState+0x1a 00000000`0050f1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0050f210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0050f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0050f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800454d060 Cid 09e0.08f8 Teb: 000000007efa4000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004540ba0 SynchronizationTimer fffffa8004f013b0 SynchronizationTimer fffffa8004e40fe0 SynchronizationEvent fffffa800457aef0 SynchronizationTimer Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80050fcb30 Image: jucheck.exe Attached Process N/A Image: N/A Wait Start TickCount 37680 Ticks: 2610 (0:00:00:40.716) Context Switch Count 6 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a11c7f Stack Init fffff880053a4db0 Current fffff880053a3fd0 Base fffff880053a5000 Limit fffff8800539f000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`053a4010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`053a4150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`053a41e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`053a4490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`053a4960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`053a4bb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`053a4c20) 00000000`0285f0f8 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`0285f100 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`0285f1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0285f210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0285f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0285f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8005045060 Cid 09e0.0ae4 Teb: 000000007efa1000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8003c2a7a0 NotificationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80050fcb30 Image: jucheck.exe Attached Process N/A Image: N/A Wait Start TickCount 26207 Ticks: 14083 (0:00:03:39.696) Context Switch Count 39 UserTime 00:00:00.015 KernelTime 00:00:00.000 Win32 Start Address 0x0000000076c29493 Stack Init fffff880053b5db0 Current fffff880053b5900 Base fffff880053b6000 Limit fffff880053b0000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`053b5940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`053b5a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`053b5b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`053b5bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`053b5c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`053b5c20) 00000000`029ff0f8 00000000`75452bcd wow64cpu!CpupSyscallStub+0x9 00000000`029ff100 00000000`754cd07e wow64cpu!Thunk0ArgReloadState+0x1a 00000000`029ff1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`029ff210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`029ff760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`029ff7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004564990 Cid 09e0.032c Teb: 000000007ef9e000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Non-Alertable fffffa8004d1bd10 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80050fcb30 Image: jucheck.exe Attached Process N/A Image: N/A Wait Start TickCount 26219 Ticks: 14071 (0:00:03:39.509) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000074356f14 Stack Init fffff880053bcdb0 Current fffff880053bc7b0 Base fffff880053bd000 Limit fffff880053b7000 Call 0 Priority 11 BasePriority 9 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`053bc7f0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`053bc930 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`053bc9c0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`053bca70 fffff800`01d479a5 nt!IoRemoveIoCompletion+0x47 fffff880`053bcb00 fffff800`01a8b993 nt!NtRemoveIoCompletion+0x145 fffff880`053bcbb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`053bcc20) 00000000`02a3f0f8 00000000`75452a76 wow64cpu!CpupSyscallStub+0x9 00000000`02a3f100 00000000`754cd07e wow64cpu!RemoveIoCompletionFault+0x3d 00000000`02a3f1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`02a3f210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`02a3f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`02a3f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004f55060 Cid 09e0.0aa4 Teb: 000000007efaa000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004b2c510 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80050fcb30 Image: jucheck.exe Attached Process N/A Image: N/A Wait Start TickCount 37680 Ticks: 2610 (0:00:00:40.716) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a12c91 Stack Init fffff88004994db0 Current fffff880049947d0 Base fffff88004995000 Limit fffff8800498f000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04994810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04994950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`049949e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04994a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04994b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04994c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04994c20) 00000000`0057e7e8 00000000`754ea2df ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0057e7f0 00000000`754ccf87 wow64!whNtWaitForWorkViaWorkerFactory+0x23 00000000`0057e840 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`0057f100 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`0057f1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0057f210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0057f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0057f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8005412b60 Cid 09e0.0704 Teb: 000000007efd5000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004ec6bb0 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80050fcb30 Image: jucheck.exe Attached Process N/A Image: N/A Wait Start TickCount 37680 Ticks: 2610 (0:00:00:40.716) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a12c91 Stack Init fffff8800583fdb0 Current fffff8800583f7d0 Base fffff88005840000 Limit fffff8800583a000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0583f810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0583f950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0583f9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0583fa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0583fb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0583fc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0583fc20) 00000000`0032e7e8 00000000`754ea2df ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0032e7f0 00000000`754ccf87 wow64!whNtWaitForWorkViaWorkerFactory+0x23 00000000`0032e840 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`0032f100 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`0032f1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0032f210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0032f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0032f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8005412660 Cid 09e0.0b14 Teb: 000000007efa7000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004b2c510 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80050fcb30 Image: jucheck.exe Attached Process N/A Image: N/A Wait Start TickCount 37680 Ticks: 2610 (0:00:00:40.716) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a12c91 Stack Init fffff8800547fdb0 Current fffff8800547f7d0 Base fffff88005480000 Limit fffff8800547a000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0547f810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0547f950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0547f9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0547fa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0547fb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0547fc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0547fc20) 00000000`0281e7e8 00000000`754ea2df ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0281e7f0 00000000`754ccf87 wow64!whNtWaitForWorkViaWorkerFactory+0x23 00000000`0281e840 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`0281f100 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`0281f1c0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0281f210 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0281f760 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0281f7d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe PROCESS fffffa8004f68370 SessionId: 1 Cid: 0a6c Peb: 7fffffd9000 ParentCid: 06ac DirBase: 296ed000 ObjectTable: fffff8a00aeeb980 HandleCount: 58. Image: NotMyfault.exe VadRoot fffffa8004fc21c0 Vads 51 Clone 0 Private 294. Modified 5. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a0093dea50 ElapsedTime 00:03:16.683 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1170, 50, 345) (4680KB, 200KB, 1380KB) PeakWorkingSetSize 1184 VirtualSize 71 Mb PeakVirtualSize 74 Mb PageFaultCount 1220 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 351 Setting context for this process... .process /p /r fffffa8004f68370 THREAD fffffa8004544b60 Cid 0a6c.0acc Teb: 000007fffffde000 Win32Thread: fffff900c1eb4010 RUNNING on processor 1 IRP List: fffffa8004d7e010: (0006,0118) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004f68370 Image: NotMyfault.exe Attached Process N/A Image: N/A Wait Start TickCount 40290 Ticks: 0 Context Switch Count 408 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.015 *** ERROR: Module load completed but symbols could not be loaded for NotMyfault.exe Win32 Start Address NotMyfault (0x0000000140002708) Stack Init fffff8800587cdb0 Current fffff8800587c6f0 Base fffff8800587d000 Limit fffff88005874000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0587c578 fffff800`01a8bca9 nt!KeBugCheckEx fffff880`0587c580 fffff800`01a8a920 nt!KiBugCheckDispatch+0x69 fffff880`0587c6c0 fffff880`04bf117a nt!KiPageFault+0x260 (TrapFrame @ fffff880`0587c6c0) fffff880`0587c850 fffff880`04bf1397 myfault+0x117a fffff880`0587c9b0 fffff800`01da7707 myfault+0x1397 fffff880`0587ca10 fffff800`01da7f66 nt!IopXxxControlFile+0x607 fffff880`0587cb40 fffff800`01a8b993 nt!NtDeviceIoControlFile+0x56 fffff880`0587cbb0 00000000`7781ff2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0587cc20) 00000000`0012f588 000007fe`fda9b399 ntdll!NtDeviceIoControlFile+0xa 00000000`0012f590 00000000`776c610f KERNELBASE!DeviceIoControl+0x75 00000000`0012f600 00000001`40001cc9 kernel32!DeviceIoControlImplementation+0x7f 00000000`0012f650 00000000`775cc3c1 NotMyfault+0x1cc9 00000000`0012f830 00000000`775ca6d8 USER32!UserCallWinProcCheckWow+0x1ad 00000000`0012f8f0 00000000`775ca85d USER32!SendMessageWorker+0x682 00000000`0012f980 00000000`775ee93e USER32!SendMessageW+0x5c 00000000`0012f9d0 00000000`775dd448 USER32!xxxBNReleaseCapture+0x45a 00000000`0012fa40 00000000`775ef6ce USER32!ButtonWndProcWorker+0x151b 00000000`0012fb90 00000000`775cc3c1 USER32!ButtonWndProcA+0x66 00000000`0012fbd0 00000000`775cc60a USER32!UserCallWinProcCheckWow+0x1ad 00000000`0012fc90 00000000`775c9fac USER32!DispatchMessageWorker+0x3b5 00000000`0012fd10 00000000`77603322 USER32!IsDialogMessageW+0x153 00000000`0012fda0 00000001`40001ed1 USER32!IsDialogMessageA+0x7a 00000000`0012fdd0 00000001`400026b5 NotMyfault+0x1ed1 00000000`0012feb0 00000000`776cf56d NotMyfault+0x26b5 00000000`0012ff60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0012ff90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800517fb60 Cid 0a6c.06a8 Teb: 000007fffffdc000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004513350 SynchronizationTimer fffffa8004ebeef0 SynchronizationTimer fffffa800509fcf0 SynchronizationTimer Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004f68370 Image: NotMyfault.exe Attached Process N/A Image: N/A Wait Start TickCount 33459 Ticks: 6831 (0:00:01:46.564) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff8800564ddb0 Current fffff8800564cfd0 Base fffff8800564e000 Limit fffff88005648000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0564d010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0564d150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0564d1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`0564d490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`0564d960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`0564dbb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0564dc20) 00000000`020afcb8 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`020afcc0 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`020aff60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`020aff90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004f58b30 SessionId: 1 Cid: 0168 Peb: 7efdf000 ParentCid: 06ac DirBase: 1bdd1000 ObjectTable: fffff8a0095ec5a0 HandleCount: 340. Image: iexplore.exe VadRoot fffffa8004a83500 Vads 267 Clone 0 Private 1557. Modified 54. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a00961d060 ElapsedTime 00:02:34.715 UserTime 00:00:00.655 KernelTime 00:00:00.062 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (5958, 50, 345) (23832KB, 200KB, 1380KB) PeakWorkingSetSize 6030 VirtualSize 146 Mb PeakVirtualSize 154 Mb PageFaultCount 6643 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 2106 Setting context for this process... .process /p /r fffffa8004f58b30 THREAD fffffa8004f75b60 Cid 0168.0824 Teb: 000000007efdb000 Win32Thread: fffff900c275fc30 WAIT: (UserRequest) UserMode Non-Alertable fffffa80050fcab0 SynchronizationEvent fffffa800458e670 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004f58b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 34986 Ticks: 5304 (0:00:01:22.742) Context Switch Count 2398 LargeStack UserTime 00:00:00.343 KernelTime 00:00:00.265 Win32 Start Address iexplore!wWinMainCRTStartup (0x00000000002c1c9a) Stack Init fffff880055b7db0 Current fffff880055b6fd0 Base fffff880055b8000 Limit fffff880055ad000 Call 0 Priority 13 BasePriority 8 UnusualBoost 3 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`055b7010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`055b7150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`055b71e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`055b7490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`055b7960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`055b7bb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`055b7c20) 00000000`0026e538 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`0026e540 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`0026e600 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0026e650 00000000`778184c8 wow64!Wow64LdrpInitialize+0x429 00000000`0026eba0 00000000`77817623 ntdll!LdrpInitializeProcess+0x17e2 00000000`0026f0a0 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bea0 00000000`0026f110 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa80050dd700 Cid 0168.01e4 Teb: 000000007efd5000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8003c28850 SynchronizationTimer fffffa800457aa60 SynchronizationTimer fffffa80041c24c0 SynchronizationEvent fffffa8004954280 SynchronizationEvent fffffa8004585b30 ProcessObject fffffa8004f249d0 SynchronizationEvent fffffa8004dad980 SynchronizationEvent fffffa80045815d0 SynchronizationTimer Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004f58b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 36171 Ticks: 4119 (0:00:01:04.256) Context Switch Count 40 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a11c7f Stack Init fffff8800558adb0 Current fffff88005589fd0 Base fffff8800558b000 Limit fffff88005585000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0558a010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0558a150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0558a1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`0558a490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`0558a960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`0558abb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0558ac20) 00000000`02aee9e8 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`02aee9f0 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`02aeeab0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`02aeeb00 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`02aef050 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`02aef0c0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004f8b950 Cid 0168.08bc Teb: 000000007efaa000 Win32Thread: fffff900c1df8c30 WAIT: (WrQueue) UserMode Alertable fffffa8004dc6360 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004f58b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 36171 Ticks: 4119 (0:00:01:04.256) Context Switch Count 15 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a12c91 Stack Init fffff88004d08db0 Current fffff88004d087d0 Base fffff88004d09000 Limit fffff88004d02000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04d08810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04d08950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04d089e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04d08a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04d08b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04d08c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04d08c20) 00000000`02ece0f8 00000000`754ea2df ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`02ece100 00000000`754ccf87 wow64!whNtWaitForWorkViaWorkerFactory+0x23 00000000`02ece150 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`02ecea10 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`02ecead0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`02eceb20 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`02ecf070 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`02ecf0e0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800457e550 Cid 0168.0370 Teb: 000000007efa1000 Win32Thread: fffff900c1d56c30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004f019e0 NotificationEvent fffffa8004945080 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004f58b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 31968 Ticks: 8322 (0:00:02:09.824) Context Switch Count 170 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.000 Win32 Start Address 0x0000000076b64bbb Stack Init fffff88004475db0 Current fffff88004474fd0 Base fffff88004476000 Limit fffff8800446f000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04475010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04475150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`044751e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04475490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`04475960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`04475bb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04475c20) 00000000`033ee9b8 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`033ee9c0 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`033eea80 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`033eead0 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`033ef020 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`033ef090 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800457fb60 Cid 0168.0534 Teb: 000000007ef9e000 Win32Thread: fffff900c21d45b0 WAIT: (UserRequest) UserMode Alertable fffffa8004b2ce90 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004f58b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 31960 Ticks: 8330 (0:00:02:09.948) Context Switch Count 25 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000076b64a2e Stack Init fffff88004131db0 Current fffff88004130fd0 Base fffff88004132000 Limit fffff8800412a000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`04131010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04131150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`041311e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04131490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`04131960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`04131bb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04131c20) 00000000`0314ebf8 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`0314ec00 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`0314ecc0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0314ed10 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0314f260 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0314f2d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800457f660 Cid 0168.0ac8 Teb: 000000007ef9b000 Win32Thread: fffff900c21e7c30 WAIT: (UserRequest) UserMode Non-Alertable fffffa80049b14f0 SynchronizationEvent fffffa8005024670 SynchronizationEvent fffffa8004f2f1c0 Semaphore Limit 0x80 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004f58b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 30460 Ticks: 9830 (0:00:02:33.348) Context Switch Count 8 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000071ead891 Stack Init fffff880040e4db0 Current fffff880040e3fd0 Base fffff880040e5000 Limit fffff880040de000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`040e4010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`040e4150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`040e41e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`040e4490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`040e4960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`040e4bb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`040e4c20) 00000000`0381ec68 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`0381ec70 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`0381ed30 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0381ed80 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0381f2d0 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0381f340 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004570b60 Cid 0168.0750 Teb: 000000007ef98000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004eb2f60 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004f58b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 30442 Ticks: 9848 (0:00:02:33.629) Context Switch Count 8 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00000000746f32fb Stack Init fffff8800533fdb0 Current fffff8800533f900 Base fffff88005340000 Limit fffff8800533a000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0533f940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0533fa80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0533fb10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`0533fbb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`0533fc20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0533fc20) 00000000`0390eb38 00000000`75452bcd wow64cpu!CpupSyscallStub+0x9 00000000`0390eb40 00000000`754cd07e wow64cpu!Thunk0ArgReloadState+0x1a 00000000`0390ec00 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0390ec50 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0390f1a0 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0390f210 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004567060 Cid 0168.0b00 Teb: 000000007ef95000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8005129e90 NotificationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004f58b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 30508 Ticks: 9782 (0:00:02:32.600) Context Switch Count 33 UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address 0x0000000076c29493 Stack Init fffff88005331db0 Current fffff88005331900 Base fffff88005332000 Limit fffff8800532c000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05331940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05331a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05331b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05331bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05331c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05331c20) 00000000`037aefb8 00000000`75452bcd wow64cpu!CpupSyscallStub+0x9 00000000`037aefc0 00000000`754cd07e wow64cpu!Thunk0ArgReloadState+0x1a 00000000`037af080 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`037af0d0 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`037af620 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`037af690 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800511ab60 Cid 0168.0a00 Teb: 000000007ef8f000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Non-Alertable fffffa800510c850 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004f58b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 30508 Ticks: 9782 (0:00:02:32.600) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000074356f14 Stack Init fffff880058c0db0 Current fffff880058c07b0 Base fffff880058c1000 Limit fffff880058bb000 Call 0 Priority 13 BasePriority 9 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`058c07f0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`058c0930 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`058c09c0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`058c0a70 fffff800`01d479a5 nt!IoRemoveIoCompletion+0x47 fffff880`058c0b00 fffff800`01a8b993 nt!NtRemoveIoCompletion+0x145 fffff880`058c0bb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`058c0c20) 00000000`03e8ecb8 00000000`75452a76 wow64cpu!CpupSyscallStub+0x9 00000000`03e8ecc0 00000000`754cd07e wow64cpu!RemoveIoCompletionFault+0x3d 00000000`03e8ed80 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`03e8edd0 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`03e8f320 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`03e8f390 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004577570 Cid 0168.07bc Teb: 000000007ef8c000 Win32Thread: fffff900c1ea4010 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004573280 SynchronizationEvent fffffa8004e40580 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004f58b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 31226 Ticks: 9064 (0:00:02:21.399) Context Switch Count 12 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00000000770712e5 Stack Init fffff88005941db0 Current fffff88005940fd0 Base fffff88005942000 Limit fffff8800593b000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05941010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05941150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`059411e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05941490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`05941960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`05941bb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05941c20) 00000000`039deaa8 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`039deab0 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`039deb70 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`039debc0 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`039df110 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`039df180 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800455e660 Cid 0168.0ab8 Teb: 000000007ef89000 Win32Thread: fffff900c1c96c30 WAIT: (WrQueue) UserMode Alertable fffffa8004a4b060 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004f58b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 36171 Ticks: 4119 (0:00:01:04.256) Context Switch Count 49 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a12c91 Stack Init fffff8800529ddb0 Current fffff8800529d7d0 Base fffff8800529e000 Limit fffff88005297000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0529d810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0529d950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0529d9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0529da90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0529db20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0529dc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0529dc20) 00000000`03f0e268 00000000`754ea2df ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`03f0e270 00000000`754ccf87 wow64!whNtWaitForWorkViaWorkerFactory+0x23 00000000`03f0e2c0 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`03f0eb80 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`03f0ec40 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`03f0ec90 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`03f0f1e0 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`03f0f250 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8005361660 Cid 0168.076c Teb: 000000007efd8000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004dc6360 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004f58b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 36171 Ticks: 4119 (0:00:01:04.256) Context Switch Count 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a12c91 Stack Init fffff8800524fdb0 Current fffff8800524f7d0 Base fffff88005250000 Limit fffff8800524a000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0524f810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0524f950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`0524f9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`0524fa90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`0524fb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`0524fc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0524fc20) 00000000`02dde268 00000000`754ea2df ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`02dde270 00000000`754ccf87 wow64!whNtWaitForWorkViaWorkerFactory+0x23 00000000`02dde2c0 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`02ddeb80 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`02ddec40 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`02ddec90 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`02ddf1e0 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`02ddf250 00000000`00000000 ntdll!LdrInitializeThunk+0xe PROCESS fffffa8004585b30 SessionId: 1 Cid: 0920 Peb: 7efdf000 ParentCid: 0168 DirBase: 1d41d000 ObjectTable: fffff8a00aeaada0 HandleCount: 443. Image: iexplore.exe VadRoot fffffa800538a7b0 Vads 383 Clone 0 Private 6806. Modified 461. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a009723a50 ElapsedTime 00:02:33.731 UserTime 00:00:00.171 KernelTime 00:00:00.156 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (12234, 50, 345) (48936KB, 200KB, 1380KB) PeakWorkingSetSize 12793 VirtualSize 205 Mb PeakVirtualSize 295 Mb PageFaultCount 13653 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 8828 Job fffffa800457f060 Setting context for this process... .process /p /r fffffa8004585b30 THREAD fffffa8004d00760 Cid 0920.0b3c Teb: 000000007efdb000 Win32Thread: fffff900c2053c30 WAIT: (UserRequest) UserMode Alertable fffffa8004dac780 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004585b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 30459 Ticks: 9831 (0:00:02:33.364) Context Switch Count 80 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.015 Win32 Start Address iexplore!wWinMainCRTStartup (0x00000000002c1c9a) Stack Init fffff880057ccdb0 Current fffff880057cbfd0 Base fffff880057cd000 Limit fffff880057c5000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`057cc010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`057cc150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`057cc1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`057cc490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`057cc960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`057ccbb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`057ccc20) 00000000`0024e998 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`0024e9a0 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`0024ea60 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0024eab0 00000000`778184c8 wow64!Wow64LdrpInitialize+0x429 00000000`0024f000 00000000`77817623 ntdll!LdrpInitializeProcess+0x17e2 00000000`0024f500 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bea0 00000000`0024f570 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004f69b60 Cid 0920.0bd0 Teb: 000000007efd8000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa800516f5f0 SynchronizationTimer fffffa8004fa1060 SynchronizationTimer fffffa8004dca400 SynchronizationEvent fffffa80050d9500 SynchronizationEvent fffffa8003c313a0 SynchronizationTimer Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004585b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 36229 Ticks: 4061 (0:00:01:03.352) Context Switch Count 10 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a11c7f Stack Init fffff88004096db0 Current fffff88004095fd0 Base fffff88004097000 Limit fffff88004091000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04096010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04096150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`040961e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04096490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`04096960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`04096bb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04096c20) 00000000`0056f0d8 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`0056f0e0 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`0056f1a0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0056f1f0 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0056f740 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0056f7b0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800455e060 Cid 0920.0ad8 Teb: 000000007efad000 Win32Thread: fffff900c2145c30 WAIT: (UserRequest) UserMode Non-Alertable fffffa80050cc910 NotificationEvent fffffa8005055950 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004585b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 32431 Ticks: 7859 (0:00:02:02.601) Context Switch Count 145 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000076b64bbb Stack Init fffff880042e6db0 Current fffff880042e5fd0 Base fffff880042e7000 Limit fffff880042e0000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`042e6010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`042e6150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`042e61e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`042e6490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`042e6960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`042e6bb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`042e6c20) 00000000`0267ebe8 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`0267ebf0 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`0267ecb0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0267ed00 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0267f250 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0267f2c0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800455eb60 Cid 0920.0ad4 Teb: 000000007efaa000 Win32Thread: fffff900c21ac010 WAIT: (UserRequest) UserMode Alertable fffffa800509dbf0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004585b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 30562 Ticks: 9728 (0:00:02:31.757) Context Switch Count 10 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000076b64a2e Stack Init fffff8800599bdb0 Current fffff8800599afd0 Base fffff8800599c000 Limit fffff88005994000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`0599b010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0599b150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`0599b1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`0599b490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`0599b960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`0599bbb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0599bc20) 00000000`0287eae8 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`0287eaf0 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`0287ebb0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0287ec00 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0287f150 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0287f1c0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800455bb60 Cid 0920.0960 Teb: 000000007efa7000 Win32Thread: fffff900c214e010 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004da2f60 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004585b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 35334 Ticks: 4956 (0:00:01:17.314) Context Switch Count 2141 LargeStack UserTime 00:00:00.889 KernelTime 00:00:00.421 Win32 Start Address 0x0000000076b649af Stack Init fffff880059e9db0 Current fffff880059e9870 Base fffff880059ea000 Limit fffff880059e1000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`059e98b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`059e99f0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`059e9a80 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`059e9b20 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`059e9bc0 fffff960`0012e22e win32k!xxxSleepThread+0x59 fffff880`059e9bf0 fffff800`01a8b993 win32k!NtUserWaitMessage+0x46 fffff880`059e9c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`059e9c20) 00000000`026bef58 00000000`75452d92 wow64cpu!CpupSyscallStub+0x9 00000000`026bef60 00000000`754cd07e wow64cpu!Thunk0Arg+0x5 00000000`026bf020 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`026bf070 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`026bf5c0 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`026bf630 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004565b60 Cid 0920.06c0 Teb: 000000007ef9b000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa8004565f20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004585b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 38257 Ticks: 2033 (0:00:00:31.715) Context Switch Count 5 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x000000007628c7f5 Stack Init fffff880055e2db0 Current fffff880055e2970 Base fffff880055e3000 Limit fffff880055dd000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`055e29b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`055e2af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`055e2b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`055e2bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`055e2c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`055e2c20) 00000000`0272ee38 00000000`75452c87 wow64cpu!CpupSyscallStub+0x9 00000000`0272ee40 00000000`754cd07e wow64cpu!Thunk2ArgNSpNSpReloadState+0x21 00000000`0272ef00 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0272ef50 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0272f4a0 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0272f510 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa80051a3a10 Cid 0920.0b24 Teb: 000000007ef98000 Win32Thread: fffff900c1c36510 WAIT: (UserRequest) UserMode Non-Alertable fffffa800456af10 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004585b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 31960 Ticks: 8330 (0:00:02:09.948) Context Switch Count 146 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address 0x000000007190e031 Stack Init fffff88004e78db0 Current fffff88004e78900 Base fffff88004e79000 Limit fffff88004e71000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04e78940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04e78a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`04e78b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`04e78bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`04e78c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04e78c20) 00000000`04e0ee78 00000000`75452bcd wow64cpu!CpupSyscallStub+0x9 00000000`04e0ee80 00000000`754cd07e wow64cpu!Thunk0ArgReloadState+0x1a 00000000`04e0ef40 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`04e0ef90 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`04e0f4e0 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`04e0f550 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004bfc190 Cid 0920.0b10 Teb: 000000007ef95000 Win32Thread: fffff900c21a2450 WAIT: (UserRequest) UserMode Non-Alertable fffffa80051a77c0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004585b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 31982 Ticks: 8308 (0:00:02:09.605) Context Switch Count 310 LargeStack UserTime 00:00:00.124 KernelTime 00:00:00.000 Win32 Start Address 0x000000007190e031 Stack Init fffff88005071db0 Current fffff88005071900 Base fffff88005072000 Limit fffff8800506b000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05071940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05071a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05071b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05071bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05071c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05071c20) 00000000`04e7ee88 00000000`75452bcd wow64cpu!CpupSyscallStub+0x9 00000000`04e7ee90 00000000`754cd07e wow64cpu!Thunk0ArgReloadState+0x1a 00000000`04e7ef50 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`04e7efa0 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`04e7f4f0 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`04e7f560 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa80051a79b0 Cid 0920.0644 Teb: 000000007ef92000 Win32Thread: fffff900c27b0010 WAIT: (WrQueue) UserMode Alertable fffffa8004d01cb0 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004585b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 36229 Ticks: 4061 (0:00:01:03.352) Context Switch Count 81 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a12c91 Stack Init fffff88004c43db0 Current fffff88004c437d0 Base fffff88004c44000 Limit fffff88004c3d000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04c43810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04c43950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`04c439e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`04c43a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`04c43b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`04c43c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04c43c20) 00000000`040fe688 00000000`754ea2df ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`040fe690 00000000`754ccf87 wow64!whNtWaitForWorkViaWorkerFactory+0x23 00000000`040fe6e0 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`040fefa0 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`040ff060 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`040ff0b0 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`040ff600 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`040ff670 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004583b60 Cid 0920.0b1c Teb: 000000007ef8f000 Win32Thread: fffff900c1c9a9a0 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004faaf60 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004585b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 31507 Ticks: 8783 (0:00:02:17.015) Context Switch Count 46 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000074a32733 Stack Init fffff880053ffdb0 Current fffff880053ff6f0 Base fffff88005400000 Limit fffff880053f8000 Call 0 Priority 12 BasePriority 10 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`053ff730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`053ff870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`053ff900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`053ff9a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`053ffa40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`053ffa70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`053ffb50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`053ffb90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`053ffc20 00000000`7549fc2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`053ffc20) 00000000`04f3e548 00000000`7547ac48 wow64win!ZwUserGetMessage+0xa 00000000`04f3e550 00000000`754ccf87 wow64win!whNtUserGetMessage+0x30 00000000`04f3e5b0 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`04f3ee70 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`04f3ef30 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`04f3ef80 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`04f3f4d0 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`04f3f540 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004ec0b60 Cid 0920.0b9c Teb: 000000007ef8c000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004f7b850 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004585b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 31496 Ticks: 8794 (0:00:02:17.187) Context Switch Count 11 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00000000746f32fb Stack Init fffff8800528adb0 Current fffff8800528a900 Base fffff8800528b000 Limit fffff88005285000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0528a940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0528aa80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0528ab10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`0528abb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`0528ac20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0528ac20) 00000000`043de9c8 00000000`75452bcd wow64cpu!CpupSyscallStub+0x9 00000000`043de9d0 00000000`754cd07e wow64cpu!Thunk0ArgReloadState+0x1a 00000000`043dea90 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`043deae0 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`043df030 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`043df0a0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004f75660 Cid 0920.0a10 Teb: 000000007ef86000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004dcad50 NotificationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004585b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 31566 Ticks: 8724 (0:00:02:16.095) Context Switch Count 34 UserTime 00:00:00.015 KernelTime 00:00:00.000 Win32 Start Address 0x0000000076c29493 Stack Init fffff8800542edb0 Current fffff8800542e900 Base fffff8800542f000 Limit fffff88005429000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0542e940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0542ea80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0542eb10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`0542ebb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`0542ec20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0542ec20) 00000000`0316ed28 00000000`75452bcd wow64cpu!CpupSyscallStub+0x9 00000000`0316ed30 00000000`754cd07e wow64cpu!Thunk0ArgReloadState+0x1a 00000000`0316edf0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0316ee40 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0316f390 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0316f400 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8004586060 Cid 0920.0a74 Teb: 000000007ef83000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa8004e9fac0 NotificationEvent IRP List: fffffa800515f9c0: (0006,01f0) Flags: 00060070 Mdl: 00000000 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004585b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 32657 Ticks: 7633 (0:00:01:59.075) Context Switch Count 2040 UserTime 00:00:00.015 KernelTime 00:00:00.031 Win32 Start Address 0x0000000076c2a43e Stack Init fffff88005435db0 Current fffff88005435900 Base fffff88005436000 Limit fffff88005430000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05435940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05435a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05435b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05435bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05435c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05435c20) 00000000`068defb8 00000000`75452bcd wow64cpu!CpupSyscallStub+0x9 00000000`068defc0 00000000`754cd07e wow64cpu!Thunk0ArgReloadState+0x1a 00000000`068df080 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`068df0d0 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`068df620 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`068df690 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800455f780 Cid 0920.096c Teb: 000000007ef80000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Non-Alertable fffffa8003c58420 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004585b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 31975 Ticks: 8315 (0:00:02:09.714) Context Switch Count 116 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000074356f14 Stack Init fffff88005478db0 Current fffff880054787b0 Base fffff88005479000 Limit fffff88005473000 Call 0 Priority 13 BasePriority 9 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`054787f0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05478930 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`054789c0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05478a70 fffff800`01d479a5 nt!IoRemoveIoCompletion+0x47 fffff880`05478b00 fffff800`01a8b993 nt!NtRemoveIoCompletion+0x145 fffff880`05478bb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05478c20) 00000000`0695ef98 00000000`75452a76 wow64cpu!CpupSyscallStub+0x9 00000000`0695efa0 00000000`754cd07e wow64cpu!RemoveIoCompletionFault+0x3d 00000000`0695f060 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0695f0b0 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0695f600 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0695f670 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800532e860 Cid 0920.03f0 Teb: 000000007ef71000 Win32Thread: fffff900c1d62c30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004ff1330 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004585b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 31921 Ticks: 8369 (0:00:02:10.557) Context Switch Count 550 LargeStack UserTime 00:00:00.202 KernelTime 00:00:00.000 Win32 Start Address 0x000000007190e031 Stack Init fffff880052c0db0 Current fffff880052c0900 Base fffff880052c1000 Limit fffff880052b8000 Call 0 Priority 13 BasePriority 8 UnusualBoost 3 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`052c0940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`052c0a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`052c0b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`052c0bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`052c0c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`052c0c20) 00000000`04eeeba8 00000000`75452bcd wow64cpu!CpupSyscallStub+0x9 00000000`04eeebb0 00000000`754cd07e wow64cpu!Thunk0ArgReloadState+0x1a 00000000`04eeec70 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`04eeecc0 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`04eef210 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`04eef280 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8005356660 Cid 0920.0b88 Teb: 000000007eeff000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004eace90 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004585b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 36229 Ticks: 4061 (0:00:01:03.352) Context Switch Count 248 UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address 0x0000000077a12c91 Stack Init fffff880059fedb0 Current fffff880059fe7d0 Base fffff880059ff000 Limit fffff880059f9000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`059fe810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`059fe950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`059fe9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`059fea90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`059feb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`059fec20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`059fec20) 00000000`09a6e148 00000000`754ea2df ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`09a6e150 00000000`754ccf87 wow64!whNtWaitForWorkViaWorkerFactory+0x23 00000000`09a6e1a0 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`09a6ea60 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`09a6eb20 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`09a6eb70 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`09a6f0c0 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`09a6f130 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa8005374790 Cid 0920.0af8 Teb: 000000007eec9000 Win32Thread: fffff900c1b845b0 WAIT: (UserRequest) UserMode Non-Alertable fffffa8005163420 NotificationEvent fffffa8004e8cd50 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004585b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 31792 Ticks: 8498 (0:00:02:12.569) Context Switch Count 2 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00000000704f783c Stack Init fffff88005a12db0 Current fffff88005a11fd0 Base fffff88005a13000 Limit fffff88005a0b000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05a12010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05a12150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`05a121e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05a12490 fffff800`01daee41 nt!ObpWaitForMultipleObjects+0x294 fffff880`05a12960 fffff800`01a8b993 nt!NtWaitForMultipleObjects32+0xec fffff880`05a12bb0 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05a12c20) 00000000`0bb5f0e8 00000000`7545282c wow64cpu!CpupSyscallStub+0x9 00000000`0bb5f0f0 00000000`754cd07e wow64cpu!WaitForMultipleObjects32+0x32 00000000`0bb5f1b0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0bb5f200 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0bb5f750 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0bb5f7c0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800532e360 Cid 0920.082c Teb: 000000007efd5000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004d01cb0 QueueObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004585b30 Image: iexplore.exe Attached Process N/A Image: N/A Wait Start TickCount 36229 Ticks: 4061 (0:00:01:03.352) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x0000000077a12c91 Stack Init fffff880044addb0 Current fffff880044ad7d0 Base fffff880044ae000 Limit fffff880044a8000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`044ad810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`044ad950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`044ad9e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`044ada90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`044adb20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`044adc20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`044adc20) 00000000`0278e128 00000000`754ea2df ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0278e130 00000000`754ccf87 wow64!whNtWaitForWorkViaWorkerFactory+0x23 00000000`0278e180 00000000`7545276d wow64!Wow64SystemServiceEx+0xd7 00000000`0278ea40 00000000`754cd07e wow64cpu!TurboDispatchJumpAddressEnd+0x24 00000000`0278eb00 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0278eb50 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0278f0a0 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0278f110 00000000`00000000 ntdll!LdrInitializeThunk+0xe PROCESS fffffa80053a8b30 SessionId: 1 Cid: 0868 Peb: 7fffffd3000 ParentCid: 06ac DirBase: 0ce59000 ObjectTable: fffff8a00af58db0 HandleCount: 52. Image: notepad.exe VadRoot fffffa80049ee2d0 Vads 55 Clone 0 Private 287. Modified 0. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a0097ed860 ElapsedTime 00:02:06.341 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1216, 50, 345) (4864KB, 200KB, 1380KB) PeakWorkingSetSize 1216 VirtualSize 73 Mb PeakVirtualSize 73 Mb PageFaultCount 1253 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 358 Setting context for this process... .process /p /r fffffa80053a8b30 THREAD fffffa80053a1780 Cid 0868.0afc Teb: 000007fffffde000 Win32Thread: fffff900c1a3d500 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004b3be10 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80053a8b30 Image: notepad.exe Attached Process N/A Image: N/A Wait Start TickCount 32336 Ticks: 7954 (0:00:02:04.083) Context Switch Count 294 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.031 Win32 Start Address notepad!WinMainCRTStartup (0x00000000ff373570) Stack Init fffff88005a38db0 Current fffff88005a386f0 Base fffff88005a39000 Limit fffff88005a2f000 Call 0 Priority 13 BasePriority 8 UnusualBoost 3 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05a38730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05a38870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05a38900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`05a389a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`05a38a40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`05a38a70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`05a38b50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`05a38b90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`05a38c20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05a38c20) 00000000`000ffae8 00000000`775cc95e USER32!NtUserGetMessage+0xa 00000000`000ffaf0 00000000`ff371064 USER32!GetMessageW+0x34 00000000`000ffb20 00000000`ff37133c notepad!WinMain+0x182 00000000`000ffba0 00000000`776cf56d notepad!DisplayNonGenuineDlgWorker+0x2da 00000000`000ffc60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`000ffc90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004514630 SessionId: 1 Cid: 07f4 Peb: 7fffffd5000 ParentCid: 06ac DirBase: 09ce9000 ObjectTable: fffff8a00908ebd0 HandleCount: 40. Image: ApplicationA.exe VadRoot fffffa800457e2a0 Vads 60 Clone 0 Private 304. Modified 0. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a00aeaf060 ElapsedTime 00:01:51.966 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1057, 50, 345) (4228KB, 200KB, 1380KB) PeakWorkingSetSize 1057 VirtualSize 62 Mb PeakVirtualSize 62 Mb PageFaultCount 1093 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 362 Setting context for this process... .process /p /r fffffa8004514630 THREAD fffffa8004f85b60 Cid 07f4.056c Teb: 000007fffffde000 Win32Thread: fffff900c01c6c30 WAIT: (DelayExecution) UserMode Non-Alertable fffffa8004f85f20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004514630 Image: ApplicationA.exe Attached Process N/A Image: N/A Wait Start TickCount 33119 Ticks: 7171 (0:00:01:51.868) Context Switch Count 25 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 *** ERROR: Module load completed but symbols could not be loaded for ApplicationA.exe Win32 Start Address ApplicationA (0x000000013f3c1548) Stack Init fffff88005b57db0 Current fffff88005b57970 Base fffff88005b58000 Limit fffff88005b51000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05b579b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05b57af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`05b57b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05b57bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05b57c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05b57c20) 00000000`0030f698 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`0030f6a0 00000001`3f3c1159 KERNELBASE!SleepEx+0xab 00000000`0030f740 00000001`3f3c150a ApplicationA+0x1159 00000000`0030f770 00000000`776cf56d ApplicationA+0x150a 00000000`0030f7b0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0030f7e0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800451cb60 Cid 07f4.0af4 Teb: 000007fffffdc000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa800451cf20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004514630 Image: ApplicationA.exe Attached Process N/A Image: N/A Wait Start TickCount 37286 Ticks: 3004 (0:00:00:46.862) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationA (0x000000013f3c1210) Stack Init fffff880058c7db0 Current fffff880058c7970 Base fffff880058c8000 Limit fffff880058c2000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`058c79b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`058c7af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`058c7b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`058c7bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`058c7c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`058c7c20) 00000000`01f9fca8 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`01f9fcb0 00000001`3f3c100f KERNELBASE!SleepEx+0xab 00000000`01f9fd50 00000001`3f3c11fb ApplicationA+0x100f 00000000`01f9fd80 00000001`3f3c12a5 ApplicationA+0x11fb 00000000`01f9fdb0 00000000`776cf56d ApplicationA+0x12a5 00000000`01f9fde0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01f9fe10 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800451c660 Cid 07f4.0998 Teb: 000007fffffda000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa800451ca20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004514630 Image: ApplicationA.exe Attached Process N/A Image: N/A Wait Start TickCount 37350 Ticks: 2940 (0:00:00:45.864) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationA (0x000000013f3c1210) Stack Init fffff880052a6db0 Current fffff880052a6970 Base fffff880052a7000 Limit fffff880052a1000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`052a69b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`052a6af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`052a6b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`052a6bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`052a6c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`052a6c20) 00000000`021cfa38 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`021cfa40 00000001`3f3c102f KERNELBASE!SleepEx+0xab 00000000`021cfae0 00000001`3f3c11fb ApplicationA+0x102f 00000000`021cfb10 00000001`3f3c12a5 ApplicationA+0x11fb 00000000`021cfb40 00000000`776cf56d ApplicationA+0x12a5 00000000`021cfb70 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`021cfba0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800451d060 Cid 07f4.0278 Teb: 000007fffffd8000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa800451d420 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004514630 Image: ApplicationA.exe Attached Process N/A Image: N/A Wait Start TickCount 37414 Ticks: 2876 (0:00:00:44.865) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationA (0x000000013f3c1210) Stack Init fffff880045c1db0 Current fffff880045c1970 Base fffff880045c2000 Limit fffff880045bc000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`045c19b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`045c1af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`045c1b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`045c1bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`045c1c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`045c1c20) 00000000`020cfc08 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`020cfc10 00000001`3f3c104f KERNELBASE!SleepEx+0xab 00000000`020cfcb0 00000001`3f3c11fb ApplicationA+0x104f 00000000`020cfce0 00000001`3f3c12a5 ApplicationA+0x11fb 00000000`020cfd10 00000000`776cf56d ApplicationA+0x12a5 00000000`020cfd40 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`020cfd70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800451db60 Cid 07f4.0b8c Teb: 000007fffffd6000 Win32Thread: fffff900c27c0c30 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004e501e0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004514630 Image: ApplicationA.exe Attached Process N/A Image: N/A Wait Start TickCount 33806 Ticks: 6484 (0:00:01:41.151) Context Switch Count 72 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.000 Win32 Start Address ApplicationA (0x000000013f3c1210) Stack Init fffff88005b7fdb0 Current fffff88005b7f870 Base fffff88005b80000 Limit fffff88005b77000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05b7f8b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05b7f9f0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05b7fa80 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`05b7fb20 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`05b7fbc0 fffff960`0012e22e win32k!xxxSleepThread+0x59 fffff880`05b7fbf0 fffff800`01a8b993 win32k!NtUserWaitMessage+0x46 fffff880`05b7fc20 00000000`775cbf5a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05b7fc20) 00000000`022ff7c8 00000000`775d7214 USER32!ZwUserWaitMessage+0xa 00000000`022ff7d0 00000000`775d74a5 USER32!DialogBox2+0x274 00000000`022ff860 00000000`776227f0 USER32!InternalDialogBox+0x135 00000000`022ff8c0 00000000`77621ae5 USER32!SoftModalMessageBox+0x9b4 00000000`022ff9f0 00000000`7762133b USER32!MessageBoxWorker+0x31d 00000000`022ffbb0 00000000`77621232 USER32!MessageBoxTimeoutW+0xb3 00000000`022ffc80 00000001`3f3c1089 USER32!MessageBoxW+0x4e 00000000`022ffcc0 00000001`3f3c11fb ApplicationA+0x1089 00000000`022ffcf0 00000001`3f3c12a5 ApplicationA+0x11fb 00000000`022ffd20 00000000`776cf56d ApplicationA+0x12a5 00000000`022ffd50 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`022ffd80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800451d660 Cid 07f4.083c Teb: 000007fffffd3000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa800451da20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004514630 Image: ApplicationA.exe Attached Process N/A Image: N/A Wait Start TickCount 37543 Ticks: 2747 (0:00:00:42.853) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationA (0x000000013f3c1210) Stack Init fffff88005b5edb0 Current fffff88005b5e970 Base fffff88005b5f000 Limit fffff88005b59000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05b5e9b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05b5eaf0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`05b5eb80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05b5ebf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05b5ec20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05b5ec20) 00000000`01e0f828 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`01e0f830 00000001`3f3c10af KERNELBASE!SleepEx+0xab 00000000`01e0f8d0 00000001`3f3c11fb ApplicationA+0x10af 00000000`01e0f900 00000001`3f3c12a5 ApplicationA+0x11fb 00000000`01e0f930 00000000`776cf56d ApplicationA+0x12a5 00000000`01e0f960 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01e0f990 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800451e060 Cid 07f4.0b7c Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa800451e420 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004514630 Image: ApplicationA.exe Attached Process N/A Image: N/A Wait Start TickCount 37607 Ticks: 2683 (0:00:00:41.855) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationA (0x000000013f3c1210) Stack Init fffff88005b65db0 Current fffff88005b65970 Base fffff88005b66000 Limit fffff88005b60000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05b659b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05b65af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`05b65b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05b65bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05b65c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05b65c20) 00000000`024df8b8 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`024df8c0 00000001`3f3c10cf KERNELBASE!SleepEx+0xab 00000000`024df960 00000001`3f3c11fb ApplicationA+0x10cf 00000000`024df990 00000001`3f3c12a5 ApplicationA+0x11fb 00000000`024df9c0 00000000`776cf56d ApplicationA+0x12a5 00000000`024df9f0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`024dfa20 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004f85630 SessionId: 1 Cid: 021c Peb: 7fffffd5000 ParentCid: 01a0 DirBase: 09b69000 ObjectTable: fffff8a009773750 HandleCount: 35. Image: conhost.exe VadRoot fffffa8004d26340 Vads 44 Clone 0 Private 237. Modified 0. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a0003d1060 ElapsedTime 00:01:51.966 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (891, 50, 345) (3564KB, 200KB, 1380KB) PeakWorkingSetSize 891 VirtualSize 49 Mb PeakVirtualSize 49 Mb PageFaultCount 919 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 290 Setting context for this process... .process /p /r fffffa8004f85630 THREAD fffffa8004f84b60 Cid 021c.08c0 Teb: 000007fffffdc000 Win32Thread: fffff900c1c88500 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8004f84f20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004f85630 Image: conhost.exe Attached Process N/A Image: N/A Wait Start TickCount 33119 Ticks: 7171 (0:00:01:51.868) Context Switch Count 34 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address conhost!ConsoleLpcThread (0x00000000ffe1876c) Stack Init fffff88005b31db0 Current fffff88005b31790 Base fffff88005b32000 Limit fffff88005b2a000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05b317d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05b31910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05b319a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`05b31a40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`05b31aa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`05b31b40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`05b31be0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`05b31c20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05b31c20) 00000000`01ebf548 00000000`ffe1113e ntdll!NtReplyWaitReceivePort+0xa 00000000`01ebf550 00000000`776cf56d conhost!ConsoleLpcThread+0x249 00000000`01ebfb50 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01ebfb80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800451b060 Cid 021c.0b78 Teb: 000007fffffde000 Win32Thread: fffff900c2158c30 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8005371d80 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004f85630 Image: conhost.exe Attached Process N/A Image: N/A Wait Start TickCount 33191 Ticks: 7099 (0:00:01:50.745) Context Switch Count 106 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address conhost!ConsoleInputThread (0x00000000ffe19250) Stack Init fffff88005b44db0 Current fffff88005b446f0 Base fffff88005b45000 Limit fffff88005b3c000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05b44730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05b44870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05b44900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`05b449a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`05b44a40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`05b44a70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`05b44b50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`05b44b90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`05b44c20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05b44c20) 00000000`0220f878 00000000`775cc95e USER32!NtUserGetMessage+0xa 00000000`0220f880 00000000`ffe115f5 USER32!GetMessageW+0x34 00000000`0220f8b0 00000000`776cf56d conhost!ConsoleInputThread+0x10a 00000000`0220f910 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0220f940 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa80053ce630 SessionId: 1 Cid: 0798 Peb: 7fffffdf000 ParentCid: 06ac DirBase: 104d60000 ObjectTable: fffff8a0031e7760 HandleCount: 14. Image: ApplicationB.exe VadRoot fffffa8005194f80 Vads 33 Clone 0 Private 152. Modified 0. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a009936060 ElapsedTime 00:01:23.998 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (364, 50, 345) (1456KB, 200KB, 1380KB) PeakWorkingSetSize 364 VirtualSize 13 Mb PeakVirtualSize 13 Mb PageFaultCount 361 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 178 Setting context for this process... .process /p /r fffffa80053ce630 THREAD fffffa80053d0b60 Cid 0798.0a5c Teb: 000007fffffdd000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa80053d0f20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80053ce630 Image: ApplicationB.exe Attached Process N/A Image: N/A Wait Start TickCount 34911 Ticks: 5379 (0:00:01:23.912) Context Switch Count 22 UserTime 00:00:00.000 KernelTime 00:00:00.000 *** ERROR: Module load completed but symbols could not be loaded for ApplicationB.exe Win32 Start Address ApplicationB (0x000000013fe01538) Stack Init fffff88005883db0 Current fffff88005883970 Base fffff88005884000 Limit fffff8800587e000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`058839b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05883af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`05883b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05883bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05883c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05883c20) 00000000`002ffe28 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`002ffe30 00000001`3fe01149 KERNELBASE!SleepEx+0xab 00000000`002ffed0 00000001`3fe014fa ApplicationB+0x1149 00000000`002fff00 00000000`776cf56d ApplicationB+0x14fa 00000000`002fff40 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`002fff70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004acf5f0 Cid 0798.072c Teb: 000007fffffdb000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa8004acf9b0 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80053ce630 Image: ApplicationB.exe Attached Process N/A Image: N/A Wait Start TickCount 39078 Ticks: 1212 (0:00:00:18.907) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationB (0x000000013fe01200) Stack Init fffff88005becdb0 Current fffff88005bec970 Base fffff88005bed000 Limit fffff88005be7000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05bec9b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05becaf0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`05becb80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05becbf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05becc20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05becc20) 00000000`007af7d8 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`007af7e0 00000001`3fe0100f KERNELBASE!SleepEx+0xab 00000000`007af880 00000001`3fe011eb ApplicationB+0x100f 00000000`007af8b0 00000001`3fe01295 ApplicationB+0x11eb 00000000`007af8e0 00000000`776cf56d ApplicationB+0x1295 00000000`007af910 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`007af940 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004523b60 Cid 0798.065c Teb: 000007fffffd9000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa8004523f20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80053ce630 Image: ApplicationB.exe Attached Process N/A Image: N/A Wait Start TickCount 39142 Ticks: 1148 (0:00:00:17.908) Context Switch Count 6 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationB (0x000000013fe01200) Stack Init fffff88005bf3db0 Current fffff88005bf3970 Base fffff88005bf4000 Limit fffff88005bee000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05bf39b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05bf3af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`05bf3b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05bf3bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05bf3c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05bf3c20) 00000000`005ff858 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`005ff860 00000001`3fe0104b KERNELBASE!SleepEx+0xab 00000000`005ff900 00000001`3fe011eb ApplicationB+0x104b 00000000`005ff930 00000001`3fe01295 ApplicationB+0x11eb 00000000`005ff960 00000000`776cf56d ApplicationB+0x1295 00000000`005ff990 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`005ff9c0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004588450 Cid 0798.014c Teb: 000007fffffd7000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa8004588810 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80053ce630 Image: ApplicationB.exe Attached Process N/A Image: N/A Wait Start TickCount 39206 Ticks: 1084 (0:00:00:16.910) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationB (0x000000013fe01200) Stack Init fffff880052fbdb0 Current fffff880052fb970 Base fffff880052fc000 Limit fffff880052f6000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`052fb9b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`052fbaf0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`052fbb80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`052fbbf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`052fbc20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`052fbc20) 00000000`00a1fbc8 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`00a1fbd0 00000001`3fe0105f KERNELBASE!SleepEx+0xab 00000000`00a1fc70 00000001`3fe011eb ApplicationB+0x105f 00000000`00a1fca0 00000001`3fe01295 ApplicationB+0x11eb 00000000`00a1fcd0 00000000`776cf56d ApplicationB+0x1295 00000000`00a1fd00 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00a1fd30 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80053e2b60 Cid 0798.0a40 Teb: 000007fffffd5000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa80053e2f20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80053ce630 Image: ApplicationB.exe Attached Process N/A Image: N/A Wait Start TickCount 39270 Ticks: 1020 (0:00:00:15.912) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationB (0x000000013fe01200) Stack Init fffff88005375db0 Current fffff88005375970 Base fffff88005376000 Limit fffff88005370000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`053759b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05375af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`05375b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05375bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05375c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05375c20) 00000000`00b3f6c8 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`00b3f6d0 00000001`3fe0107f KERNELBASE!SleepEx+0xab 00000000`00b3f770 00000001`3fe011eb ApplicationB+0x107f 00000000`00b3f7a0 00000001`3fe01295 ApplicationB+0x11eb 00000000`00b3f7d0 00000000`776cf56d ApplicationB+0x1295 00000000`00b3f800 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00b3f830 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80053ceb60 Cid 0798.04a8 Teb: 000007fffffd3000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa80053cef20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80053ce630 Image: ApplicationB.exe Attached Process N/A Image: N/A Wait Start TickCount 39335 Ticks: 955 (0:00:00:14.898) Context Switch Count 5 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationB (0x000000013fe01200) Stack Init fffff8800538fdb0 Current fffff8800538f970 Base fffff88005390000 Limit fffff8800538a000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0538f9b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0538faf0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`0538fb80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`0538fbf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`0538fc20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0538fc20) 00000000`00c3fac8 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`00c3fad0 00000001`3fe0109f KERNELBASE!SleepEx+0xab 00000000`00c3fb70 00000001`3fe011eb ApplicationB+0x109f 00000000`00c3fba0 00000001`3fe01295 ApplicationB+0x11eb 00000000`00c3fbd0 00000000`776cf56d ApplicationB+0x1295 00000000`00c3fc00 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00c3fc30 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004571b60 Cid 0798.0bf0 Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa8004571f20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80053ce630 Image: ApplicationB.exe Attached Process N/A Image: N/A Wait Start TickCount 39399 Ticks: 891 (0:00:00:13.899) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationB (0x000000013fe01200) Stack Init fffff88005396db0 Current fffff88005396970 Base fffff88005397000 Limit fffff88005391000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`053969b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05396af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`05396b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05396bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05396c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05396c20) 00000000`00d6f7e8 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`00d6f7f0 00000001`3fe010bf KERNELBASE!SleepEx+0xab 00000000`00d6f890 00000001`3fe011eb ApplicationB+0x10bf 00000000`00d6f8c0 00000001`3fe01295 ApplicationB+0x11eb 00000000`00d6f8f0 00000000`776cf56d ApplicationB+0x1295 00000000`00d6f920 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00d6f950 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa80053d0060 SessionId: 1 Cid: 0248 Peb: 7fffffdc000 ParentCid: 01a0 DirBase: 102c33000 ObjectTable: fffff8a0098fb700 HandleCount: 34. Image: conhost.exe VadRoot fffffa800451eb20 Vads 44 Clone 0 Private 231. Modified 0. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a00992ea50 ElapsedTime 00:01:23.998 UserTime 00:00:00.015 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (887, 50, 345) (3548KB, 200KB, 1380KB) PeakWorkingSetSize 887 VirtualSize 49 Mb PeakVirtualSize 49 Mb PageFaultCount 920 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 286 Setting context for this process... .process /p /r fffffa80053d0060 THREAD fffffa8005197060 Cid 0248.0b50 Teb: 000007fffffda000 Win32Thread: fffff900c01d3c30 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8005197420 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80053d0060 Image: conhost.exe Attached Process N/A Image: N/A Wait Start TickCount 34911 Ticks: 5379 (0:00:01:23.912) Context Switch Count 26 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address conhost!ConsoleLpcThread (0x00000000ffe1876c) Stack Init fffff8800527cdb0 Current fffff8800527c790 Base fffff8800527d000 Limit fffff88005276000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0527c7d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0527c910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0527c9a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`0527ca40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`0527caa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`0527cb40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`0527cbe0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`0527cc20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0527cc20) 00000000`0022f188 00000000`ffe1113e ntdll!NtReplyWaitReceivePort+0xa 00000000`0022f190 00000000`776cf56d conhost!ConsoleLpcThread+0x249 00000000`0022f790 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0022f7c0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004f7b060 Cid 0248.09f0 Teb: 000007fffffde000 Win32Thread: fffff900c1e9ec30 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa800451b9d0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80053d0060 Image: conhost.exe Attached Process N/A Image: N/A Wait Start TickCount 35067 Ticks: 5223 (0:00:01:21.479) Context Switch Count 191 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address conhost!ConsoleInputThread (0x00000000ffe19250) Stack Init fffff880052eddb0 Current fffff880052ed6f0 Base fffff880052ee000 Limit fffff880052e5000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`052ed730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`052ed870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`052ed900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`052ed9a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`052eda40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`052eda70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`052edb50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`052edb90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`052edc20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`052edc20) 00000000`001cfb58 00000000`775cc95e USER32!NtUserGetMessage+0xa 00000000`001cfb60 00000000`ffe115f5 USER32!GetMessageW+0x34 00000000`001cfb90 00000000`776cf56d conhost!ConsoleInputThread+0x10a 00000000`001cfbf0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`001cfc20 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8005400b30 SessionId: 1 Cid: 0b34 Peb: 7fffffd5000 ParentCid: 06ac DirBase: b290f000 ObjectTable: fffff8a0098ebe90 HandleCount: 17. Image: ApplicationC.exe VadRoot fffffa80051a8db0 Vads 33 Clone 0 Private 153. Modified 0. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a009931440 ElapsedTime 00:01:06.924 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (365, 50, 345) (1460KB, 200KB, 1380KB) PeakWorkingSetSize 365 VirtualSize 13 Mb PeakVirtualSize 13 Mb PageFaultCount 362 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 179 Setting context for this process... .process /p /r fffffa8005400b30 THREAD fffffa8004f8b240 Cid 0b34.0ab0 Teb: 000007fffffde000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004c41fe0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8005400b30 Image: ApplicationC.exe Attached Process N/A Image: N/A Wait Start TickCount 36389 Ticks: 3901 (0:00:01:00.855) Context Switch Count 26 UserTime 00:00:00.000 KernelTime 00:00:00.000 *** ERROR: Module load completed but symbols could not be loaded for ApplicationC.exe Win32 Start Address ApplicationC (0x000000013f7015d8) Stack Init fffff88005419db0 Current fffff88005419900 Base fffff8800541a000 Limit fffff88005414000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05419940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05419a80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05419b10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05419bb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05419c20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05419c20) 00000000`002af9f8 00000000`7781d1a8 ntdll!NtWaitForSingleObject+0xa 00000000`002afa00 00000000`7781d0a2 ntdll!RtlpWaitOnCriticalSection+0xe8 00000000`002afab0 00000001`3f7011c2 ntdll!RtlEnterCriticalSection+0xab 00000000`002afae0 00000001`3f70159a ApplicationC+0x11c2 00000000`002afb10 00000000`776cf56d ApplicationC+0x159a 00000000`002afb50 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`002afb80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800455b060 Cid 0b34.0b98 Teb: 000007fffffdc000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa80045339c0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8005400b30 Image: ApplicationC.exe Attached Process N/A Image: N/A Wait Start TickCount 36197 Ticks: 4093 (0:00:01:03.851) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationC (0x000000013f7012a0) Stack Init fffff8800537cdb0 Current fffff8800537c900 Base fffff8800537d000 Limit fffff88005377000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0537c940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0537ca80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0537cb10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`0537cbb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`0537cc20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0537cc20) 00000000`005cfc18 00000000`7781d1a8 ntdll!NtWaitForSingleObject+0xa 00000000`005cfc20 00000000`7781d0a2 ntdll!RtlpWaitOnCriticalSection+0xe8 00000000`005cfcd0 00000001`3f701036 ntdll!RtlEnterCriticalSection+0xab 00000000`005cfd00 00000001`3f70128b ApplicationC+0x1036 00000000`005cfd30 00000001`3f701335 ApplicationC+0x128b 00000000`005cfd60 00000000`776cf56d ApplicationC+0x1335 00000000`005cfd90 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`005cfdc0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005000960 Cid 0b34.09b0 Teb: 000007fffffda000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa8005000d20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8005400b30 Image: ApplicationC.exe Attached Process N/A Image: N/A Wait Start TickCount 40235 Ticks: 55 (0:00:00:00.858) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationC (0x000000013f7012a0) Stack Init fffff880049efdb0 Current fffff880049ef970 Base fffff880049f0000 Limit fffff880049ea000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`049ef9b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`049efaf0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`049efb80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`049efbf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`049efc20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`049efc20) 00000000`0082f988 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`0082f990 00000001`3f70107f KERNELBASE!SleepEx+0xab 00000000`0082fa30 00000001`3f70128b ApplicationC+0x107f 00000000`0082fa60 00000001`3f701335 ApplicationC+0x128b 00000000`0082fa90 00000000`776cf56d ApplicationC+0x1335 00000000`0082fac0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0082faf0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004565060 Cid 0b34.0b80 Teb: 000007fffffd8000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa8004565420 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8005400b30 Image: ApplicationC.exe Attached Process N/A Image: N/A Wait Start TickCount 36004 Ticks: 4286 (0:00:01:06.862) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationC (0x000000013f7012a0) Stack Init fffff88005b99db0 Current fffff88005b99970 Base fffff88005b9a000 Limit fffff88005b94000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05b999b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05b99af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`05b99b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05b99bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05b99c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05b99c20) 00000000`009ff778 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`009ff780 00000001`3f70109f KERNELBASE!SleepEx+0xab 00000000`009ff820 00000001`3f70128b ApplicationC+0x109f 00000000`009ff850 00000001`3f701335 ApplicationC+0x128b 00000000`009ff880 00000000`776cf56d ApplicationC+0x1335 00000000`009ff8b0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`009ff8e0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004cd2b60 Cid 0b34.0ad0 Teb: 000007fffffd6000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa8004cd2f20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8005400b30 Image: ApplicationC.exe Attached Process N/A Image: N/A Wait Start TickCount 36004 Ticks: 4286 (0:00:01:06.862) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationC (0x000000013f7012a0) Stack Init fffff88005bfadb0 Current fffff88005bfa970 Base fffff88005bfb000 Limit fffff88005bf5000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site fffff880`05bfa9b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05bfaaf0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`05bfab80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05bfabf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05bfac20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05bfac20) 00000000`006df898 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`006df8a0 00000001`3f7010bf KERNELBASE!SleepEx+0xab 00000000`006df940 00000001`3f70128b ApplicationC+0x10bf 00000000`006df970 00000001`3f701335 ApplicationC+0x128b 00000000`006df9a0 00000000`776cf56d ApplicationC+0x1335 00000000`006df9d0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`006dfa00 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800457a060 Cid 0b34.0a34 Teb: 000007fffffd3000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa800457a420 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8005400b30 Image: ApplicationC.exe Attached Process N/A Image: N/A Wait Start TickCount 36004 Ticks: 4286 (0:00:01:06.862) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationC (0x000000013f7012a0) Stack Init fffff88005b16db0 Current fffff88005b16970 Base fffff88005b17000 Limit fffff88005b11000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05b169b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05b16af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`05b16b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05b16bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05b16c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05b16c20) 00000000`00bdfd08 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`00bdfd10 00000001`3f7010df KERNELBASE!SleepEx+0xab 00000000`00bdfdb0 00000001`3f70128b ApplicationC+0x10df 00000000`00bdfde0 00000001`3f701335 ApplicationC+0x128b 00000000`00bdfe10 00000000`776cf56d ApplicationC+0x1335 00000000`00bdfe40 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00bdfe70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004562b60 Cid 0b34.0858 Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004b96ce0 Mutant - owning thread fffffa8004523b60 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8005400b30 Image: ApplicationC.exe Attached Process N/A Image: N/A Wait Start TickCount 36004 Ticks: 4286 (0:00:01:06.862) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationC (0x000000013f7012a0) Stack Init fffff88005b1ddb0 Current fffff88005b1d900 Base fffff88005b1e000 Limit fffff88005b18000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05b1d940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05b1da80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05b1db10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05b1dbb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05b1dc20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05b1dc20) 00000000`00e2f658 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`00e2f660 00000001`3f70112e KERNELBASE!WaitForSingleObjectEx+0x79 00000000`00e2f700 00000001`3f70128b ApplicationC+0x112e 00000000`00e2f730 00000001`3f701335 ApplicationC+0x128b 00000000`00e2f760 00000000`776cf56d ApplicationC+0x1335 00000000`00e2f790 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00e2f7c0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa800451f060 SessionId: 1 Cid: 0bb4 Peb: 7fffffda000 ParentCid: 01a0 DirBase: b0e39000 ObjectTable: fffff8a0098ca220 HandleCount: 35. Image: conhost.exe VadRoot fffffa8004947bb0 Vads 44 Clone 0 Private 230. Modified 0. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a0099a8060 ElapsedTime 00:01:06.908 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (893, 50, 345) (3572KB, 200KB, 1380KB) PeakWorkingSetSize 893 VirtualSize 49 Mb PeakVirtualSize 49 Mb PageFaultCount 925 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 285 Setting context for this process... .process /p /r fffffa800451f060 THREAD fffffa8004517060 Cid 0bb4.0b54 Teb: 000007fffffdc000 Win32Thread: fffff900c1a3d120 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8004517420 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa800451f060 Image: conhost.exe Attached Process N/A Image: N/A Wait Start TickCount 36004 Ticks: 4286 (0:00:01:06.862) Context Switch Count 27 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address conhost!ConsoleLpcThread (0x00000000ffe1876c) Stack Init fffff88005af4db0 Current fffff88005af4790 Base fffff88005af5000 Limit fffff88005aee000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05af47d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05af4910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05af49a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`05af4a40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`05af4aa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`05af4b40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`05af4be0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`05af4c20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05af4c20) 00000000`01f9f6d8 00000000`ffe1113e ntdll!NtReplyWaitReceivePort+0xa 00000000`01f9f6e0 00000000`776cf56d conhost!ConsoleLpcThread+0x249 00000000`01f9fce0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01f9fd10 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80051aab60 Cid 0bb4.0918 Teb: 000007fffffde000 Win32Thread: fffff900c1a4bc30 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004cb0290 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa800451f060 Image: conhost.exe Attached Process N/A Image: N/A Wait Start TickCount 36147 Ticks: 4143 (0:00:01:04.631) Context Switch Count 199 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address conhost!ConsoleInputThread (0x00000000ffe19250) Stack Init fffff88005b07db0 Current fffff88005b076f0 Base fffff88005b08000 Limit fffff88005aff000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05b07730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05b07870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05b07900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`05b079a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`05b07a40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`05b07a70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`05b07b50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`05b07b90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`05b07c20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05b07c20) 00000000`0231fe98 00000000`775cc95e USER32!NtUserGetMessage+0xa 00000000`0231fea0 00000000`ffe115f5 USER32!GetMessageW+0x34 00000000`0231fed0 00000000`776cf56d conhost!ConsoleInputThread+0x10a 00000000`0231ff30 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0231ff60 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8005369060 SessionId: 1 Cid: 0abc Peb: 7fffffd8000 ParentCid: 06ac DirBase: a3994000 ObjectTable: fffff8a0032c03a0 HandleCount: 15. Image: ApplicationD.exe VadRoot fffffa8004f5b240 Vads 34 Clone 0 Private 157. Modified 0. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a0028d8a50 ElapsedTime 00:00:54.266 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (419, 50, 345) (1676KB, 200KB, 1380KB) PeakWorkingSetSize 419 VirtualSize 13 Mb PeakVirtualSize 13 Mb PageFaultCount 417 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 181 Setting context for this process... .process /p /r fffffa8005369060 THREAD fffffa800535f060 Cid 0abc.08fc Teb: 000007fffffde000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 fffffa800535f338 Semaphore Limit 0x2 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8005369060 Image: ApplicationD.exe Attached Process N/A Image: N/A Wait Start TickCount 37083 Ticks: 3207 (0:00:00:50.029) Context Switch Count 31 UserTime 00:00:00.000 KernelTime 00:00:00.000 *** ERROR: Module load completed but symbols could not be loaded for ApplicationD.exe Win32 Start Address ApplicationD (0x000000013fa71650) Stack Init fffff88005591db0 Current fffff88005591780 Base fffff88005592000 Limit fffff8800558c000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`055917c0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05591900 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05591990 fffff800`01a6b0e4 nt!KeWaitForSingleObject+0x19f fffff880`05591a30 fffff800`01a69101 nt!KiSuspendThread+0x74 fffff880`05591a70 fffff800`01a93b9d nt!KiDeliverApc+0x211 fffff880`05591af0 fffff800`01a9597a nt!KiCommitThreadWait+0x3dd fffff880`05591b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05591bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05591c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05591c20) 00000000`002ff888 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`002ff890 00000001`3fa71169 KERNELBASE!SleepEx+0xab 00000000`002ff930 00000001`3fa71612 ApplicationD+0x1169 00000000`002ff960 00000000`776cf56d ApplicationD+0x1612 00000000`002ff9a0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`002ff9d0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004548b60 Cid 0abc.0b04 Teb: 000007fffffdc000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 fffffa8004548e38 Semaphore Limit 0x2 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8005369060 Image: ApplicationD.exe Attached Process N/A Image: N/A Wait Start TickCount 37062 Ticks: 3228 (0:00:00:50.357) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationD (0x000000013fa71318) Stack Init fffff8800571ddb0 Current fffff8800571d780 Base fffff8800571e000 Limit fffff88005718000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`0571d7c0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`0571d900 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`0571d990 fffff800`01a6b0e4 nt!KeWaitForSingleObject+0x19f fffff880`0571da30 fffff800`01a69101 nt!KiSuspendThread+0x74 fffff880`0571da70 fffff800`01a93b9d nt!KiDeliverApc+0x211 fffff880`0571daf0 fffff800`01a9597a nt!KiCommitThreadWait+0x3dd fffff880`0571db80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`0571dbf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`0571dc20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`0571dc20) 00000000`0062fd38 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`0062fd40 00000001`3fa7100f KERNELBASE!SleepEx+0xab 00000000`0062fde0 00000001`3fa71303 ApplicationD+0x100f 00000000`0062fe10 00000001`3fa713ad ApplicationD+0x1303 00000000`0062fe40 00000000`776cf56d ApplicationD+0x13ad 00000000`0062fe70 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0062fea0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004ea7b60 Cid 0abc.03a8 Teb: 000007fffffda000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 fffffa8004ea7e38 Semaphore Limit 0x2 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8005369060 Image: ApplicationD.exe Attached Process N/A Image: N/A Wait Start TickCount 37062 Ticks: 3228 (0:00:00:50.357) Context Switch Count 5 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationD (0x000000013fa71318) Stack Init fffff880057fadb0 Current fffff880057fa780 Base fffff880057fb000 Limit fffff880057f5000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`057fa7c0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`057fa900 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`057fa990 fffff800`01a6b0e4 nt!KeWaitForSingleObject+0x19f fffff880`057faa30 fffff800`01a69101 nt!KiSuspendThread+0x74 fffff880`057faa70 fffff800`01a93b9d nt!KiDeliverApc+0x211 fffff880`057faaf0 fffff800`01a9597a nt!KiCommitThreadWait+0x3dd fffff880`057fab80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`057fabf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`057fac20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`057fac20) 00000000`0092fc78 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`0092fc80 00000001`3fa7102f KERNELBASE!SleepEx+0xab 00000000`0092fd20 00000001`3fa71303 ApplicationD+0x102f 00000000`0092fd50 00000001`3fa713ad ApplicationD+0x1303 00000000`0092fd80 00000000`776cf56d ApplicationD+0x13ad 00000000`0092fdb0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0092fde0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004eeeb60 Cid 0abc.0b40 Teb: 000007fffffd6000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 fffffa8004eeee38 Semaphore Limit 0x2 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8005369060 Image: ApplicationD.exe Attached Process N/A Image: N/A Wait Start TickCount 37062 Ticks: 3228 (0:00:00:50.357) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationD (0x000000013fa71318) Stack Init fffff88005a3fdb0 Current fffff88005a3f780 Base fffff88005a40000 Limit fffff88005a3a000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05a3f7c0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05a3f900 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05a3f990 fffff800`01a6b0e4 nt!KeWaitForSingleObject+0x19f fffff880`05a3fa30 fffff800`01a69101 nt!KiSuspendThread+0x74 fffff880`05a3fa70 fffff800`01a93b9d nt!KiDeliverApc+0x211 fffff880`05a3faf0 fffff800`01a9597a nt!KiCommitThreadWait+0x3dd fffff880`05a3fb80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05a3fbf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05a3fc20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05a3fc20) 00000000`00b2fdf8 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`00b2fe00 00000001`3fa7104f KERNELBASE!SleepEx+0xab 00000000`00b2fea0 00000001`3fa71303 ApplicationD+0x104f 00000000`00b2fed0 00000001`3fa713ad ApplicationD+0x1303 00000000`00b2ff00 00000000`776cf56d ApplicationD+0x13ad 00000000`00b2ff30 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00b2ff60 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800519e060 Cid 0abc.0664 Teb: 000007fffffd4000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 fffffa800519e338 Semaphore Limit 0x2 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8005369060 Image: ApplicationD.exe Attached Process N/A Image: N/A Wait Start TickCount 37062 Ticks: 3228 (0:00:00:50.357) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationD (0x000000013fa71318) Stack Init fffff88005a46db0 Current fffff88005a46780 Base fffff88005a47000 Limit fffff88005a41000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05a467c0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05a46900 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05a46990 fffff800`01a6b0e4 nt!KeWaitForSingleObject+0x19f fffff880`05a46a30 fffff800`01a69101 nt!KiSuspendThread+0x74 fffff880`05a46a70 fffff800`01a93b9d nt!KiDeliverApc+0x211 fffff880`05a46af0 fffff800`01a9597a nt!KiCommitThreadWait+0x3dd fffff880`05a46b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05a46bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05a46c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05a46c20) 00000000`0081fc08 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`0081fc10 00000001`3fa7106f KERNELBASE!SleepEx+0xab 00000000`0081fcb0 00000001`3fa71303 ApplicationD+0x106f 00000000`0081fce0 00000001`3fa713ad ApplicationD+0x1303 00000000`0081fd10 00000000`776cf56d ApplicationD+0x13ad 00000000`0081fd40 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0081fd70 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004514060 Cid 0abc.087c Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa800518fb30 ProcessObject Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8005369060 Image: ApplicationD.exe Attached Process N/A Image: N/A Wait Start TickCount 37081 Ticks: 3209 (0:00:00:50.060) Context Switch Count 11 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationD (0x000000013fa71318) Stack Init fffff88005a6cdb0 Current fffff88005a6c900 Base fffff88005a6d000 Limit fffff88005a67000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05a6c940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05a6ca80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05a6cb10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05a6cbb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05a6cc20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05a6cc20) 00000000`00dde928 00000000`77895ce2 ntdll!NtWaitForSingleObject+0xa 00000000`00dde930 00000000`77895e85 ntdll!RtlReportExceptionEx+0x1d2 00000000`00ddea20 00000000`77895eea ntdll!RtlReportException+0xb5 00000000`00ddeaa0 00000000`77896d25 ntdll!RtlpTerminateFailureFilter+0x1a 00000000`00ddead0 00000000`777e5148 ntdll!RtlReportCriticalFailure+0x96 00000000`00ddeb00 00000000`7780554d ntdll!_C_specific_handler+0x8c 00000000`00ddeb70 00000000`777e5d1c ntdll!RtlpExecuteHandlerForException+0xd 00000000`00ddeba0 00000000`777e62ee ntdll!RtlDispatchException+0x3cb 00000000`00ddf280 00000000`77896cd2 ntdll!RtlRaiseException+0x221 00000000`00ddf8c0 00000000`77897396 ntdll!RtlReportCriticalFailure+0x62 00000000`00ddf990 00000000`778986c2 ntdll!RtlpReportHeapFailure+0x26 00000000`00ddf9c0 00000000`7789a0c4 ntdll!RtlpHeapHandleError+0x12 00000000`00ddf9f0 00000000`7783d1cd ntdll!RtlpLogHeapFailure+0xa4 00000000`00ddfa20 00000000`776d2c7a ntdll! ?? ::FNODOBFM::`string'+0x123b4 00000000`00ddfaa0 00000001`3fa71274 kernel32!HeapFree+0xa 00000000`00ddfad0 00000001`3fa710c3 ApplicationD+0x1274 00000000`00ddfb00 00000001`3fa71303 ApplicationD+0x10c3 00000000`00ddfb30 00000001`3fa713ad ApplicationD+0x1303 00000000`00ddfb60 00000000`776cf56d ApplicationD+0x13ad 00000000`00ddfb90 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00ddfbc0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004ac3660 Cid 0abc.0970 Teb: 000007fffffac000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 fffffa8004ac3938 Semaphore Limit 0x2 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8005369060 Image: ApplicationD.exe Attached Process N/A Image: N/A Wait Start TickCount 37062 Ticks: 3228 (0:00:00:50.357) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationD (0x000000013fa71318) Stack Init fffff88005a73db0 Current fffff88005a73780 Base fffff88005a74000 Limit fffff88005a6e000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05a737c0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05a73900 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05a73990 fffff800`01a6b0e4 nt!KeWaitForSingleObject+0x19f fffff880`05a73a30 fffff800`01a69101 nt!KiSuspendThread+0x74 fffff880`05a73a70 fffff800`01a93b9d nt!KiDeliverApc+0x211 fffff880`05a73af0 fffff800`01a9597a nt!KiCommitThreadWait+0x3dd fffff880`05a73b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05a73bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05a73c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05a73c20) 00000000`00f0fa78 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`00f0fa80 00000001`3fa710df KERNELBASE!SleepEx+0xab 00000000`00f0fb20 00000001`3fa71303 ApplicationD+0x10df 00000000`00f0fb50 00000001`3fa713ad ApplicationD+0x1303 00000000`00f0fb80 00000000`776cf56d ApplicationD+0x13ad 00000000`00f0fbb0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00f0fbe0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa80053ce060 SessionId: 1 Cid: 0a14 Peb: 7fffffdb000 ParentCid: 01a0 DirBase: a593f000 ObjectTable: fffff8a00aef8820 HandleCount: 34. Image: conhost.exe VadRoot fffffa8004e5ec00 Vads 44 Clone 0 Private 232. Modified 0. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a0099d77e0 ElapsedTime 00:00:54.266 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (885, 50, 345) (3540KB, 200KB, 1380KB) PeakWorkingSetSize 885 VirtualSize 49 Mb PeakVirtualSize 49 Mb PageFaultCount 916 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 285 Setting context for this process... .process /p /r fffffa80053ce060 THREAD fffffa800538ab60 Cid 0a14.0580 Teb: 000007fffffdc000 Win32Thread: fffff900c1a68010 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa800538af20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80053ce060 Image: conhost.exe Attached Process N/A Image: N/A Wait Start TickCount 36815 Ticks: 3475 (0:00:00:54.210) Context Switch Count 26 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address conhost!ConsoleLpcThread (0x00000000ffe1876c) Stack Init fffff880057b9db0 Current fffff880057b9790 Base fffff880057ba000 Limit fffff880057b3000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`057b97d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`057b9910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`057b99a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`057b9a40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`057b9aa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`057b9b40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`057b9be0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`057b9c20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`057b9c20) 00000000`01fff598 00000000`ffe1113e ntdll!NtReplyWaitReceivePort+0xa 00000000`01fff5a0 00000000`776cf56d conhost!ConsoleLpcThread+0x249 00000000`01fffba0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01fffbd0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004588b60 Cid 0a14.0a50 Teb: 000007fffffde000 Win32Thread: fffff900c1a5e010 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa800539a3d0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80053ce060 Image: conhost.exe Attached Process N/A Image: N/A Wait Start TickCount 37114 Ticks: 3176 (0:00:00:49.545) Context Switch Count 219 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address conhost!ConsoleInputThread (0x00000000ffe19250) Stack Init fffff88005a25db0 Current fffff88005a256f0 Base fffff88005a26000 Limit fffff88005a1d000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05a25730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05a25870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05a25900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`05a259a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`05a25a40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`05a25a70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`05a25b50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`05a25b90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`05a25c20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05a25c20) 00000000`01f0fc18 00000000`775cc95e USER32!NtUserGetMessage+0xa 00000000`01f0fc20 00000000`ffe115f5 USER32!GetMessageW+0x34 00000000`01f0fc50 00000000`776cf56d conhost!ConsoleInputThread+0x10a 00000000`01f0fcb0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01f0fce0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa800540e060 SessionId: 0 Cid: 0a1c Peb: 7fffffd9000 ParentCid: 0210 DirBase: 7f4f9000 ObjectTable: fffff8a0099295c0 HandleCount: 75. Image: svchost.exe VadRoot fffffa800495abc0 Vads 59 Clone 0 Private 311. Modified 0. Locked 0. DeviceMap fffff8a000008c10 Token fffff8a009562a70 ElapsedTime 00:00:50.552 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1018, 50, 345) (4072KB, 200KB, 1380KB) PeakWorkingSetSize 1045 VirtualSize 42 Mb PeakVirtualSize 43 Mb PageFaultCount 1066 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 392 Setting context for this process... .process /p /r fffffa800540e060 THREAD fffffa8005362060 Cid 0a1c.0b68 Teb: 000007fffffde000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004dc0a60 SynchronizationEvent Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa800540e060 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 37051 Ticks: 3239 (0:00:00:50.528) Context Switch Count 13 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address svchost!wmainCRTStartup (0x00000000ffa9246c) Stack Init fffff88005abbdb0 Current fffff88005abb900 Base fffff88005abc000 Limit fffff88005ab6000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05abb940 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05abba80 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05abbb10 fffff800`01d871d2 nt!KeWaitForSingleObject+0x19f fffff880`05abbbb0 fffff800`01a8b993 nt!NtWaitForSingleObject+0xb2 fffff880`05abbc20 00000000`7781fefa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05abbc20) 00000000`001ffab8 000007fe`fda910ac ntdll!NtWaitForSingleObject+0xa 00000000`001ffac0 000007fe`ff4eaffb KERNELBASE!WaitForSingleObjectEx+0x79 00000000`001ffb60 000007fe`ff4e9d61 sechost!ScSendResponseReceiveControls+0x13b 00000000`001ffc50 000007fe`ff4e9c16 sechost!ScDispatcherLoop+0x121 00000000`001ffd60 00000000`ffa91d3a sechost!StartServiceCtrlDispatcherW+0x14e 00000000`001ffdb0 00000000`ffa9257a svchost!wmain+0x110 00000000`001ffde0 00000000`776cf56d svchost!ScCreateWellKnownSids+0x2fd 00000000`001ffe20 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`001ffe50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800518b060 Cid 0a1c.0440 Teb: 000007fffffdc000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable fffffa8004f29d10 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa800540e060 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 37051 Ticks: 3239 (0:00:00:50.528) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005ac9db0 Current fffff88005ac97d0 Base fffff88005aca000 Limit fffff88005ac4000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05ac9810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05ac9950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`05ac99e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05ac9a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05ac9b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05ac9c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05ac9c20) 00000000`0058fa48 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0058fa50 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0058fd50 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0058fd80 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800535e060 Cid 0a1c.0a84 Teb: 000007fffffda000 Win32Thread: fffff900c1cb9010 WAIT: (WrQueue) UserMode Alertable fffffa8004f29d10 QueueObject Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa800540e060 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 37057 Ticks: 3233 (0:00:00:50.435) Context Switch Count 26 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWorkerThread (0x00000000777e8f00) Stack Init fffff88005bd2db0 Current fffff88005bd27d0 Base fffff88005bd3000 Limit fffff88005bca000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05bd2810 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05bd2950 fffff800`01a972a1 nt!KiCommitThreadWait+0x1d2 fffff880`05bd29e0 fffff800`01d87df7 nt!KeRemoveQueueEx+0x301 fffff880`05bd2a90 fffff800`01a9caa6 nt!IoRemoveIoCompletion+0x47 fffff880`05bd2b20 fffff800`01a8b993 nt!NtWaitForWorkViaWorkerFactory+0x285 fffff880`05bd2c20 00000000`778217ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05bd2c20) 00000000`0069f928 00000000`777e914b ntdll!NtWaitForWorkViaWorkerFactory+0xa 00000000`0069f930 00000000`776cf56d ntdll!TppWorkerThread+0x2c9 00000000`0069fc30 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0069fc60 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800518bb60 Cid 0a1c.0bc8 Teb: 000007fffffd5000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa800519fda0 SynchronizationTimer fffffa8004948850 NotificationEvent fffffa800494f060 SynchronizationTimer fffffa8005156970 SynchronizationTimer Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa800540e060 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 37052 Ticks: 3238 (0:00:00:50.513) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff88005adedb0 Current fffff88005addfd0 Base fffff88005adf000 Limit fffff88005ad9000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05ade010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05ade150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`05ade1e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05ade490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`05ade960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`05adebb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05adec20) 00000000`00bbf8b8 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`00bbf8c0 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`00bbfb60 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00bbfb90 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800519eb60 Cid 0a1c.08b8 Teb: 000007fffffd3000 Win32Thread: 0000000000000000 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa800519ef20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a000008c10 Owning Process fffffa800540e060 Image: svchost.exe Attached Process N/A Image: N/A Wait Start TickCount 37057 Ticks: 3233 (0:00:00:50.435) Context Switch Count 6 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address wersvc!CWerService::StaticLpcServerThread (0x000007fef6f04c88) Stack Init fffff88005b6cdb0 Current fffff88005b6c750 Base fffff88005b6d000 Limit fffff88005b67000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05b6c790 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05b6c8d0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`05b6c960 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`05b6ca00 fffff800`01d8cac7 nt!AlpcpReceiveMessagePort+0x189 fffff880`05b6ca60 fffff800`01d8e006 nt!AlpcpReceiveMessage+0x2d4 fffff880`05b6cb00 fffff800`01a8b993 nt!NtAlpcSendWaitReceivePort+0x1e6 fffff880`05b6cbb0 00000000`7782070a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05b6cc20) 00000000`00c4ee08 000007fe`f6f04da6 ntdll!ZwAlpcSendWaitReceivePort+0xa 00000000`00c4ee10 000007fe`f6f04c91 wersvc!CWerService::LpcServerThread+0xf2 00000000`00c4f7f0 00000000`776cf56d wersvc!CWerService::StaticLpcServerThread+0x9 00000000`00c4f820 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00c4f850 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa800518fb30 SessionId: 1 Cid: 0a78 Peb: 7fffffde000 ParentCid: 0a1c DirBase: 83484000 ObjectTable: fffff8a00331a4e0 HandleCount: 115. Image: WerFault.exe VadRoot fffffa8004520900 Vads 90 Clone 0 Private 637. Modified 15. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a0099fc640 ElapsedTime 00:00:50.458 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (2467, 50, 345) (9868KB, 200KB, 1380KB) PeakWorkingSetSize 2467 VirtualSize 83 Mb PeakVirtualSize 84 Mb PageFaultCount 2984 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 1107 Setting context for this process... .process /p /r fffffa800518fb30 THREAD fffffa8005360b60 Cid 0a78.090c Teb: 000007fffffdc000 Win32Thread: fffff900c1d56010 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004eb2de0 NotificationEvent fffffa800519e660 Thread fffffa8004517740 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa800518fb30 Image: WerFault.exe Attached Process N/A Image: N/A Wait Start TickCount 37087 Ticks: 3203 (0:00:00:49.967) Context Switch Count 163 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.031 Win32 Start Address WerFault!wmainCRTStartup (0x00000000ff504920) Stack Init fffff88005be5db0 Current fffff88005be4fd0 Base fffff88005be6000 Limit fffff88005bdd000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05be5010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05be5150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`05be51e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05be5490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`05be5960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`05be5bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05be5c20) 00000000`001fc858 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`001fc860 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`001fc960 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`001fc9f0 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`001fca90 00000000`775c8880 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`001fcad0 000007fe`f6eddc3c USER32!MsgWaitForMultipleObjects+0x20 00000000`001fcb10 000007fe`f6ed9f1a werui!UtilMsgWaitForMultipleObjects+0x54 00000000`001fcba0 000007fe`f6ed458a werui!CInitialConsentUI::Show+0x202 00000000`001fcbf0 000007fe`f6ed46ba werui!CEventUI::GetInitialDialogSelection+0x15e 00000000`001fcc60 000007fe`f6ed31d5 werui!CEventUI::Start+0x3a 00000000`001fcde0 000007fe`f20575be werui!WerUIStart+0x45 00000000`001fce10 000007fe`f201bd33 wer!CWerUIFacade::Start+0x1a 00000000`001fce40 000007fe`f201b99b wer!CReportManager::ReportProblem+0x67d 00000000`001fcf60 000007fe`f2041cbe wer!CReportHandleInstance::SubmitReport+0x386 00000000`001fcfd0 000007fe`f58a9a26 wer!WerReportSubmit+0x16a 00000000`001fd070 000007fe`f58a7eda faultrep!CCrashReport::GenerateCrashReport+0xc42 00000000`001fe070 000007fe`f58a71a1 faultrep!CCrashReport::ReportCrash+0x51e 00000000`001fe9f0 00000000`ff4d3811 faultrep!WerpInitiateCrashReporting+0x509 00000000`001ff610 00000000`ff4c9075 WerFault!UserCrashMain+0x18d 00000000`001ff650 00000000`ff5047d1 WerFault!wmain+0x149 00000000`001ffb80 00000000`776cf56d WerFault!DelayLoadFailureHook+0x199 00000000`001ffbc0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`001ffbf0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005404b60 Cid 0a78.07ec Teb: 000007fffffd8000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffffa80053a6270 SynchronizationTimer fffffa80045835f0 SynchronizationTimer fffffa80053f85e0 SynchronizationTimer Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa800518fb30 Image: WerFault.exe Attached Process N/A Image: N/A Wait Start TickCount 37065 Ticks: 3225 (0:00:00:50.310) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ntdll!TppWaiterpThread (0x00000000777e9a90) Stack Init fffff88005ad0db0 Current fffff88005acffd0 Base fffff88005ad1000 Limit fffff88005acb000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05ad0010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05ad0150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`05ad01e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`05ad0490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`05ad0960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`05ad0bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05ad0c20) 00000000`022df838 00000000`777e9bd7 ntdll!NtWaitForMultipleObjects+0xa 00000000`022df840 00000000`776cf56d ntdll!TppWaiterpThread+0x14d 00000000`022dfae0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`022dfb10 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800519e660 Cid 0a78.05e8 Teb: 000007fffffda000 Win32Thread: fffff900c1a03c30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8005118620 SynchronizationEvent fffffa8004c3f810 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa800518fb30 Image: WerFault.exe Attached Process N/A Image: N/A Wait Start TickCount 40290 Ticks: 0 Context Switch Count 556 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.062 Win32 Start Address werui!CInitialConsentUI::Static_InitialDlgThreadRoutine (0x000007fef6ed9f68) Stack Init fffff88004300770 Current fffff880042ff990 Base fffff88004301000 Limit fffff880042f5000 Call fffff880043009e0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`042ff9d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`042ffb10 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`042ffba0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`042ffe50 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04300320 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04300570 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`043005e0) 00000000`026ef088 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`026ef090 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`026ef190 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`026ef220 000007fe`fba714e6 USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`026ef2c0 000007fe`fba715ef DUser!CoreSC::Wait+0x62 00000000`026ef310 000007fe`fba71565 DUser!CoreSC::WaitMessage+0x6f 00000000`026ef350 00000000`775cbfce DUser!MphWaitMessageEx+0x5c 00000000`026ef380 00000000`7781fdf5 USER32!_ClientWaitMessageExMPH+0x1a 00000000`026ef3d0 00000000`775cbf5a ntdll!KiUserCallbackDispatcherContinue (TrapFrame @ 00000000`026ef298) 00000000`026ef438 00000000`775d7214 USER32!ZwUserWaitMessage+0xa 00000000`026ef440 00000000`775d74a5 USER32!DialogBox2+0x274 00000000`026ef4d0 00000000`775d751a USER32!InternalDialogBox+0x135 00000000`026ef530 00000000`775d7558 USER32!DialogBoxIndirectParamAorW+0x58 00000000`026ef570 000007fe`fc021d4e USER32!DialogBoxIndirectParamW+0x18 00000000`026ef5b0 000007fe`fbf5dd2d COMCTL32!SHFusionDialogBoxIndirectParam+0x56 00000000`026ef600 000007fe`f6ed7469 COMCTL32!CTaskDialog::Show+0x1a1 00000000`026ef690 000007fe`f6eda4d1 werui!IsolationAwareTaskDialogIndirect+0xe5 00000000`026ef6d0 000007fe`f6ed9f71 werui!CInitialConsentUI::InitialDlgThreadRoutine+0x551 00000000`026ef7e0 00000000`776cf56d werui!CInitialConsentUI::Static_InitialDlgThreadRoutine+0x9 00000000`026ef810 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`026ef840 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80053f8b60 Cid 0a78.08b0 Teb: 000007fffffd6000 Win32Thread: fffff900c1ac1c30 WAIT: (UserRequest) UserMode Non-Alertable fffffa8004dfa7f0 SynchronizationEvent fffffa8005367ad0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa800518fb30 Image: WerFault.exe Attached Process N/A Image: N/A Wait Start TickCount 37087 Ticks: 3203 (0:00:00:49.967) Context Switch Count 2 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address msvcrt!endthreadex (0x000007fefdd173fc) Stack Init fffff88004462db0 Current fffff88004461fd0 Base fffff88004463000 Limit fffff8800445c000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`04462010 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`04462150 fffff800`01a8fd4b nt!KiCommitThreadWait+0x1d2 fffff880`044621e0 fffff800`01d882ef nt!KeWaitForMultipleObjects+0x271 fffff880`04462490 fffff800`01d88bf2 nt!ObpWaitForMultipleObjects+0x294 fffff880`04462960 fffff800`01a8b993 nt!NtWaitForMultipleObjects+0xe5 fffff880`04462bb0 00000000`7782046a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`04462c20) 00000000`0290fa08 000007fe`fda913a6 ntdll!NtWaitForMultipleObjects+0xa 00000000`0290fa10 00000000`776d3143 KERNELBASE!WaitForMultipleObjectsEx+0xe8 00000000`0290fb10 00000000`775cbc3d kernel32!WaitForMultipleObjectsExImplementation+0xb3 00000000`0290fba0 00000000`775c905a USER32!RealMsgWaitForMultipleObjectsEx+0x12a 00000000`0290fc40 000007fe`fba809a4 USER32!MsgWaitForMultipleObjectsEx+0x46 00000000`0290fc80 000007fe`fba716b2 DUser!CoreSC::Wait+0x6a 00000000`0290fcd0 000007fe`fba805dd DUser!CoreSC::xwProcessNL+0xed 00000000`0290fd40 000007fe`fba80500 DUser!GetMessageExA+0x7b 00000000`0290fd90 000007fe`fdd142bf DUser!ResourceManager::SharedThreadProc+0xe8 00000000`0290fe20 000007fe`fdd17459 msvcrt!endthreadex+0x47 00000000`0290fe50 00000000`776cf56d msvcrt!endthreadex+0xe0 00000000`0290fe80 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0290feb0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa800541a060 SessionId: 1 Cid: 0b94 Peb: 7fffffde000 ParentCid: 06ac DirBase: a6ba9000 ObjectTable: fffff8a0098efaf0 HandleCount: 20013. Image: ApplicationE.exe VadRoot fffffa800540a430 Vads 33 Clone 0 Private 187. Modified 0. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a009a00a50 ElapsedTime 00:00:36.848 UserTime 00:00:00.078 KernelTime 00:00:00.967 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (412, 50, 345) (1648KB, 200KB, 1380KB) PeakWorkingSetSize 7732 VirtualSize 13 Mb PeakVirtualSize 1976 Mb PageFaultCount 89605 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 211 Setting context for this process... .process /p /r fffffa800541a060 THREAD fffffa80053a1060 Cid 0b94.05ac Teb: 000007fffffdc000 Win32Thread: 0000000000000000 RUNNING on processor 0 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa800541a060 Image: ApplicationE.exe Attached Process N/A Image: N/A Wait Start TickCount 40290 Ticks: 0 Context Switch Count 27735 UserTime 00:00:35.459 KernelTime 00:00:00.015 *** ERROR: Module load completed but symbols could not be loaded for ApplicationE.exe Win32 Start Address ApplicationE (0x000000013f231578) Stack Init fffff88005315db0 Current fffff88005315a90 Base fffff88005316000 Limit fffff88005310000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site 00000000`001bf920 00000001`3f231185 ApplicationE+0x6ce1 00000000`001bf980 00000001`3f23153a ApplicationE+0x1185 00000000`001bf9c0 00000000`776cf56d ApplicationE+0x153a 00000000`001bfa00 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`001bfa30 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa80045076c0 Cid 0b94.0a2c Teb: 000007fffffda000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa8004507a80 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa800541a060 Image: ApplicationE.exe Attached Process N/A Image: N/A Wait Start TickCount 37931 Ticks: 2359 (0:00:00:36.800) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationE (0x000000013f231240) Stack Init fffff88005724db0 Current fffff88005724970 Base fffff88005725000 Limit fffff8800571f000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`057249b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05724af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`05724b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05724bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05724c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05724c20) 00000000`0076fd38 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`0076fd40 00000001`3f23101f KERNELBASE!SleepEx+0xab 00000000`0076fde0 00000001`3f23122b ApplicationE+0x101f 00000000`0076fe10 00000001`3f2312d5 ApplicationE+0x122b 00000000`0076fe40 00000000`776cf56d ApplicationE+0x12d5 00000000`0076fe70 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0076fea0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004f3c060 Cid 0b94.09a0 Teb: 000007fffffd8000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa8004f3c420 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa800541a060 Image: ApplicationE.exe Attached Process N/A Image: N/A Wait Start TickCount 37931 Ticks: 2359 (0:00:00:36.800) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationE (0x000000013f231240) Stack Init fffff88005bbfdb0 Current fffff88005bbf970 Base fffff88005bc0000 Limit fffff88005bba000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05bbf9b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05bbfaf0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`05bbfb80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05bbfbf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05bbfc20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05bbfc20) 00000000`0092f9c8 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`0092f9d0 00000001`3f23103f KERNELBASE!SleepEx+0xab 00000000`0092fa70 00000001`3f23122b ApplicationE+0x103f 00000000`0092faa0 00000001`3f2312d5 ApplicationE+0x122b 00000000`0092fad0 00000000`776cf56d ApplicationE+0x12d5 00000000`0092fb00 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0092fb30 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004f6c060 Cid 0b94.0b0c Teb: 000007fffffd6000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa8004f6c420 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa800541a060 Image: ApplicationE.exe Attached Process N/A Image: N/A Wait Start TickCount 37931 Ticks: 2359 (0:00:00:36.800) Context Switch Count 4 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationE (0x000000013f231240) Stack Init fffff88005ad7db0 Current fffff88005ad7970 Base fffff88005ad8000 Limit fffff88005ad2000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`05ad79b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05ad7af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`05ad7b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05ad7bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05ad7c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05ad7c20) 00000000`00b0f718 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`00b0f720 00000001`3f23105f KERNELBASE!SleepEx+0xab 00000000`00b0f7c0 00000001`3f23122b ApplicationE+0x105f 00000000`00b0f7f0 00000001`3f2312d5 ApplicationE+0x122b 00000000`00b0f820 00000000`776cf56d ApplicationE+0x12d5 00000000`00b0f850 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00b0f880 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800518ab60 Cid 0b94.08d0 Teb: 000007fffffd4000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa800518af20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa800541a060 Image: ApplicationE.exe Attached Process N/A Image: N/A Wait Start TickCount 38088 Ticks: 2202 (0:00:00:34.351) Context Switch Count 28620 UserTime 00:00:00.031 KernelTime 00:00:01.544 Win32 Start Address ApplicationE (0x000000013f231240) Stack Init fffff88005739db0 Current fffff88005739970 Base fffff8800573a000 Limit fffff88005734000 Call 0 Priority 9 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`057399b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05739af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`05739b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05739bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05739c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05739c20) 00000000`00d9fde8 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`00d9fdf0 00000001`3f2310af KERNELBASE!SleepEx+0xab 00000000`00d9fe90 00000001`3f23122b ApplicationE+0x10af 00000000`00d9fed0 00000001`3f2312d5 ApplicationE+0x122b 00000000`00d9ff00 00000000`776cf56d ApplicationE+0x12d5 00000000`00d9ff30 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00d9ff60 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa800541ab60 Cid 0b94.0460 Teb: 000007fffffae000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa800541af20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa800541a060 Image: ApplicationE.exe Attached Process N/A Image: N/A Wait Start TickCount 37931 Ticks: 2359 (0:00:00:36.800) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationE (0x000000013f231240) Stack Init fffff880053d6db0 Current fffff880053d6970 Base fffff880053d7000 Limit fffff880053d1000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`053d69b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`053d6af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`053d6b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`053d6bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`053d6c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`053d6c20) 00000000`00eafae8 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`00eafaf0 00000001`3f2310cf KERNELBASE!SleepEx+0xab 00000000`00eafb90 00000001`3f23122b ApplicationE+0x10cf 00000000`00eafbc0 00000001`3f2312d5 ApplicationE+0x122b 00000000`00eafbf0 00000000`776cf56d ApplicationE+0x12d5 00000000`00eafc20 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00eafc50 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005406b60 Cid 0b94.09f8 Teb: 000007fffffac000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa8005406f20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa800541a060 Image: ApplicationE.exe Attached Process N/A Image: N/A Wait Start TickCount 37940 Ticks: 2350 (0:00:00:36.660) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationE (0x000000013f231240) Stack Init fffff880054c4db0 Current fffff880054c4970 Base fffff880054c5000 Limit fffff880054bf000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`054c49b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`054c4af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`054c4b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`054c4bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`054c4c20 00000000`778201fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`054c4c20) 00000000`00fdfdc8 000007fe`fda91203 ntdll!NtDelayExecution+0xa 00000000`00fdfdd0 00000001`3f2310ef KERNELBASE!SleepEx+0xab 00000000`00fdfe70 00000001`3f23122b ApplicationE+0x10ef 00000000`00fdfea0 00000001`3f2312d5 ApplicationE+0x122b 00000000`00fdfed0 00000000`776cf56d ApplicationE+0x12d5 00000000`00fdff00 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`00fdff30 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa8004522060 SessionId: 1 Cid: 0be4 Peb: 7fffffdc000 ParentCid: 01a0 DirBase: 7a697000 ObjectTable: fffff8a0034938b0 HandleCount: 34. Image: conhost.exe VadRoot fffffa8004b45f70 Vads 44 Clone 0 Private 231. Modified 0. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a009a86060 ElapsedTime 00:00:36.833 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (880, 50, 345) (3520KB, 200KB, 1380KB) PeakWorkingSetSize 880 VirtualSize 49 Mb PeakVirtualSize 49 Mb PageFaultCount 911 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 286 Setting context for this process... .process /p /r fffffa8004522060 THREAD fffffa8005370290 Cid 0be4.05d4 Teb: 000007fffffda000 Win32Thread: fffff900c1abeb40 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8005370650 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004522060 Image: conhost.exe Attached Process N/A Image: N/A Wait Start TickCount 38092 Ticks: 2198 (0:00:00:34.289) Context Switch Count 20127 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.046 Win32 Start Address conhost!ConsoleLpcThread (0x00000000ffe1876c) Stack Init fffff88005262db0 Current fffff88005262790 Base fffff88005263000 Limit fffff8800525c000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`052627d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05262910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`052629a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`05262a40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`05262aa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`05262b40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`05262be0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`05262c20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05262c20) 00000000`01e5f3a8 00000000`ffe1113e ntdll!NtReplyWaitReceivePort+0xa 00000000`01e5f3b0 00000000`776cf56d conhost!ConsoleLpcThread+0x249 00000000`01e5f9b0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01e5f9e0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8004a4cb60 Cid 0be4.0204 Teb: 000007fffffde000 Win32Thread: fffff900c1f03c30 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004d0d210 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8004522060 Image: conhost.exe Attached Process N/A Image: N/A Wait Start TickCount 38091 Ticks: 2199 (0:00:00:34.304) Context Switch Count 185 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address conhost!ConsoleInputThread (0x00000000ffe19250) Stack Init fffff880053cfdb0 Current fffff880053cf6f0 Base fffff880053d0000 Limit fffff880053c7000 Call 0 Priority 13 BasePriority 8 UnusualBoost 3 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`053cf730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`053cf870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`053cf900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`053cf9a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`053cfa40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`053cfa70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`053cfb50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`053cfb90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`053cfc20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`053cfc20) 00000000`0233fd58 00000000`775cc95e USER32!NtUserGetMessage+0xa 00000000`0233fd60 00000000`ffe115f5 USER32!GetMessageW+0x34 00000000`0233fd90 00000000`776cf56d conhost!ConsoleInputThread+0x10a 00000000`0233fdf0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`0233fe20 00000000`00000000 ntdll!RtlUserThreadStart+0x1d PROCESS fffffa80056e2590 SessionId: 1 Cid: 1455c Peb: 7efdf000 ParentCid: 06ac DirBase: 7134d000 ObjectTable: fffff8a0035c94f0 HandleCount: 49. Image: ApplicationA.exe VadRoot fffffa800456af80 Vads 75 Clone 0 Private 241. Modified 0. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a003313a50 ElapsedTime 00:00:22.302 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (1128, 50, 345) (4512KB, 200KB, 1380KB) PeakWorkingSetSize 1128 VirtualSize 65 Mb PeakVirtualSize 65 Mb PageFaultCount 1169 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 327 Setting context for this process... .process /p /r fffffa80056e2590 THREAD fffffa8004525780 Cid 1455c.14560 Teb: 000000007efdb000 Win32Thread: fffff900c1a71c30 WAIT: (DelayExecution) UserMode Non-Alertable fffffa8004525b40 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80056e2590 Image: ApplicationA.exe Attached Process N/A Image: N/A Wait Start TickCount 38866 Ticks: 1424 (0:00:00:22.214) Context Switch Count 37 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 *** ERROR: Module load completed but symbols could not be loaded for ApplicationA.exe Win32 Start Address ApplicationA (0x0000000000de1429) Stack Init fffff88007bd2db0 Current fffff88007bd2970 Base fffff88007bd3000 Limit fffff88007bcc000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`07bd29b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`07bd2af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`07bd2b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`07bd2bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`07bd2c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`07bd2c20) 00000000`000eeaa8 00000000`75452c87 wow64cpu!CpupSyscallStub+0x9 00000000`000eeab0 00000000`754cd07e wow64cpu!Thunk2ArgNSpNSpReloadState+0x21 00000000`000eeb70 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`000eebc0 00000000`778184c8 wow64!Wow64LdrpInitialize+0x429 00000000`000ef110 00000000`77817623 ntdll!LdrpInitializeProcess+0x17e2 00000000`000ef610 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bea0 00000000`000ef680 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800541cb60 Cid 1455c.14578 Teb: 000000007efd8000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa800541cf20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80056e2590 Image: ApplicationA.exe Attached Process N/A Image: N/A Wait Start TickCount 38866 Ticks: 1424 (0:00:00:22.214) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationA (0x0000000000de117f) Stack Init fffff880049a9db0 Current fffff880049a9970 Base fffff880049aa000 Limit fffff880049a4000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`049a99b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`049a9af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`049a9b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`049a9bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`049a9c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`049a9c20) 00000000`009fec68 00000000`75452c87 wow64cpu!CpupSyscallStub+0x9 00000000`009fec70 00000000`754cd07e wow64cpu!Thunk2ArgNSpNSpReloadState+0x21 00000000`009fed30 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`009fed80 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`009ff2d0 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`009ff340 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800541c660 Cid 1455c.1457c Teb: 000000007efd5000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa800541ca20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80056e2590 Image: ApplicationA.exe Attached Process N/A Image: N/A Wait Start TickCount 38868 Ticks: 1422 (0:00:00:22.183) Context Switch Count 2 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationA (0x0000000000de117f) Stack Init fffff88007c0cdb0 Current fffff88007c0c970 Base fffff88007c0d000 Limit fffff88007c07000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`07c0c9b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`07c0caf0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`07c0cb80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`07c0cbf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`07c0cc20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`07c0cc20) 00000000`0024f038 00000000`75452c87 wow64cpu!CpupSyscallStub+0x9 00000000`0024f040 00000000`754cd07e wow64cpu!Thunk2ArgNSpNSpReloadState+0x21 00000000`0024f100 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0024f150 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0024f6a0 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0024f710 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa80053a7060 Cid 1455c.14580 Teb: 000000007efad000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa80053a7420 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80056e2590 Image: ApplicationA.exe Attached Process N/A Image: N/A Wait Start TickCount 38866 Ticks: 1424 (0:00:00:22.214) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationA (0x0000000000de117f) Stack Init fffff88005359db0 Current fffff88005359970 Base fffff8800535a000 Limit fffff88005354000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`053599b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`05359af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`05359b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`05359bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`05359c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`05359c20) 00000000`00b1f058 00000000`75452c87 wow64cpu!CpupSyscallStub+0x9 00000000`00b1f060 00000000`754cd07e wow64cpu!Thunk2ArgNSpNSpReloadState+0x21 00000000`00b1f120 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`00b1f170 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`00b1f6c0 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`00b1f730 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa80053a7b60 Cid 1455c.14584 Teb: 000000007efaa000 Win32Thread: fffff900c01d4c30 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8005068790 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80056e2590 Image: ApplicationA.exe Attached Process N/A Image: N/A Wait Start TickCount 39086 Ticks: 1204 (0:00:00:18.782) Context Switch Count 79 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationA (0x0000000000de117f) Stack Init fffff88007bf3db0 Current fffff88007bf3870 Base fffff88007bf4000 Limit fffff88007beb000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`07bf38b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`07bf39f0 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`07bf3a80 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`07bf3b20 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`07bf3bc0 fffff960`0012e22e win32k!xxxSleepThread+0x59 fffff880`07bf3bf0 fffff800`01a8b993 win32k!NtUserWaitMessage+0x46 fffff880`07bf3c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`07bf3c20) 00000000`00a7ea08 00000000`75452d92 wow64cpu!CpupSyscallStub+0x9 00000000`00a7ea10 00000000`754cd07e wow64cpu!Thunk0Arg+0x5 00000000`00a7ead0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`00a7eb20 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`00a7f070 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`00a7f0e0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa80053a7660 Cid 1455c.14588 Teb: 000000007efa7000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa80053a7a20 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80056e2590 Image: ApplicationA.exe Attached Process N/A Image: N/A Wait Start TickCount 38866 Ticks: 1424 (0:00:00:22.214) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationA (0x0000000000de117f) Stack Init fffff88007bd9db0 Current fffff88007bd9970 Base fffff88007bda000 Limit fffff88007bd4000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`07bd99b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`07bd9af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`07bd9b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`07bd9bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`07bd9c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`07bd9c20) 00000000`0099edf8 00000000`75452c87 wow64cpu!CpupSyscallStub+0x9 00000000`0099ee00 00000000`754cd07e wow64cpu!Thunk2ArgNSpNSpReloadState+0x21 00000000`0099eec0 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`0099ef10 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`0099f460 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`0099f4d0 00000000`00000000 ntdll!LdrInitializeThunk+0xe THREAD fffffa800535d060 Cid 1455c.1458c Teb: 000000007efa4000 Win32Thread: 0000000000000000 WAIT: (DelayExecution) UserMode Non-Alertable fffffa800535d420 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa80056e2590 Image: ApplicationA.exe Attached Process N/A Image: N/A Wait Start TickCount 38868 Ticks: 1422 (0:00:00:22.183) Context Switch Count 3 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address ApplicationA (0x0000000000de117f) Stack Init fffff88007be0db0 Current fffff88007be0970 Base fffff88007be1000 Limit fffff88007bdb000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`07be09b0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`07be0af0 fffff800`01a9597a nt!KiCommitThreadWait+0x1d2 fffff880`07be0b80 fffff800`01d8710e nt!KeDelayExecutionThread+0x186 fffff880`07be0bf0 fffff800`01a8b993 nt!NtDelayExecution+0x59 fffff880`07be0c20 00000000`75452dd9 nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`07be0c20) 00000000`00ace9c8 00000000`75452c87 wow64cpu!CpupSyscallStub+0x9 00000000`00ace9d0 00000000`754cd07e wow64cpu!Thunk2ArgNSpNSpReloadState+0x21 00000000`00acea90 00000000`754cc549 wow64!RunCpuSimulation+0xa 00000000`00aceae0 00000000`7784d177 wow64!Wow64LdrpInitialize+0x429 00000000`00acf030 00000000`7780308e ntdll! ?? ::FNODOBFM::`string'+0x2bfe4 00000000`00acf0a0 00000000`00000000 ntdll!LdrInitializeThunk+0xe PROCESS fffffa8005416630 SessionId: 1 Cid: 14564 Peb: 7fffffd5000 ParentCid: 01a0 DirBase: 646aa000 ObjectTable: fffff8a00322bdf0 HandleCount: 33. Image: conhost.exe VadRoot fffffa8005985570 Vads 44 Clone 0 Private 231. Modified 0. Locked 0. DeviceMap fffff8a001e84c00 Token fffff8a0099cd060 ElapsedTime 00:00:22.271 UserTime 00:00:00.000 KernelTime 00:00:00.000 QuotaPoolUsage[PagedPool] 0 QuotaPoolUsage[NonPagedPool] 0 Working Set Sizes (now,min,max) (835, 50, 345) (3340KB, 200KB, 1380KB) PeakWorkingSetSize 835 VirtualSize 49 Mb PeakVirtualSize 49 Mb PageFaultCount 860 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 285 Setting context for this process... .process /p /r fffffa8005416630 THREAD fffffa8004530060 Cid 14564.14570 Teb: 000007fffffdc000 Win32Thread: fffff900c1bf06b0 WAIT: (WrLpcReceive) UserMode Non-Alertable fffffa8004530420 Semaphore Limit 0x1 Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8005416630 Image: conhost.exe Attached Process N/A Image: N/A Wait Start TickCount 38868 Ticks: 1422 (0:00:00:22.183) Context Switch Count 31 LargeStack UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address conhost!ConsoleLpcThread (0x00000000ffe1876c) Stack Init fffff88007b93db0 Current fffff88007b93790 Base fffff88007b94000 Limit fffff88007b8d000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`07b937d0 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`07b93910 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`07b939a0 fffff800`01d8b3b9 nt!KeWaitForSingleObject+0x19f fffff880`07b93a40 fffff800`01d9dcf8 nt!AlpcpReceiveMessagePort+0x189 fffff880`07b93aa0 fffff800`01d9e0b7 nt!AlpcpReceiveLegacyMessage+0x127 fffff880`07b93b40 fffff800`01d9e12f nt!NtReplyWaitReceivePortEx+0x106 fffff880`07b93be0 fffff800`01a8b993 nt!NtReplyWaitReceivePort+0xf fffff880`07b93c20 00000000`7781ff6a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`07b93c20) 00000000`01fcf868 00000000`ffe1113e ntdll!NtReplyWaitReceivePort+0xa 00000000`01fcf870 00000000`776cf56d conhost!ConsoleLpcThread+0x249 00000000`01fcfe70 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01fcfea0 00000000`00000000 ntdll!RtlUserThreadStart+0x1d THREAD fffffa8005186b60 Cid 14564.14574 Teb: 000007fffffde000 Win32Thread: fffff900c1e105f0 WAIT: (WrUserRequest) UserMode Non-Alertable fffffa8004f0b1f0 SynchronizationEvent Not impersonating DeviceMap fffff8a001e84c00 Owning Process fffffa8005416630 Image: conhost.exe Attached Process N/A Image: N/A Wait Start TickCount 38936 Ticks: 1354 (0:00:00:21.122) Context Switch Count 106 LargeStack UserTime 00:00:00.015 KernelTime 00:00:00.015 Win32 Start Address conhost!ConsoleInputThread (0x00000000ffe19250) Stack Init fffff88007bafdb0 Current fffff88007baf6f0 Base fffff88007bb0000 Limit fffff88007ba7000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site fffff880`07baf730 fffff800`01a93992 nt!KiSwapContext+0x7a fffff880`07baf870 fffff800`01a95cff nt!KiCommitThreadWait+0x1d2 fffff880`07baf900 fffff960`0011b557 nt!KeWaitForSingleObject+0x19f fffff880`07baf9a0 fffff960`0011b5f1 win32k!xxxRealSleepThread+0x257 fffff880`07bafa40 fffff960`00119c1c win32k!xxxSleepThread+0x59 fffff880`07bafa70 fffff960`00119d21 win32k!xxxRealInternalGetMessage+0x7dc fffff880`07bafb50 fffff960`0011b725 win32k!xxxInternalGetMessage+0x35 fffff880`07bafb90 fffff800`01a8b993 win32k!NtUserGetMessage+0x75 fffff880`07bafc20 00000000`775cc92a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ fffff880`07bafc20) 00000000`01edf958 00000000`775cc95e USER32!NtUserGetMessage+0xa 00000000`01edf960 00000000`ffe115f5 USER32!GetMessageW+0x34 00000000`01edf990 00000000`776cf56d conhost!ConsoleInputThread+0x10a 00000000`01edf9f0 00000000`77803281 kernel32!BaseThreadInitThunk+0xd 00000000`01edfa20 00000000`00000000 ntdll!RtlUserThreadStart+0x1d .process /p /r 0 1: kd> !process 0 0 **** NT ACTIVE PROCESS DUMP **** PROCESS fffffa8003baa890 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000 DirBase: 00187000 ObjectTable: fffff8a000001a80 HandleCount: 558. Image: System PROCESS fffffa8004277870 SessionId: none Cid: 011c Peb: 7fffffdf000 ParentCid: 0004 DirBase: 133579000 ObjectTable: fffff8a00000f3d0 HandleCount: 35. Image: smss.exe PROCESS fffffa80048f3950 SessionId: 0 Cid: 016c Peb: 7fffffdf000 ParentCid: 0154 DirBase: 128628000 ObjectTable: fffff8a001d62f90 HandleCount: 387. Image: csrss.exe PROCESS fffffa8003cf60f0 SessionId: 1 Cid: 01a0 Peb: 7fffffd6000 ParentCid: 0198 DirBase: 127790000 ObjectTable: fffff8a001d7d100 HandleCount: 419. Image: csrss.exe PROCESS fffffa80048ec6c0 SessionId: 0 Cid: 01a8 Peb: 7fffffd6000 ParentCid: 011c DirBase: 127995000 ObjectTable: fffff8a001d80640 HandleCount: 792. Image: psxss.exe PROCESS fffffa800491d910 SessionId: 1 Cid: 01cc Peb: 7fffffdf000 ParentCid: 0198 DirBase: 126d56000 ObjectTable: fffff8a001d8a0c0 HandleCount: 95. Image: winlogon.exe PROCESS fffffa800491f630 SessionId: 0 Cid: 01d8 Peb: 7fffffd5000 ParentCid: 0154 DirBase: 1270ae000 ObjectTable: fffff8a001d8c830 HandleCount: 77. Image: wininit.exe PROCESS fffffa80049655f0 SessionId: 0 Cid: 0210 Peb: 7fffffdb000 ParentCid: 01d8 DirBase: 125d4e000 ObjectTable: fffff8a001ea5580 HandleCount: 215. Image: services.exe PROCESS fffffa8004970b30 SessionId: 0 Cid: 0218 Peb: 7fffffda000 ParentCid: 01d8 DirBase: 125daf000 ObjectTable: fffff8a001e805b0 HandleCount: 670. Image: lsass.exe PROCESS fffffa8004972b30 SessionId: 0 Cid: 0220 Peb: 7fffffd5000 ParentCid: 01d8 DirBase: 126175000 ObjectTable: fffff8a001629530 HandleCount: 146. Image: lsm.exe PROCESS fffffa80049c6b30 SessionId: 0 Cid: 0288 Peb: 7fffffd8000 ParentCid: 0210 DirBase: 1253c5000 ObjectTable: fffff8a001f12220 HandleCount: 351. Image: svchost.exe PROCESS fffffa80049dc060 SessionId: 0 Cid: 02d8 Peb: 7fffffdc000 ParentCid: 0210 DirBase: 124ec6000 ObjectTable: fffff8a001fc2ed0 HandleCount: 271. Image: svchost.exe PROCESS fffffa8004a1b740 SessionId: 0 Cid: 0334 Peb: 7fffffd6000 ParentCid: 0210 DirBase: 123faf000 ObjectTable: fffff8a00201d550 HandleCount: 410. Image: svchost.exe PROCESS fffffa8004a282f0 SessionId: 0 Cid: 0354 Peb: 7fffffdf000 ParentCid: 0210 DirBase: 123d77000 ObjectTable: fffff8a00205f710 HandleCount: 1109. Image: svchost.exe PROCESS fffffa8004a444f0 SessionId: 0 Cid: 0384 Peb: 7fffffd6000 ParentCid: 0210 DirBase: 100e40000 ObjectTable: fffff8a002090bd0 HandleCount: 480. Image: svchost.exe PROCESS fffffa8004a57b30 SessionId: 0 Cid: 03d4 Peb: 7fffffd4000 ParentCid: 0210 DirBase: 12360d000 ObjectTable: fffff8a0020c89b0 HandleCount: 294. Image: svchost.exe PROCESS fffffa8004a7c590 SessionId: 0 Cid: 012c Peb: 7fffffdf000 ParentCid: 0210 DirBase: 122fd3000 ObjectTable: fffff8a0020ecf90 HandleCount: 457. Image: svchost.exe PROCESS fffffa8004aca060 SessionId: 0 Cid: 040c Peb: 7fffffd3000 ParentCid: 0334 DirBase: 1212b3000 ObjectTable: fffff8a002143510 HandleCount: 141. Image: audiodg.exe PROCESS fffffa800495db30 SessionId: 0 Cid: 042c Peb: 7fffffdf000 ParentCid: 0210 DirBase: 1208ac000 ObjectTable: fffff8a002157140 HandleCount: 307. Image: svchost.exe PROCESS fffffa8004b9eb30 SessionId: 0 Cid: 04e4 Peb: 7fffffdf000 ParentCid: 0210 DirBase: 11ed44000 ObjectTable: fffff8a00220c9d0 HandleCount: 454. Image: spoolsv.exe PROCESS fffffa8004bdeb30 SessionId: 0 Cid: 0538 Peb: 7efdf000 ParentCid: 0210 DirBase: 11e2a2000 ObjectTable: fffff8a0022865e0 HandleCount: 80. Image: mdm.exe PROCESS fffffa8004c05790 SessionId: 0 Cid: 0584 Peb: 7fffffd9000 ParentCid: 0210 DirBase: 11dd8f000 ObjectTable: fffff8a0022ac5d0 HandleCount: 46. Image: svchost.exe PROCESS fffffa8004d16060 SessionId: 0 Cid: 0730 Peb: 7fffffd6000 ParentCid: 0210 DirBase: 11b29e000 ObjectTable: fffff8a0023cc800 HandleCount: 102. Image: svchost.exe PROCESS fffffa8004ce66a0 SessionId: 0 Cid: 0744 Peb: 7fffffdf000 ParentCid: 0210 DirBase: 11b424000 ObjectTable: fffff8a00234cf50 HandleCount: 294. Image: svchost.exe PROCESS fffffa8004d23b30 SessionId: 1 Cid: 0378 Peb: 7fffffd9000 ParentCid: 0210 DirBase: 1122b3000 ObjectTable: fffff8a0031c1690 HandleCount: 183. Image: taskhost.exe PROCESS fffffa8004d3ab30 SessionId: 1 Cid: 067c Peb: 7fffffdf000 ParentCid: 03d4 DirBase: 111dbc000 ObjectTable: fffff8a0031d6bc0 HandleCount: 75. Image: dwm.exe PROCESS fffffa8004d4bb30 SessionId: 1 Cid: 06ac Peb: 7fffffd6000 ParentCid: 0648 DirBase: 111e49000 ObjectTable: fffff8a0031e0a50 HandleCount: 1177. Image: explorer.exe PROCESS fffffa8004e7db30 SessionId: 1 Cid: 0890 Peb: 7efdf000 ParentCid: 079c DirBase: 10935c000 ObjectTable: fffff8a002947420 HandleCount: 119. Image: concentr.exe PROCESS fffffa8004e97060 SessionId: 1 Cid: 08a0 Peb: 7efdf000 ParentCid: 079c DirBase: 108c3e000 ObjectTable: fffff8a002059010 HandleCount: 213. Image: jusched.exe PROCESS fffffa8004ed62f0 SessionId: 1 Cid: 08ec Peb: 7fffffdb000 ParentCid: 01cc DirBase: 107cf8000 ObjectTable: 00000000 HandleCount: 0. Image: wlrmdr.exe PROCESS fffffa8005094060 SessionId: 0 Cid: 0828 Peb: 7efdf000 ParentCid: 0210 DirBase: b2091000 ObjectTable: fffff8a00338b8a0 HandleCount: 102. Image: mscorsvw.exe PROCESS fffffa80050a2060 SessionId: 0 Cid: 071c Peb: 7fffffdb000 ParentCid: 0210 DirBase: b0fa4000 ObjectTable: fffff8a003687d70 HandleCount: 98. Image: mscorsvw.exe PROCESS fffffa8005101060 SessionId: 0 Cid: 081c Peb: 7fffffdf000 ParentCid: 0210 DirBase: b5fec000 ObjectTable: fffff8a00350e3f0 HandleCount: 129. Image: TrustedInstaller.exe PROCESS fffffa8005175a60 SessionId: 0 Cid: 0438 Peb: 7fffffda000 ParentCid: 0210 DirBase: aacb6000 ObjectTable: fffff8a0037d76a0 HandleCount: 148. Image: msdtc.exe PROCESS fffffa80044fab30 SessionId: 1 Cid: 05f8 Peb: 7fffffdc000 ParentCid: 0354 DirBase: 8153b000 ObjectTable: fffff8a003637d30 HandleCount: 95. Image: wuauclt.exe PROCESS fffffa8004eceb30 SessionId: 1 Cid: 0bbc Peb: 7efdf000 ParentCid: 0288 DirBase: 5ce43000 ObjectTable: fffff8a0036530a0 HandleCount: 178. Image: wfcrun32.exe PROCESS fffffa80050fcb30 SessionId: 1 Cid: 09e0 Peb: 7efdf000 ParentCid: 08a0 DirBase: 32114000 ObjectTable: fffff8a0032faa20 HandleCount: 198. Image: jucheck.exe PROCESS fffffa8004f68370 SessionId: 1 Cid: 0a6c Peb: 7fffffd9000 ParentCid: 06ac DirBase: 296ed000 ObjectTable: fffff8a00aeeb980 HandleCount: 58. Image: NotMyfault.exe PROCESS fffffa8004f58b30 SessionId: 1 Cid: 0168 Peb: 7efdf000 ParentCid: 06ac DirBase: 1bdd1000 ObjectTable: fffff8a0095ec5a0 HandleCount: 340. Image: iexplore.exe PROCESS fffffa8004585b30 SessionId: 1 Cid: 0920 Peb: 7efdf000 ParentCid: 0168 DirBase: 1d41d000 ObjectTable: fffff8a00aeaada0 HandleCount: 443. Image: iexplore.exe PROCESS fffffa80053a8b30 SessionId: 1 Cid: 0868 Peb: 7fffffd3000 ParentCid: 06ac DirBase: 0ce59000 ObjectTable: fffff8a00af58db0 HandleCount: 52. Image: notepad.exe PROCESS fffffa8004514630 SessionId: 1 Cid: 07f4 Peb: 7fffffd5000 ParentCid: 06ac DirBase: 09ce9000 ObjectTable: fffff8a00908ebd0 HandleCount: 40. Image: ApplicationA.exe PROCESS fffffa8004f85630 SessionId: 1 Cid: 021c Peb: 7fffffd5000 ParentCid: 01a0 DirBase: 09b69000 ObjectTable: fffff8a009773750 HandleCount: 35. Image: conhost.exe PROCESS fffffa80053ce630 SessionId: 1 Cid: 0798 Peb: 7fffffdf000 ParentCid: 06ac DirBase: 104d60000 ObjectTable: fffff8a0031e7760 HandleCount: 14. Image: ApplicationB.exe PROCESS fffffa80053d0060 SessionId: 1 Cid: 0248 Peb: 7fffffdc000 ParentCid: 01a0 DirBase: 102c33000 ObjectTable: fffff8a0098fb700 HandleCount: 34. Image: conhost.exe PROCESS fffffa8005400b30 SessionId: 1 Cid: 0b34 Peb: 7fffffd5000 ParentCid: 06ac DirBase: b290f000 ObjectTable: fffff8a0098ebe90 HandleCount: 17. Image: ApplicationC.exe PROCESS fffffa800451f060 SessionId: 1 Cid: 0bb4 Peb: 7fffffda000 ParentCid: 01a0 DirBase: b0e39000 ObjectTable: fffff8a0098ca220 HandleCount: 35. Image: conhost.exe PROCESS fffffa8005369060 SessionId: 1 Cid: 0abc Peb: 7fffffd8000 ParentCid: 06ac DirBase: a3994000 ObjectTable: fffff8a0032c03a0 HandleCount: 15. Image: ApplicationD.exe PROCESS fffffa80053ce060 SessionId: 1 Cid: 0a14 Peb: 7fffffdb000 ParentCid: 01a0 DirBase: a593f000 ObjectTable: fffff8a00aef8820 HandleCount: 34. Image: conhost.exe PROCESS fffffa800540e060 SessionId: 0 Cid: 0a1c Peb: 7fffffd9000 ParentCid: 0210 DirBase: 7f4f9000 ObjectTable: fffff8a0099295c0 HandleCount: 75. Image: svchost.exe PROCESS fffffa800518fb30 SessionId: 1 Cid: 0a78 Peb: 7fffffde000 ParentCid: 0a1c DirBase: 83484000 ObjectTable: fffff8a00331a4e0 HandleCount: 115. Image: WerFault.exe PROCESS fffffa800541a060 SessionId: 1 Cid: 0b94 Peb: 7fffffde000 ParentCid: 06ac DirBase: a6ba9000 ObjectTable: fffff8a0098efaf0 HandleCount: 20013. Image: ApplicationE.exe PROCESS fffffa8004522060 SessionId: 1 Cid: 0be4 Peb: 7fffffdc000 ParentCid: 01a0 DirBase: 7a697000 ObjectTable: fffff8a0034938b0 HandleCount: 34. Image: conhost.exe PROCESS fffffa80056e2590 SessionId: 1 Cid: 1455c Peb: 7efdf000 ParentCid: 06ac DirBase: 7134d000 ObjectTable: fffff8a0035c94f0 HandleCount: 49. Image: ApplicationA.exe PROCESS fffffa8005416630 SessionId: 1 Cid: 14564 Peb: 7fffffd5000 ParentCid: 01a0 DirBase: 646aa000 ObjectTable: fffff8a00322bdf0 HandleCount: 33. Image: conhost.exe 1: kd> q quit: