Opened log file 'c:\DebuggingTV\1C-3.log' 0: kd> .symfix c:\mss 0: kd> .reload Loading Kernel Symbols ............................................................... ................................................................ ...................... Loading User Symbols PEB is paged out (Peb.Ldr = 00007ff6`d42a6018). Type ".hh dbgerr001" for details Loading unloaded module list ............ 0: kd> !process 0 0 **** NT ACTIVE PROCESS DUMP **** PROCESS ffffe000001ff900 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000 DirBase: 001a7000 ObjectTable: ffffc00000003000 HandleCount: Image: System PROCESS ffffe0000178b900 SessionId: none Cid: 011c Peb: 7ff63e5cf000 ParentCid: 0004 DirBase: 05af6000 ObjectTable: ffffc00000302a40 HandleCount: Image: smss.exe PROCESS ffffe000011ed900 SessionId: 0 Cid: 0188 Peb: 7ff76217f000 ParentCid: 0178 DirBase: 05653000 ObjectTable: ffffc000019c70c0 HandleCount: Image: csrss.exe PROCESS ffffe00001d77900 SessionId: 0 Cid: 01c8 Peb: 7ff6de383000 ParentCid: 0178 DirBase: 155d9000 ObjectTable: ffffc00001bd1980 HandleCount: Image: wininit.exe PROCESS ffffe00001bc4080 SessionId: 0 Cid: 01f8 Peb: 7ff600279000 ParentCid: 01c8 DirBase: 0f435000 ObjectTable: ffffc00001d3d7c0 HandleCount: Image: services.exe PROCESS ffffe00001dcc500 SessionId: 0 Cid: 0240 Peb: 7ff683d78000 ParentCid: 01c8 DirBase: 10d81000 ObjectTable: ffffc00001c45040 HandleCount: Image: lsass.exe PROCESS ffffe00002087900 SessionId: 0 Cid: 027c Peb: 7ff715b5d000 ParentCid: 01f8 DirBase: 116a9000 ObjectTable: ffffc00001dce8c0 HandleCount: Image: svchost.exe PROCESS ffffe0000024e900 SessionId: 0 Cid: 02ac Peb: 7ff71649c000 ParentCid: 01f8 DirBase: 11900000 ObjectTable: ffffc00001de1cc0 HandleCount: Image: svchost.exe PROCESS ffffe000018b23c0 SessionId: 0 Cid: 0330 Peb: 7ff7158cb000 ParentCid: 01f8 DirBase: 12c88000 ObjectTable: ffffc00001f70280 HandleCount: Image: svchost.exe PROCESS ffffe00002105500 SessionId: 0 Cid: 0358 Peb: 7ff71601d000 ParentCid: 01f8 DirBase: 1325f000 ObjectTable: ffffc00001fc0f00 HandleCount: Image: svchost.exe PROCESS ffffe0000212a080 SessionId: 0 Cid: 0368 Peb: 7ff716297000 ParentCid: 01f8 DirBase: 134e5000 ObjectTable: ffffc00001fc7f00 HandleCount: Image: svchost.exe PROCESS ffffe00002120900 SessionId: 0 Cid: 03a4 Peb: 7ff716334000 ParentCid: 01f8 DirBase: 1442a000 ObjectTable: ffffc00001ffe3c0 HandleCount: Image: svchost.exe PROCESS ffffe000021c2900 SessionId: 0 Cid: 017c Peb: 7ff7159e8000 ParentCid: 01f8 DirBase: 16e20000 ObjectTable: ffffc0000218dc00 HandleCount: Image: svchost.exe PROCESS ffffe00002304080 SessionId: 0 Cid: 0440 Peb: 7ff7c0527000 ParentCid: 01f8 DirBase: 1a828000 ObjectTable: ffffc0000230a040 HandleCount: Image: spoolsv.exe PROCESS ffffe00002323500 SessionId: 0 Cid: 045c Peb: 7ff715e0f000 ParentCid: 01f8 DirBase: 1acad000 ObjectTable: ffffc0000231f4c0 HandleCount: Image: svchost.exe PROCESS ffffe000023f7900 SessionId: 0 Cid: 051c Peb: 7ff7f6478000 ParentCid: 01f8 DirBase: 007ff000 ObjectTable: ffffc000024ec5c0 HandleCount: Image: MsMpEng.exe PROCESS ffffe00002451900 SessionId: 0 Cid: 0584 Peb: 7ff71683f000 ParentCid: 0358 DirBase: 1d18c000 ObjectTable: ffffc00002533c00 HandleCount: Image: dasHost.exe PROCESS ffffe0000256c500 SessionId: 0 Cid: 06d8 Peb: 7ff715cf5000 ParentCid: 01f8 DirBase: 21065000 ObjectTable: ffffc000026ecc00 HandleCount: Image: svchost.exe PROCESS ffffe00002510300 SessionId: 0 Cid: 07a0 Peb: 7ff69091f000 ParentCid: 0358 DirBase: 2223d000 ObjectTable: ffffc00002566a80 HandleCount: Image: WUDFHost.exe PROCESS ffffe0000271b500 SessionId: 0 Cid: 0808 Peb: 7ff794bcf000 ParentCid: 01f8 DirBase: 2838e000 ObjectTable: ffffc000029fd500 HandleCount: Image: NisSrv.exe PROCESS ffffe0000116d080 SessionId: 0 Cid: 098c Peb: 7ff61f003000 ParentCid: 01f8 DirBase: 2c769000 ObjectTable: ffffc000029c5300 HandleCount: Image: SearchIndexer.exe PROCESS ffffe0000287b100 SessionId: 2 Cid: 09a0 Peb: 7ff761acc000 ParentCid: 05cc DirBase: 7aa76000 ObjectTable: ffffc000020713c0 HandleCount: Image: csrss.exe PROCESS ffffe000006a3900 SessionId: 2 Cid: 0b88 Peb: 7ff7438ce000 ParentCid: 05cc DirBase: 64642000 ObjectTable: ffffc00002e08740 HandleCount: Image: winlogon.exe PROCESS ffffe00002684900 SessionId: 2 Cid: 0a1c Peb: 7ff6113ca000 ParentCid: 0b88 DirBase: 3a62c000 ObjectTable: ffffc000020222c0 HandleCount: Image: dwm.exe PROCESS ffffe00002076900 SessionId: 2 Cid: 07d8 Peb: 7ff7e607a000 ParentCid: 0368 DirBase: 01d95000 ObjectTable: ffffc00003b4b340 HandleCount: Image: taskhostex.exe PROCESS ffffe000021fd900 SessionId: 2 Cid: 0214 Peb: 7ff70c36a000 ParentCid: 0230 DirBase: 48626000 ObjectTable: ffffc00002853940 HandleCount: Image: explorer.exe PROCESS ffffe00001797900 SessionId: 2 Cid: 0fac Peb: 7ff6d42a6000 ParentCid: 0214 DirBase: 0025d000 ObjectTable: ffffc00002e5c3c0 HandleCount: Image: NotMyfault.exe PROCESS ffffe00002785900 SessionId: 2 Cid: 081c Peb: 7ff7e57f5000 ParentCid: 0214 DirBase: 3523a000 ObjectTable: ffffc00002d92040 HandleCount: Image: Taskmgr.exe PROCESS ffffe00002018500 SessionId: 2 Cid: 0d2c Peb: 7ff6f6c1c000 ParentCid: 027c DirBase: 1e64e000 ObjectTable: ffffc00002cb3780 HandleCount: Image: dllhost.exe PROCESS ffffe0000206b900 SessionId: 0 Cid: 0e10 Peb: 7ff7e01e9000 ParentCid: 01f8 DirBase: 6a298000 ObjectTable: ffffc00002055340 HandleCount: Image: VSSVC.exe PROCESS ffffe000027648c0 SessionId: 0 Cid: 096c Peb: 7ff7157f5000 ParentCid: 01f8 DirBase: 7041f000 ObjectTable: ffffc00002ac5880 HandleCount: Image: svchost.exe 0: kd> !process ffffe000021fd900 3f PROCESS ffffe000021fd900 SessionId: 2 Cid: 0214 Peb: 7ff70c36a000 ParentCid: 0230 DirBase: 48626000 ObjectTable: ffffc00002853940 HandleCount: Image: explorer.exe VadRoot ffffe0000283b900 Vads 844 Clone 0 Private 16533. Modified 382265. Locked 210. DeviceMap ffffc00001c145c0 Token ffffc00001f548e0 ElapsedTime 00:19:42.192 UserTime 00:00:02.015 KernelTime 00:00:06.718 QuotaPoolUsage[PagedPool] 1493200 QuotaPoolUsage[NonPagedPool] 111584 Working Set Sizes (now,min,max) (148751, 50, 345) (595004KB, 200KB, 1380KB) PeakWorkingSetSize 154879 VirtualSize 681 Mb PeakVirtualSize 847 Mb PageFaultCount 1316897 MemoryPriority BACKGROUND BasePriority 8 CommitCharge 19101 Setting context for this process... .process /p /r ffffe000021fd900 !peb PEB at 00007ff6d42a6000 error 1 InitTypeRead( nt!_PEB at 00007ff6d42a6000)... THREAD ffffe00002903880 Cid 0214.031c Teb: 00007ff70c36e000 Win32Thread: fffff9014064c3e0 WAIT: (WrUserRequest) UserMode Non-Alertable ffffe0000204d750 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 288417 Ticks: 35 (0:00:00:00.546) Context Switch Count 9463 IdealProcessor: 1 UserTime 00:00:00.281 KernelTime 00:00:00.359 Win32 Start Address 0x00007ff70d17f4f4 Stack Init ffffd0002134fdd0 Current ffffd0002134f7c0 Base ffffd00021350000 Limit ffffd0002134a000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Page 1cef7 not present in the dump file. Type ".hh dbgerr004" for details *** ERROR: Module load completed but symbols could not be loaded for myfault.sys Child-SP RetAddr Call Site ffffd000`2134f800 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`2134f940 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`2134f9e0 fffff802`c572a20a nt!KiCommitThreadWait+0x127 ffffd000`2134fa40 fffff960`001343b8 nt!KeWaitForMultipleObjects+0x40a ffffd000`2134fb00 fffff960`0012f971 win32k!xxxRealSleepThread+0x278 ffffd000`2134fbc0 fffff960`001fda1f win32k!xxxSleepThread+0xc1 ffffd000`2134fc10 fffff802`c57e14b3 win32k!NtUserWaitMessage+0x20 ffffd000`2134fc40 00007ffe`1de7102a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`2134fc40) 00000000`00fcf4f8 00000000`00000000 0x00007ffe`1de7102a THREAD ffffe0000200d880 Cid 0214.0bbc Teb: 00007ff70c364000 Win32Thread: fffff90140621010 WAIT: (WrUserRequest) UserMode Non-Alertable ffffe000017afdd0 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 288442 Ticks: 10 (0:00:00:00.156) Context Switch Count 51133 IdealProcessor: 1 UserTime 00:00:00.156 KernelTime 00:00:00.359 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd00021b24dd0 Current ffffd00021b247c0 Base ffffd00021b25000 Limit ffffd00021b1f000 Call 0 Priority 13 BasePriority 9 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`21b24800 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`21b24940 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21b249e0 fffff802`c572a20a nt!KiCommitThreadWait+0x127 ffffd000`21b24a40 fffff960`001343b8 nt!KeWaitForMultipleObjects+0x40a ffffd000`21b24b00 fffff960`0012f971 win32k!xxxRealSleepThread+0x278 ffffd000`21b24bc0 fffff960`001fda93 win32k!xxxSleepThread+0xc1 ffffd000`21b24c10 fffff802`c57e14b3 win32k!NtUserWaitAvailableMessageEx+0x33 ffffd000`21b24c40 00007ffe`1de71fba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`21b24c40) 00000000`0332f828 00000000`00000000 0x00007ffe`1de71fba THREAD ffffe00002950880 Cid 0214.013c Teb: 00007ff70c23e000 Win32Thread: fffff90140777790 WAIT: (UserRequest) UserMode Non-Alertable ffffe000021ae9d0 SynchronizationEvent ffffe00001df3bf0 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 261329 Ticks: 27123 (0:00:07:03.796) Context Switch Count 12 IdealProcessor: 0 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe1d6899b0 Stack Init ffffd00021bfcdd0 Current ffffd00021bfc120 Base ffffd00021bfd000 Limit ffffd00021bf7000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`21bfc160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`21bfc2a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21bfc340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`21bfc3a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`21bfc460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`21bfc970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`21bfcbd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`21bfcc40) 00000000`033af9d8 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe0000201b680 Cid 0214.0860 Teb: 00007ff70c23a000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable ffffe000010bf2c0 SynchronizationTimer Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 285661 Ticks: 2791 (0:00:00:43.609) Context Switch Count 55 IdealProcessor: 0 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe1dd08530 Stack Init ffffd00021833dd0 Current ffffd00021833120 Base ffffd00021834000 Limit ffffd0002182e000 Call 0 Priority 10 BasePriority 8 UnusualBoost 2 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`21833160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`218332a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21833340 fffff802`c572a20a nt!KiCommitThreadWait+0x127 ffffd000`218333a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x40a ffffd000`21833460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`21833970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`21833bd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`21833c40) 00000000`035ff3d8 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe0000295b880 Cid 0214.0594 Teb: 00007ff70c238000 Win32Thread: fffff90143c82450 WAIT: (UserRequest) UserMode Alertable ffffe000022d0fe0 NotificationEvent ffffe000010c03e0 NotificationEvent ffffe00002228410 NotificationEvent ffffe000025267f0 NotificationEvent ffffe000025c27d0 NotificationEvent ffffe00002900e40 NotificationEvent ffffe000021bfcf0 NotificationEvent ffffe00002347600 NotificationEvent ffffe0000076c970 NotificationEvent ffffe0000206d060 NotificationEvent ffffe000028c6460 NotificationEvent ffffe00002436890 NotificationEvent ffffe00001c09740 NotificationEvent ffffe00002939690 NotificationEvent ffffe000020e8fe0 NotificationEvent ffffe00002733f50 NotificationEvent ffffe000010cd8b0 NotificationEvent ffffe000020dfe20 NotificationEvent ffffe000027b2fe0 NotificationEvent ffffe000010df3d0 NotificationEvent ffffe00001117d60 NotificationEvent ffffe0000203b290 NotificationEvent ffffe00002664d20 NotificationEvent ffffe000020babb0 NotificationEvent ffffe0000170e890 NotificationEvent ffffe00002561460 NotificationEvent ffffe00002621be0 NotificationEvent ffffe00001294c00 NotificationEvent ffffe000007049c0 SynchronizationEvent IRP List: ffffe0000292b010: (0006,03e8) Flags: 00060000 Mdl: 00000000 ffffe0000264ac10: (0006,03e8) Flags: 00060000 Mdl: 00000000 ffffe000010dd010: (0006,03e8) Flags: 00060000 Mdl: 00000000 ffffe000010cac10: (0006,03e8) Flags: 00060000 Mdl: 00000000 ffffe00002169c10: (0006,03e8) Flags: 00060000 Mdl: 00000000 ffffe000025c4c10: (0006,03e8) Flags: 00060000 Mdl: 00000000 ffffe000006908c0: (0006,03e8) Flags: 00060000 Mdl: 00000000 ffffe00002487c10: (0006,03e8) Flags: 00060000 Mdl: 00000000 ffffe000007984d0: (0006,03e8) Flags: 00060000 Mdl: 00000000 ffffe000011f2c10: (0006,03e8) Flags: 00060000 Mdl: 00000000 ffffe00002884270: (0006,03e8) Flags: 00060000 Mdl: 00000000 ffffe00002784010: (0006,03e8) Flags: 00060000 Mdl: 00000000 ffffe000007a8420: (0006,03e8) Flags: 00060000 Mdl: 00000000 ffffe000029f5c10: (0006,03e8) Flags: 00060000 Mdl: 00000000 ffffe00002803010: (0006,03e8) Flags: 00060000 Mdl: 00000000 ffffe000012459a0: (0006,03e8) Flags: 00060000 Mdl: 00000000 ffffe0000061bc10: (0006,03e8) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 285726 Ticks: 2726 (0:00:00:42.593) Context Switch Count 4857 IdealProcessor: 1 UserTime 00:00:00.062 KernelTime 00:00:00.062 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd00021c46dd0 Current ffffd00021c46120 Base ffffd00021c47000 Limit ffffd00021c41000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`21c46160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`21c462a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21c46340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`21c463a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`21c46460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`21c46970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`21c46bd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`21c46c40) 00000000`046ff738 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe00002965880 Cid 0214.074c Teb: 00007ff70c236000 Win32Thread: fffff90143c9a320 WAIT: (UserRequest) UserMode Alertable ffffe0000263ea40 SynchronizationEvent ffffe00001244e60 NotificationEvent ffffe000026ed530 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 287524 Ticks: 928 (0:00:00:14.500) Context Switch Count 47818 IdealProcessor: 1 UserTime 00:00:03.531 KernelTime 00:00:01.453 Win32 Start Address 0x00007ffe16ab4870 Stack Init ffffd00021c59dd0 Current ffffd00021c59120 Base ffffd00021c5a000 Limit ffffd00021c54000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`21c59160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`21c592a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21c59340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`21c593a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`21c59460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`21c59970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`21c59bd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`21c59c40) 00000000`0497f458 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe00002842880 Cid 0214.07d0 Teb: 00007ff70c234000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable fffff802c592af80 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 261329 Ticks: 27123 (0:00:07:03.796) Context Switch Count 6 IdealProcessor: 0 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ff70d180a38 Stack Init ffffd00023466dd0 Current ffffd00023464b70 Base ffffd00023467000 Limit ffffd00023461000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`23464bb0 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`23464cf0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`23464d90 fffff802`c56c39a8 nt!KiCommitThreadWait+0x127 ffffd000`23464df0 fffff802`c5af5954 nt!KeWaitForSingleObject+0x248 ffffd000`23464e90 fffff802`c5aee731 nt!LdrpResSearchResourceInsideDirectory+0x6f48 ffffd000`234662a0 fffff802`c57403f9 nt!LdrpResGetResourceDirectory+0x1229 ffffd000`234662e0 fffff802`c5b23cf4 nt!KeExpandKernelStackAndCalloutInternal+0xe9 ffffd000`23466430 fffff802`c5b23c0b nt!IoDeleteController+0x270 ffffd000`23466490 fffff802`c5a37c11 nt!IoDeleteController+0x187 ffffd000`23466540 fffff802`c5a37429 nt!ExpQuerySystemInformation+0x795 ffffd000`23466c00 fffff802`c57e14b3 nt!NtQuerySystemInformation+0x49 ffffd000`23466c40 00007ffe`1e2c68da nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`23466c40) 00000000`049ff648 00000000`00000000 0x00007ffe`1e2c68da THREAD ffffe000010f4740 Cid 0214.0720 Teb: 00007ff70c232000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Alertable ffffe00000218ce0 NotificationEvent ffffe000012877d0 SynchronizationEvent ffffe00001287750 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 261329 Ticks: 27123 (0:00:07:03.796) Context Switch Count 15 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe17f547f4 Stack Init ffffd00021c8bdd0 Current ffffd00021c8b120 Base ffffd00021c8c000 Limit ffffd00021c86000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`21c8b160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`21c8b2a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21c8b340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`21c8b3a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`21c8b460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`21c8b970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`21c8bbd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`21c8bc40) 00000000`04a8f678 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe0000205b880 Cid 0214.0354 Teb: 00007ff70c22e000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable ffffe0000275c8d0 SynchronizationTimer ffffe00002043e50 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 288100 Ticks: 352 (0:00:00:05.500) Context Switch Count 89 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe102db0f0 Stack Init ffffd00020e44dd0 Current ffffd00020e44120 Base ffffd00020e45000 Limit ffffd00020e3f000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`20e44160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`20e442a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`20e44340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`20e443a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`20e44460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`20e44970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`20e44bd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`20e44c40) 00000000`04b8f638 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe00002818080 Cid 0214.046c Teb: 00007ff70c22a000 Win32Thread: fffff90143ca0b70 WAIT: (UserRequest) UserMode Non-Alertable ffffe000012817e0 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 261329 Ticks: 27123 (0:00:07:03.796) Context Switch Count 11 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd00021c80dd0 Current ffffd00021c808b0 Base ffffd00021c81000 Limit ffffd00021c7b000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`21c808f0 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`21c80a30 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21c80ad0 fffff802`c56c39a8 nt!KiCommitThreadWait+0x127 ffffd000`21c80b30 fffff802`c5a31472 nt!KeWaitForSingleObject+0x248 ffffd000`21c80bd0 fffff802`c57e14b3 nt!NtWaitForSingleObject+0xb2 ffffd000`21c80c40 00007ffe`1e2c65ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`21c80c40) 00000000`04c8fcb8 00000000`00000000 0x00007ffe`1e2c65ba THREAD ffffe000007fa080 Cid 0214.0264 Teb: 00007ff70c21e000 Win32Thread: fffff90143cecb70 WAIT: (UserRequest) UserMode Non-Alertable ffffe0000278b9f0 SynchronizationEvent ffffe000017a2250 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 261329 Ticks: 27123 (0:00:07:03.796) Context Switch Count 18 IdealProcessor: 1 UserTime 00:00:00.046 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe199ff0ac Stack Init ffffd00020fbddd0 Current ffffd00020fbd120 Base ffffd00020fbe000 Limit ffffd00020fb8000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`20fbd160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`20fbd2a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`20fbd340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`20fbd3a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`20fbd460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`20fbd970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`20fbdbd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`20fbdc40) 00000000`0513fbc8 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe000028b6080 Cid 0214.0928 Teb: 00007ff70c21c000 Win32Thread: fffff90143d08b70 WAIT: (UserRequest) UserMode Non-Alertable ffffe00001706db0 SynchronizationEvent ffffe000022dec10 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 261329 Ticks: 27123 (0:00:07:03.796) Context Switch Count 74 IdealProcessor: 0 UserTime 00:00:00.000 KernelTime 00:00:00.015 Win32 Start Address 0x00007ffe1a2865dc Stack Init ffffd00021006dd0 Current ffffd00021006120 Base ffffd00021007000 Limit ffffd00021001000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`21006160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`210062a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21006340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`210063a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`21006460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`21006970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`21006bd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`21006c40) 00000000`080cf858 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe00002998880 Cid 0214.095c Teb: 00007ff70c218000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable ffffe00002415970 NotificationEvent ffffe00001c09ee0 NotificationEvent ffffe000010bfc80 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 261329 Ticks: 27123 (0:00:07:03.796) Context Switch Count 12 IdealProcessor: 0 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe0e627bb0 Stack Init ffffd00021171dd0 Current ffffd00021171120 Base ffffd00021172000 Limit ffffd0002116c000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`21171160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`211712a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21171340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`211713a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`21171460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`21171970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`21171bd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`21171c40) 00000000`0942f5e8 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe000007ef080 Cid 0214.05c4 Teb: 00007ff70c214000 Win32Thread: fffff90143cfa930 WAIT: (UserRequest) UserMode Non-Alertable ffffe000029182b0 SynchronizationEvent IRP List: ffffe000026081a0: (0006,03e8) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 288446 Ticks: 6 (0:00:00:00.093) Context Switch Count 6440 IdealProcessor: 0 UserTime 00:00:00.046 KernelTime 00:00:00.078 Win32 Start Address 0x00007ffe1e26b5c0 Stack Init ffffd00021286dd0 Current ffffd000212868b0 Base ffffd00021287000 Limit ffffd00021281000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`212868f0 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`21286a30 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21286ad0 fffff802`c56c39a8 nt!KiCommitThreadWait+0x127 ffffd000`21286b30 fffff802`c5a31472 nt!KeWaitForSingleObject+0x248 ffffd000`21286bd0 fffff802`c57e14b3 nt!NtWaitForSingleObject+0xb2 ffffd000`21286c40 00007ffe`1e2c65ba nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`21286c40) 00000000`0952ee38 00000000`00000000 0x00007ffe`1e2c65ba THREAD ffffe0000296e080 Cid 0214.0414 Teb: 00007ff70c210000 Win32Thread: fffff90143d2a540 WAIT: (UserRequest) UserMode Alertable ffffe0000203c460 SynchronizationEvent ffffe0000265f370 NotificationEvent ffffe00001797480 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 288442 Ticks: 10 (0:00:00:00.156) Context Switch Count 2239 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd000212a3dd0 Current ffffd000212a3120 Base ffffd000212a4000 Limit ffffd0002129e000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`212a3160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`212a32a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`212a3340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`212a33a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`212a3460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`212a3970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`212a3bd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`212a3c40) 00000000`0b3af398 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe00000605880 Cid 0214.05e4 Teb: 00007ff70c20e000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable ffffe000006817d0 NotificationEvent ffffe0000232b450 NotificationEvent ffffe000010bfc80 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 261329 Ticks: 27123 (0:00:07:03.796) Context Switch Count 11 IdealProcessor: 0 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe0e627bb0 Stack Init ffffd0002116add0 Current ffffd0002116a120 Base ffffd0002116b000 Limit ffffd00021165000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`2116a160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`2116a2a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`2116a340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`2116a3a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`2116a460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`2116a970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`2116abd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`2116ac40) 00000000`0b42f818 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe00000660880 Cid 0214.0b7c Teb: 00007ff70c206000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable ffffe00001db69b0 SynchronizationEvent ffffe00002870ec0 SynchronizationTimer Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 284329 Ticks: 4123 (0:00:01:04.421) Context Switch Count 27 IdealProcessor: 0 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe1dd08530 Stack Init ffffd000213aadd0 Current ffffd000213aa120 Base ffffd000213ab000 Limit ffffd000213a5000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`213aa160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`213aa2a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`213aa340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`213aa3a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`213aa460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`213aa970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`213aabd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`213aac40) 00000000`0b6bef38 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe00000780880 Cid 0214.0674 Teb: 00007ff70c204000 Win32Thread: fffff9014424f500 WAIT: (WrUserRequest) UserMode Non-Alertable ffffe000021958c0 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 274236 Ticks: 14216 (0:00:03:42.125) Context Switch Count 196 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe1dd08530 Stack Init ffffd0002139fdd0 Current ffffd0002139f670 Base ffffd000213a0000 Limit ffffd0002139a000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`2139f6b0 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`2139f7f0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`2139f890 fffff802`c572a20a nt!KiCommitThreadWait+0x127 ffffd000`2139f8f0 fffff960`001343b8 nt!KeWaitForMultipleObjects+0x40a ffffd000`2139f9b0 fffff960`0012f971 win32k!xxxRealSleepThread+0x278 ffffd000`2139fa70 fffff960`00133fd5 win32k!xxxSleepThread+0xc1 ffffd000`2139fac0 fffff960`000f2a8e win32k!xxxRealInternalGetMessage+0x9d5 ffffd000`2139fb90 fffff960`0012f84e win32k!xxxInternalGetMessage+0x2e ffffd000`2139fbd0 fffff802`c57e14b3 win32k!NtUserGetMessage+0x6e ffffd000`2139fc40 00007ffe`1de725fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`2139fc40) 00000000`0b73f718 00000000`00000000 0x00007ffe`1de725fa THREAD ffffe0000280b880 Cid 0214.091c Teb: 00007ff70c1fe000 Win32Thread: fffff90143d36b70 WAIT: (UserRequest) UserMode Alertable ffffe000029ebda0 NotificationEvent ffffe0000240d220 NotificationEvent ffffe0000218ac10 SynchronizationTimer ffffe000023eede0 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 286464 Ticks: 1988 (0:00:00:31.062) Context Switch Count 481 IdealProcessor: 0 UserTime 00:00:00.140 KernelTime 00:00:00.093 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd000213bddd0 Current ffffd000213bd120 Base ffffd000213be000 Limit ffffd000213b8000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`213bd160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`213bd2a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`213bd340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`213bd3a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`213bd460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`213bd970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`213bdbd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`213bdc40) 00000000`0b8cee08 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe00002838080 Cid 0214.05cc Teb: 00007ff70c202000 Win32Thread: fffff90143d34490 WAIT: (UserRequest) UserMode Alertable ffffe00000f25210 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 261329 Ticks: 27123 (0:00:07:03.796) Context Switch Count 17 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe093c5130 Stack Init ffffd000213b1dd0 Current ffffd000213b1120 Base ffffd000213b2000 Limit ffffd000213ac000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`213b1160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`213b12a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`213b1340 fffff802`c572a20a nt!KiCommitThreadWait+0x127 ffffd000`213b13a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x40a ffffd000`213b1460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`213b1970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`213b1bd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`213b1c40) 00000000`0c6df7d8 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe000007e8880 Cid 0214.00d0 Teb: 00007ff70c1fc000 Win32Thread: fffff90143d28b70 WAIT: (WrUserRequest) UserMode Non-Alertable ffffe000007c7350 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 285857 Ticks: 2595 (0:00:00:40.546) Context Switch Count 478 IdealProcessor: 0 UserTime 00:00:00.031 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd000218e9dd0 Current ffffd000218e9670 Base ffffd000218ea000 Limit ffffd000218e4000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`218e96b0 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`218e97f0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`218e9890 fffff802`c572a20a nt!KiCommitThreadWait+0x127 ffffd000`218e98f0 fffff960`001343b8 nt!KeWaitForMultipleObjects+0x40a ffffd000`218e99b0 fffff960`0012f971 win32k!xxxRealSleepThread+0x278 ffffd000`218e9a70 fffff960`00133fd5 win32k!xxxSleepThread+0xc1 ffffd000`218e9ac0 fffff960`000f2a8e win32k!xxxRealInternalGetMessage+0x9d5 ffffd000`218e9b90 fffff960`0012f84e win32k!xxxInternalGetMessage+0x2e ffffd000`218e9bd0 fffff802`c57e14b3 win32k!NtUserGetMessage+0x6e ffffd000`218e9c40 00007ffe`1de725fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`218e9c40) 00000000`0c78fa58 00000000`00000000 0x00007ffe`1de725fa THREAD ffffe000028f6040 Cid 0214.0838 Teb: 00007ff70c1f4000 Win32Thread: fffff90143d50b70 WAIT: (UserRequest) UserMode Non-Alertable ffffe000024db6e0 NotificationEvent ffffe000022de490 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 277969 Ticks: 10483 (0:00:02:43.796) Context Switch Count 63 IdealProcessor: 0 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe1e26b5c0 Stack Init ffffd00021dbadd0 Current ffffd00021dba120 Base ffffd00021dbb000 Limit ffffd00021db5000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`21dba160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`21dba2a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21dba340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`21dba3a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`21dba460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`21dba970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`21dbabd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`21dbac40) 00000000`0de3f158 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe000028c5080 Cid 0214.0794 Teb: 00007ff70c1f2000 Win32Thread: fffff90143d506d0 WAIT: (UserRequest) UserMode Non-Alertable ffffe00001dbf9b0 SynchronizationEvent ffffe0000125f100 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 280778 Ticks: 7674 (0:00:01:59.906) Context Switch Count 652 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.031 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd00022b6efd0 Current ffffd00022b6e320 Base ffffd00022b6f000 Limit ffffd00022b69000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`22b6e360 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`22b6e4a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`22b6e540 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`22b6e5a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`22b6e660 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`22b6eb70 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`22b6edd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`22b6ee40) 00000000`0deff468 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe0000061d080 Cid 0214.0454 Teb: 00007ff70c1ee000 Win32Thread: fffff90143d4a650 WAIT: (WrUserRequest) UserMode Non-Alertable ffffe000023d0060 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 285694 Ticks: 2758 (0:00:00:43.093) Context Switch Count 155 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd00022692dd0 Current ffffd00022692670 Base ffffd00022693000 Limit ffffd0002268d000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`226926b0 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`226927f0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`22692890 fffff802`c572a20a nt!KiCommitThreadWait+0x127 ffffd000`226928f0 fffff960`001343b8 nt!KeWaitForMultipleObjects+0x40a ffffd000`226929b0 fffff960`0012f971 win32k!xxxRealSleepThread+0x278 ffffd000`22692a70 fffff960`00133fd5 win32k!xxxSleepThread+0xc1 ffffd000`22692ac0 fffff960`000f2a8e win32k!xxxRealInternalGetMessage+0x9d5 ffffd000`22692b90 fffff960`0012f84e win32k!xxxInternalGetMessage+0x2e ffffd000`22692bd0 fffff802`c57e14b3 win32k!NtUserGetMessage+0x6e ffffd000`22692c40 00007ffe`1de725fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`22692c40) 00000000`0dfff5c8 00000000`00000000 0x00007ffe`1de725fa THREAD ffffe00000796080 Cid 0214.00ac Teb: 00007ff70c1fa000 Win32Thread: fffff901407796d0 WAIT: (WrUserRequest) UserMode Non-Alertable ffffe00002928270 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 277969 Ticks: 10483 (0:00:02:43.796) Context Switch Count 67 IdealProcessor: 0 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd000216e4dd0 Current ffffd000216e4670 Base ffffd000216e5000 Limit ffffd000216df000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`216e46b0 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`216e47f0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`216e4890 fffff802`c572a20a nt!KiCommitThreadWait+0x127 ffffd000`216e48f0 fffff960`001343b8 nt!KeWaitForMultipleObjects+0x40a ffffd000`216e49b0 fffff960`0012f971 win32k!xxxRealSleepThread+0x278 ffffd000`216e4a70 fffff960`00133fd5 win32k!xxxSleepThread+0xc1 ffffd000`216e4ac0 fffff960`000f2a8e win32k!xxxRealInternalGetMessage+0x9d5 ffffd000`216e4b90 fffff960`0012f84e win32k!xxxInternalGetMessage+0x2e ffffd000`216e4bd0 fffff802`c57e14b3 win32k!NtUserGetMessage+0x6e ffffd000`216e4c40 00007ffe`1de725fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`216e4c40) 00000000`0ebcf9c8 00000000`00000000 0x00007ffe`1de725fa THREAD ffffe000029f1080 Cid 0214.06d4 Teb: 00007ff70c1d0000 Win32Thread: 0000000000000000 WAIT: (UserRequest) UserMode Non-Alertable ffffe00001bc2bb0 NotificationEvent ffffe00001719320 NotificationEvent ffffe000010bfc80 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 261329 Ticks: 27123 (0:00:07:03.796) Context Switch Count 10 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe0e627bb0 Stack Init ffffd00021711dd0 Current ffffd00021711120 Base ffffd00021712000 Limit ffffd0002170c000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`21711160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`217112a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21711340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`217113a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`21711460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`21711970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`21711bd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`21711c40) 00000000`0ef6f678 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe00000681880 Cid 0214.0324 Teb: 00007ff70c1ce000 Win32Thread: fffff90140668390 WAIT: (UserRequest) UserMode Alertable ffffe00002177ca0 NotificationEvent ffffe000025bc190 SynchronizationTimer ffffe00002740fe0 NotificationEvent ffffe0000295b2e0 NotificationEvent ffffe0000200a710 SynchronizationEvent ffffe00002958850 SynchronizationEvent ffffe00001719190 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 277969 Ticks: 10483 (0:00:02:43.796) Context Switch Count 514 IdealProcessor: 0 UserTime 00:00:00.015 KernelTime 00:00:00.015 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd0002110fdd0 Current ffffd0002110f120 Base ffffd00021110000 Limit ffffd0002110a000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`2110f160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`2110f2a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`2110f340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`2110f3a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`2110f460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`2110f970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`2110fbd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`2110fc40) 00000000`0f24f448 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe000022c2880 Cid 0214.02c4 Teb: 00007ff70c1cc000 Win32Thread: fffff90143cf03e0 WAIT: (UserRequest) UserMode Alertable ffffe000017afd50 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 284751 Ticks: 3701 (0:00:00:57.828) Context Switch Count 513 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd00021a94dd0 Current ffffd00021a94120 Base ffffd00021a95000 Limit ffffd00021a8f000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`21a94160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`21a942a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21a94340 fffff802`c572a20a nt!KiCommitThreadWait+0x127 ffffd000`21a943a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x40a ffffd000`21a94460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`21a94970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`21a94bd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`21a94c40) 00000000`0f2cf358 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe00002790080 Cid 0214.0a08 Teb: 00007ff70c1ca000 Win32Thread: fffff9014074c940 WAIT: (UserRequest) UserMode Alertable ffffe00002761dc0 SynchronizationEvent ffffe00002841e00 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 277969 Ticks: 10483 (0:00:02:43.796) Context Switch Count 110 IdealProcessor: 0 UserTime 00:00:00.015 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd00020ff9dd0 Current ffffd00020ff9120 Base ffffd00020ffa000 Limit ffffd00020ff4000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`20ff9160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`20ff92a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`20ff9340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`20ff93a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`20ff9460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`20ff9970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`20ff9bd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`20ff9c40) 00000000`0f35ed78 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe000028f2340 Cid 0214.0988 Teb: 00007ff70c1c8000 Win32Thread: fffff9014065d010 WAIT: (WrUserRequest) UserMode Non-Alertable ffffe00002138c60 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 261329 Ticks: 27123 (0:00:07:03.796) Context Switch Count 7 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd0002114add0 Current ffffd0002114a670 Base ffffd0002114b000 Limit ffffd00021145000 Call 0 Priority 9 BasePriority 8 UnusualBoost 1 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`2114a6b0 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`2114a7f0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`2114a890 fffff802`c572a20a nt!KiCommitThreadWait+0x127 ffffd000`2114a8f0 fffff960`001343b8 nt!KeWaitForMultipleObjects+0x40a ffffd000`2114a9b0 fffff960`0012f971 win32k!xxxRealSleepThread+0x278 ffffd000`2114aa70 fffff960`00133fd5 win32k!xxxSleepThread+0xc1 ffffd000`2114aac0 fffff960`000f2a8e win32k!xxxRealInternalGetMessage+0x9d5 ffffd000`2114ab90 fffff960`0012f84e win32k!xxxInternalGetMessage+0x2e ffffd000`2114abd0 fffff802`c57e14b3 win32k!NtUserGetMessage+0x6e ffffd000`2114ac40 00007ffe`1de725fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`2114ac40) 00000000`0f3df608 00000000`00000000 0x00007ffe`1de725fa THREAD ffffe00000786080 Cid 0214.0be0 Teb: 00007ff70c1c6000 Win32Thread: fffff9014066bb70 WAIT: (WrUserRequest) UserMode Non-Alertable ffffe000026b5990 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 277968 Ticks: 10484 (0:00:02:43.812) Context Switch Count 189 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd00024330dd0 Current ffffd00024330670 Base ffffd00024331000 Limit ffffd0002432b000 Call 0 Priority 15 BasePriority 15 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`243306b0 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`243307f0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`24330890 fffff802`c572a20a nt!KiCommitThreadWait+0x127 ffffd000`243308f0 fffff960`001343b8 nt!KeWaitForMultipleObjects+0x40a ffffd000`243309b0 fffff960`0012f971 win32k!xxxRealSleepThread+0x278 ffffd000`24330a70 fffff960`00133fd5 win32k!xxxSleepThread+0xc1 ffffd000`24330ac0 fffff960`000f2a8e win32k!xxxRealInternalGetMessage+0x9d5 ffffd000`24330b90 fffff960`0012f84e win32k!xxxInternalGetMessage+0x2e ffffd000`24330bd0 fffff802`c57e14b3 win32k!NtUserGetMessage+0x6e ffffd000`24330c40 00007ffe`1de725fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`24330c40) 00000000`0f47f778 00000000`00000000 0x00007ffe`1de725fa THREAD ffffe000007f4880 Cid 0214.0704 Teb: 00007ff70c1c4000 Win32Thread: fffff90140666b70 WAIT: (UserRequest) UserMode Alertable ffffe000018a32a0 SynchronizationEvent IRP List: ffffe00000653c10: (0006,03e8) Flags: 00060000 Mdl: 00000000 ffffe000007fcc10: (0006,03e8) Flags: 00060000 Mdl: 00000000 Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 261329 Ticks: 27123 (0:00:07:03.796) Context Switch Count 154 IdealProcessor: 0 UserTime 00:00:00.031 KernelTime 00:00:00.015 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd00023c46dd0 Current ffffd00023c46120 Base ffffd00023c47000 Limit ffffd00023c41000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`23c46160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`23c462a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`23c46340 fffff802`c572a20a nt!KiCommitThreadWait+0x127 ffffd000`23c463a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x40a ffffd000`23c46460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`23c46970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`23c46bd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`23c46c40) 00000000`1057f0a8 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe00001db0080 Cid 0214.0c60 Teb: 00007ff70c224000 Win32Thread: fffff90143de0290 WAIT: (UserRequest) UserMode Non-Alertable ffffe000028b5180 SynchronizationEvent ffffe00002114750 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 288447 Ticks: 5 (0:00:00:00.078) Context Switch Count 86954 IdealProcessor: 0 UserTime 00:00:00.843 KernelTime 00:00:02.343 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd00022b67dd0 Current ffffd00022b67120 Base ffffd00022b68000 Limit ffffd00022b62000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`22b67160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`22b672a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`22b67340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`22b673a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`22b67460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`22b67970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`22b67bd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`22b67c40) 00000000`18e7e3b8 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe000025d2280 Cid 0214.0c64 Teb: 00007ff70c220000 Win32Thread: fffff9014077a570 WAIT: (WrUserRequest) UserMode Non-Alertable ffffe00001281410 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 278376 Ticks: 10076 (0:00:02:37.437) Context Switch Count 2200 IdealProcessor: 1 UserTime 00:00:00.140 KernelTime 00:00:00.015 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd00021da1dd0 Current ffffd00021da1670 Base ffffd00021da2000 Limit ffffd00021d9c000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`21da16b0 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`21da17f0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21da1890 fffff802`c572a20a nt!KiCommitThreadWait+0x127 ffffd000`21da18f0 fffff960`001343b8 nt!KeWaitForMultipleObjects+0x40a ffffd000`21da19b0 fffff960`0012f971 win32k!xxxRealSleepThread+0x278 ffffd000`21da1a70 fffff960`00133fd5 win32k!xxxSleepThread+0xc1 ffffd000`21da1ac0 fffff960`000f2a8e win32k!xxxRealInternalGetMessage+0x9d5 ffffd000`21da1b90 fffff960`0012f84e win32k!xxxInternalGetMessage+0x2e ffffd000`21da1bd0 fffff802`c57e14b3 win32k!NtUserGetMessage+0x6e ffffd000`21da1c40 00007ffe`1de725fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`21da1c40) 00000000`1943f608 00000000`00000000 0x00007ffe`1de725fa THREAD ffffe00000662880 Cid 0214.0c80 Teb: 00007ff70c1c0000 Win32Thread: 0000000000000000 WAIT: (WrQueue) UserMode Alertable ffffe0000203b640 QueueObject Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 261329 Ticks: 27123 (0:00:07:03.796) Context Switch Count 38 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe1e26b5c0 Stack Init ffffd00021992dd0 Current ffffd00021992580 Base ffffd00021993000 Limit ffffd0002198d000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`219925c0 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`21992700 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`219927a0 fffff802`c572bc25 nt!KiCommitThreadWait+0x127 ffffd000`21992800 fffff802`c572b79a nt!KeRemoveQueueEx+0x275 ffffd000`21992890 fffff802`c572ad3a nt!IoRemoveIoCompletion+0x8a ffffd000`219929b0 fffff802`c57e14b3 nt!NtWaitForWorkViaWorkerFactory+0x30a ffffd000`21992bd0 00007ffe`1e2c806a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`21992c40) 00000000`19dafa98 00000000`00000000 0x00007ffe`1e2c806a THREAD ffffe00001822080 Cid 0214.0dc0 Teb: 00007ff70c23c000 Win32Thread: fffff901406696f0 WAIT: (UserRequest) UserMode Non-Alertable ffffe000027a8c90 SynchronizationEvent ffffe000020d2060 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 288427 Ticks: 25 (0:00:00:00.390) Context Switch Count 72172 IdealProcessor: 0 UserTime 00:00:02.156 KernelTime 00:00:02.328 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd000238e4fd0 Current ffffd000238e4320 Base ffffd000238e5000 Limit ffffd000238df000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`238e4360 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`238e44a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`238e4540 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`238e45a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`238e4660 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`238e4b70 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`238e4dd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`238e4e40) 00000000`0b4af328 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe0000070f340 Cid 0214.0e08 Teb: 00007ff70c1f8000 Win32Thread: fffff901406ea010 WAIT: (WrQueue) UserMode Alertable ffffe0000210a3c0 QueueObject Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 288403 Ticks: 49 (0:00:00:00.765) Context Switch Count 2584 IdealProcessor: 0 UserTime 00:00:00.140 KernelTime 00:00:00.156 Win32 Start Address 0x00007ffe1e26b5c0 Stack Init ffffd00024309dd0 Current ffffd00024309580 Base ffffd0002430a000 Limit ffffd00024304000 Call 0 Priority 11 BasePriority 8 UnusualBoost 3 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`243095c0 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`24309700 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`243097a0 fffff802`c572bc25 nt!KiCommitThreadWait+0x127 ffffd000`24309800 fffff802`c572b79a nt!KeRemoveQueueEx+0x275 ffffd000`24309890 fffff802`c572ad3a nt!IoRemoveIoCompletion+0x8a ffffd000`243099b0 fffff802`c57e14b3 nt!NtWaitForWorkViaWorkerFactory+0x30a ffffd000`24309bd0 00007ffe`1e2c806a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`24309c40) 00000000`1553faf8 00000000`00000000 0x00007ffe`1e2c806a THREAD ffffe00002866080 Cid 0214.0ed8 Teb: 00007ff70c1de000 Win32Thread: fffff90143d284c0 WAIT: (WrUserRequest) UserMode Non-Alertable ffffe00002227690 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 278888 Ticks: 9564 (0:00:02:29.437) Context Switch Count 449 IdealProcessor: 0 UserTime 00:00:00.062 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd000211f7dd0 Current ffffd000211f7670 Base ffffd000211f8000 Limit ffffd000211f2000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`211f76b0 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`211f77f0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`211f7890 fffff802`c572a20a nt!KiCommitThreadWait+0x127 ffffd000`211f78f0 fffff960`001343b8 nt!KeWaitForMultipleObjects+0x40a ffffd000`211f79b0 fffff960`0012f971 win32k!xxxRealSleepThread+0x278 ffffd000`211f7a70 fffff960`00133fd5 win32k!xxxSleepThread+0xc1 ffffd000`211f7ac0 fffff960`000f2a8e win32k!xxxRealInternalGetMessage+0x9d5 ffffd000`211f7b90 fffff960`0012f84e win32k!xxxInternalGetMessage+0x2e ffffd000`211f7bd0 fffff802`c57e14b3 win32k!NtUserGetMessage+0x6e ffffd000`211f7c40 00007ffe`1de725fa nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`211f7c40) 00000000`15e5f5c8 00000000`00000000 0x00007ffe`1de725fa THREAD ffffe000007ea880 Cid 0214.0edc Teb: 00007ff70c1da000 Win32Thread: fffff901406f0b70 WAIT: (UserRequest) UserMode Non-Alertable ffffe000020ee800 SynchronizationEvent ffffe00001114360 NotificationEvent ffffe0000234f500 NotificationEvent ffffe0000238df40 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 261329 Ticks: 27123 (0:00:07:03.796) Context Switch Count 7 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe14ae8c54 Stack Init ffffd00021224dd0 Current ffffd00021224120 Base ffffd00021225000 Limit ffffd0002121f000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`21224160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`212242a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21224340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`212243a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`21224460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`21224970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`21224bd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`21224c40) 00000000`1a32f558 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe00002614700 Cid 0214.0c74 Teb: 00007ff70c22c000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 ffffe000026149e0 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 255497 Ticks: 32955 (0:00:08:34.921) Context Switch Count 3 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe14aed6bc Stack Init ffffd00022aaedd0 Current ffffd00022aae500 Base ffffd00022aaf000 Limit ffffd00022aa9000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`22aae540 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`22aae680 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`22aae720 fffff802`c56c39a8 nt!KiCommitThreadWait+0x127 ffffd000`22aae780 fffff802`c577ce64 nt!KeWaitForSingleObject+0x248 ffffd000`22aae820 fffff802`c572e289 nt!KiSchedulerApc+0x94 ffffd000`22aae880 fffff802`c57daa23 nt!KiDeliverApc+0x209 ffffd000`22aae900 fffff802`c5ac325c nt!KiApcInterrupt+0xc3 (TrapFrame @ ffffd000`22aae900) ffffd000`22aaea90 fffff802`c57dc3f5 nt!PspUserThreadStartup+0x18 ffffd000`22aaeb00 fffff802`c57dc377 nt!KiStartUserThread+0x16 ffffd000`22aaec40 00007ffe`1e2a43b4 nt!KiStartUserThreadReturn (TrapFrame @ ffffd000`22aaec40) 00000000`15c5fca8 00000000`00000000 0x00007ffe`1e2a43b4 THREAD ffffe000028cc880 Cid 0214.0ab0 Teb: 00007ff70c1d4000 Win32Thread: fffff9014062f150 WAIT: (UserRequest) UserMode Non-Alertable ffffe000026c21e0 NotificationEvent ffffe000010f7930 Semaphore Limit 0xffff ffffe000028cec70 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 285694 Ticks: 2758 (0:00:00:43.093) Context Switch Count 43869 IdealProcessor: 1 UserTime 00:00:00.968 KernelTime 00:00:00.687 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd00020da5dd0 Current ffffd00020da5120 Base ffffd00020da6000 Limit ffffd00020da0000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`20da5160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`20da52a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`20da5340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`20da53a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`20da5460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`20da5970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`20da5bd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`20da5c40) 00000000`191ef7a8 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe0000287b880 Cid 0214.0a80 Teb: 00007ff70c230000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 ffffe0000287bb60 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 255497 Ticks: 32955 (0:00:08:34.921) Context Switch Count 3 IdealProcessor: 0 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe14aed6bc Stack Init ffffd00021d40dd0 Current ffffd00021d40500 Base ffffd00021d41000 Limit ffffd00021d3b000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`21d40540 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`21d40680 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21d40720 fffff802`c56c39a8 nt!KiCommitThreadWait+0x127 ffffd000`21d40780 fffff802`c577ce64 nt!KeWaitForSingleObject+0x248 ffffd000`21d40820 fffff802`c572e289 nt!KiSchedulerApc+0x94 ffffd000`21d40880 fffff802`c57daa23 nt!KiDeliverApc+0x209 ffffd000`21d40900 fffff802`c5ac325c nt!KiApcInterrupt+0xc3 (TrapFrame @ ffffd000`21d40900) ffffd000`21d40a90 fffff802`c57dc3f5 nt!PspUserThreadStartup+0x18 ffffd000`21d40b00 fffff802`c57dc377 nt!KiStartUserThread+0x16 ffffd000`21d40c40 00007ffe`1e2a43b4 nt!KiStartUserThreadReturn (TrapFrame @ ffffd000`21d40c40) 00000000`1a42fac8 00000000`00000000 0x00007ffe`1e2a43b4 THREAD ffffe00002786880 Cid 0214.0b40 Teb: 00007ff70c1bc000 Win32Thread: fffff901441da010 WAIT: (UserRequest) UserMode Non-Alertable ffffe00001dd5890 SynchronizationEvent ffffe0000170e990 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 288403 Ticks: 49 (0:00:00:00.765) Context Switch Count 86065 IdealProcessor: 1 UserTime 00:00:13.828 KernelTime 00:00:21.015 Win32 Start Address 0x00007ffe19b80b0c Stack Init ffffd00024125fd0 Current ffffd00024125320 Base ffffd00024126000 Limit ffffd00024120000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`24125360 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`241254a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`24125540 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`241255a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`24125660 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`24125b70 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`24125dd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`24125e40) 00000000`1cfbf5c8 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe000028435c0 Cid 0214.0cc0 Teb: 00007ff70c1b8000 Win32Thread: fffff901441da580 WAIT: (UserRequest) UserMode Non-Alertable ffffe00002042e20 NotificationEvent ffffe000029da7b0 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 277969 Ticks: 10483 (0:00:02:43.796) Context Switch Count 30 IdealProcessor: 0 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe1da92764 Stack Init ffffd00021bd9dd0 Current ffffd00021bd9120 Base ffffd00021bda000 Limit ffffd00021bd4000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`21bd9160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`21bd92a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21bd9340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`21bd93a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`21bd9460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`21bd9970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`21bd9bd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`21bd9c40) 00000000`1d6af5a8 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe00001834080 Cid 0214.05f8 Teb: 00007ff70c1b0000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 ffffe00001834360 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 255497 Ticks: 32955 (0:00:08:34.921) Context Switch Count 3 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe14aed6bc Stack Init ffffd00023b5ddd0 Current ffffd00023b5d500 Base ffffd00023b5e000 Limit ffffd00023b58000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`23b5d540 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`23b5d680 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`23b5d720 fffff802`c56c39a8 nt!KiCommitThreadWait+0x127 ffffd000`23b5d780 fffff802`c577ce64 nt!KeWaitForSingleObject+0x248 ffffd000`23b5d820 fffff802`c572e289 nt!KiSchedulerApc+0x94 ffffd000`23b5d880 fffff802`c57daa23 nt!KiDeliverApc+0x209 ffffd000`23b5d900 fffff802`c5ac325c nt!KiApcInterrupt+0xc3 (TrapFrame @ ffffd000`23b5d900) ffffd000`23b5da90 fffff802`c57dc3f5 nt!PspUserThreadStartup+0x18 ffffd000`23b5db00 fffff802`c57dc377 nt!KiStartUserThread+0x16 ffffd000`23b5dc40 00007ffe`1e2a43b4 nt!KiStartUserThreadReturn (TrapFrame @ ffffd000`23b5dc40) 00000000`1d72ff88 00000000`00000000 0x00007ffe`1e2a43b4 THREAD ffffe00002808480 Cid 0214.0468 Teb: 00007ff70c1be000 Win32Thread: fffff90144264b70 WAIT: (UserRequest) UserMode Non-Alertable ffffe000025ba220 SynchronizationEvent ffffe000024c0870 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 288417 Ticks: 35 (0:00:00:00.546) Context Switch Count 3786 IdealProcessor: 1 UserTime 00:00:00.031 KernelTime 00:00:00.015 Win32 Start Address 0x00007ffe1e26b5c0 Stack Init ffffd00023d7efd0 Current ffffd00023d7e320 Base ffffd00023d7f000 Limit ffffd00023d79000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`23d7e360 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`23d7e4a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`23d7e540 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`23d7e5a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`23d7e660 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`23d7eb70 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`23d7edd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`23d7ee40) 00000000`1b72ed98 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe0000120e3c0 Cid 0214.0c38 Teb: 00007ff70c1b2000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 ffffe0000120e6a0 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 255497 Ticks: 32955 (0:00:08:34.921) Context Switch Count 3 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe14aed6bc Stack Init ffffd00023cf6dd0 Current ffffd00023cf6500 Base ffffd00023cf7000 Limit ffffd00023cf1000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`23cf6540 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`23cf6680 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`23cf6720 fffff802`c56c39a8 nt!KiCommitThreadWait+0x127 ffffd000`23cf6780 fffff802`c577ce64 nt!KeWaitForSingleObject+0x248 ffffd000`23cf6820 fffff802`c572e289 nt!KiSchedulerApc+0x94 ffffd000`23cf6880 fffff802`c57daa23 nt!KiDeliverApc+0x209 ffffd000`23cf6900 fffff802`c5ac325c nt!KiApcInterrupt+0xc3 (TrapFrame @ ffffd000`23cf6900) ffffd000`23cf6a90 fffff802`c57dc3f5 nt!PspUserThreadStartup+0x18 ffffd000`23cf6b00 fffff802`c57dc377 nt!KiStartUserThread+0x16 ffffd000`23cf6c40 00007ffe`1e2a43b4 nt!KiStartUserThreadReturn (TrapFrame @ ffffd000`23cf6c40) 00000000`1b9afa78 00000000`00000000 0x00007ffe`1e2a43b4 THREAD ffffe00000625080 Cid 0214.03d8 Teb: 00007ff70c1a8000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 ffffe00000625360 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 255497 Ticks: 32955 (0:00:08:34.921) Context Switch Count 3 IdealProcessor: 0 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe14aed6bc Stack Init ffffd000239c2dd0 Current ffffd000239c2500 Base ffffd000239c3000 Limit ffffd000239bd000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`239c2540 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`239c2680 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`239c2720 fffff802`c56c39a8 nt!KiCommitThreadWait+0x127 ffffd000`239c2780 fffff802`c577ce64 nt!KeWaitForSingleObject+0x248 ffffd000`239c2820 fffff802`c572e289 nt!KiSchedulerApc+0x94 ffffd000`239c2880 fffff802`c57daa23 nt!KiDeliverApc+0x209 ffffd000`239c2900 fffff802`c5ac325c nt!KiApcInterrupt+0xc3 (TrapFrame @ ffffd000`239c2900) ffffd000`239c2a90 fffff802`c57dc3f5 nt!PspUserThreadStartup+0x18 ffffd000`239c2b00 fffff802`c57dc377 nt!KiStartUserThread+0x16 ffffd000`239c2c40 00007ffe`1e2a43b4 nt!KiStartUserThreadReturn (TrapFrame @ ffffd000`239c2c40) 00000000`1becfa78 00000000`00000000 0x00007ffe`1e2a43b4 THREAD ffffe0000294c880 Cid 0214.0848 Teb: 00007ff70c1b4000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 ffffe0000294cb60 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 255497 Ticks: 32955 (0:00:08:34.921) Context Switch Count 3 IdealProcessor: 0 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe14aed6bc Stack Init ffffd0002349cdd0 Current ffffd0002349c500 Base ffffd0002349d000 Limit ffffd00023497000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`2349c540 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`2349c680 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`2349c720 fffff802`c56c39a8 nt!KiCommitThreadWait+0x127 ffffd000`2349c780 fffff802`c577ce64 nt!KeWaitForSingleObject+0x248 ffffd000`2349c820 fffff802`c572e289 nt!KiSchedulerApc+0x94 ffffd000`2349c880 fffff802`c57daa23 nt!KiDeliverApc+0x209 ffffd000`2349c900 fffff802`c5ac325c nt!KiApcInterrupt+0xc3 (TrapFrame @ ffffd000`2349c900) ffffd000`2349ca90 fffff802`c57dc3f5 nt!PspUserThreadStartup+0x18 ffffd000`2349cb00 fffff802`c57dc377 nt!KiStartUserThread+0x16 ffffd000`2349cc40 00007ffe`1e2a43b4 nt!KiStartUserThreadReturn (TrapFrame @ ffffd000`2349cc40) 00000000`1b82fc38 00000000`00000000 0x00007ffe`1e2a43b4 THREAD ffffe00000752880 Cid 0214.0210 Teb: 00007ff70c1a6000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 ffffe00000752b60 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 255497 Ticks: 32955 (0:00:08:34.921) Context Switch Count 3 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe14aed6bc Stack Init ffffd00021a67dd0 Current ffffd00021a67500 Base ffffd00021a68000 Limit ffffd00021a62000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`21a67540 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`21a67680 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21a67720 fffff802`c56c39a8 nt!KiCommitThreadWait+0x127 ffffd000`21a67780 fffff802`c577ce64 nt!KeWaitForSingleObject+0x248 ffffd000`21a67820 fffff802`c572e289 nt!KiSchedulerApc+0x94 ffffd000`21a67880 fffff802`c57daa23 nt!KiDeliverApc+0x209 ffffd000`21a67900 fffff802`c5ac325c nt!KiApcInterrupt+0xc3 (TrapFrame @ ffffd000`21a67900) ffffd000`21a67a90 fffff802`c57dc3f5 nt!PspUserThreadStartup+0x18 ffffd000`21a67b00 fffff802`c57dc377 nt!KiStartUserThread+0x16 ffffd000`21a67c40 00007ffe`1e2a43b4 nt!KiStartUserThreadReturn (TrapFrame @ ffffd000`21a67c40) 00000000`15d5fb68 00000000`00000000 0x00007ffe`1e2a43b4 THREAD ffffe000028cb880 Cid 0214.0950 Teb: 00007ff70c1d6000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 ffffe000028cbb60 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 255497 Ticks: 32955 (0:00:08:34.921) Context Switch Count 3 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe14aed6bc Stack Init ffffd00021ccedd0 Current ffffd00021cce500 Base ffffd00021ccf000 Limit ffffd00021cc9000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`21cce540 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`21cce680 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21cce720 fffff802`c56c39a8 nt!KiCommitThreadWait+0x127 ffffd000`21cce780 fffff802`c577ce64 nt!KeWaitForSingleObject+0x248 ffffd000`21cce820 fffff802`c572e289 nt!KiSchedulerApc+0x94 ffffd000`21cce880 fffff802`c57daa23 nt!KiDeliverApc+0x209 ffffd000`21cce900 fffff802`c5ac325c nt!KiApcInterrupt+0xc3 (TrapFrame @ ffffd000`21cce900) ffffd000`21ccea90 fffff802`c57dc3f5 nt!PspUserThreadStartup+0x18 ffffd000`21cceb00 fffff802`c57dc377 nt!KiStartUserThread+0x16 ffffd000`21ccec40 00007ffe`1e2a43b4 nt!KiStartUserThreadReturn (TrapFrame @ ffffd000`21ccec40) 00000000`19e2fd88 00000000`00000000 0x00007ffe`1e2a43b4 THREAD ffffe00002944880 Cid 0214.0cec Teb: 00007ff70c1a0000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 ffffe00002944b60 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 255497 Ticks: 32955 (0:00:08:34.921) Context Switch Count 4 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe14aed6bc Stack Init ffffd000234bfdd0 Current ffffd000234bf500 Base ffffd000234c0000 Limit ffffd000234ba000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`234bf540 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`234bf680 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`234bf720 fffff802`c56c39a8 nt!KiCommitThreadWait+0x127 ffffd000`234bf780 fffff802`c577ce64 nt!KeWaitForSingleObject+0x248 ffffd000`234bf820 fffff802`c572e289 nt!KiSchedulerApc+0x94 ffffd000`234bf880 fffff802`c57daa23 nt!KiDeliverApc+0x209 ffffd000`234bf900 fffff802`c5ac325c nt!KiApcInterrupt+0xc3 (TrapFrame @ ffffd000`234bf900) ffffd000`234bfa90 fffff802`c57dc3f5 nt!PspUserThreadStartup+0x18 ffffd000`234bfb00 fffff802`c57dc377 nt!KiStartUserThread+0x16 ffffd000`234bfc40 00007ffe`1e2a43b4 nt!KiStartUserThreadReturn (TrapFrame @ ffffd000`234bfc40) 00000000`1c6cfcf8 00000000`00000000 0x00007ffe`1e2a43b4 THREAD ffffe000028f5880 Cid 0214.0438 Teb: 00007ff70c1a2000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 ffffe000028f5b60 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 255497 Ticks: 32955 (0:00:08:34.921) Context Switch Count 4 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe14aed6bc Stack Init ffffd0002233bdd0 Current ffffd0002233b500 Base ffffd0002233c000 Limit ffffd00022336000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`2233b540 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`2233b680 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`2233b720 fffff802`c56c39a8 nt!KiCommitThreadWait+0x127 ffffd000`2233b780 fffff802`c577ce64 nt!KeWaitForSingleObject+0x248 ffffd000`2233b820 fffff802`c572e289 nt!KiSchedulerApc+0x94 ffffd000`2233b880 fffff802`c57daa23 nt!KiDeliverApc+0x209 ffffd000`2233b900 fffff802`c5ac325c nt!KiApcInterrupt+0xc3 (TrapFrame @ ffffd000`2233b900) ffffd000`2233ba90 fffff802`c57dc3f5 nt!PspUserThreadStartup+0x18 ffffd000`2233bb00 fffff802`c57dc377 nt!KiStartUserThread+0x16 ffffd000`2233bc40 00007ffe`1e2a43b4 nt!KiStartUserThreadReturn (TrapFrame @ ffffd000`2233bc40) 00000000`1c23ff08 00000000`00000000 0x00007ffe`1e2a43b4 THREAD ffffe000006f4880 Cid 0214.063c Teb: 00007ff70c1a4000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 ffffe000006f4b60 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 255497 Ticks: 32955 (0:00:08:34.921) Context Switch Count 2 IdealProcessor: 0 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe14aed6bc Stack Init ffffd00022119dd0 Current ffffd00022119500 Base ffffd0002211a000 Limit ffffd00022114000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`22119540 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`22119680 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`22119720 fffff802`c56c39a8 nt!KiCommitThreadWait+0x127 ffffd000`22119780 fffff802`c577ce64 nt!KeWaitForSingleObject+0x248 ffffd000`22119820 fffff802`c572e289 nt!KiSchedulerApc+0x94 ffffd000`22119880 fffff802`c57daa23 nt!KiDeliverApc+0x209 ffffd000`22119900 fffff802`c5ac325c nt!KiApcInterrupt+0xc3 (TrapFrame @ ffffd000`22119900) ffffd000`22119a90 fffff802`c57dc3f5 nt!PspUserThreadStartup+0x18 ffffd000`22119b00 fffff802`c57dc377 nt!KiStartUserThread+0x16 ffffd000`22119c40 00007ffe`1e2a43b4 nt!KiStartUserThreadReturn (TrapFrame @ ffffd000`22119c40) 00000000`0d49fcb8 00000000`00000000 0x00007ffe`1e2a43b4 THREAD ffffe00000900080 Cid 0214.0e9c Teb: 00007ff70c196000 Win32Thread: fffff90144133010 WAIT: (UserRequest) UserMode Non-Alertable ffffe00000681410 NotificationEvent ffffe000007462f0 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 261329 Ticks: 27123 (0:00:07:03.796) Context Switch Count 28 IdealProcessor: 0 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe1e26b5c0 Stack Init ffffd00023a8ddd0 Current ffffd00023a8d120 Base ffffd00023a8e000 Limit ffffd00023a88000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Kernel stack not resident. Child-SP RetAddr Call Site ffffd000`23a8d160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`23a8d2a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`23a8d340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`23a8d3a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`23a8d460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`23a8d970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`23a8dbd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`23a8dc40) 00000000`2142f458 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe00000718880 Cid 0214.020c Teb: 00007ff70c226000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 ffffe00000718b60 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 264340 Ticks: 24112 (0:00:06:16.750) Context Switch Count 1 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe14aed6bc Stack Init ffffd000231f5dd0 Current ffffd000231f5500 Base ffffd000231f6000 Limit ffffd000231f0000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`231f5540 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`231f5680 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`231f5720 fffff802`c56c39a8 nt!KiCommitThreadWait+0x127 ffffd000`231f5780 fffff802`c577ce64 nt!KeWaitForSingleObject+0x248 ffffd000`231f5820 fffff802`c572e289 nt!KiSchedulerApc+0x94 ffffd000`231f5880 fffff802`c57daa23 nt!KiDeliverApc+0x209 ffffd000`231f5900 fffff802`c5ac325c nt!KiApcInterrupt+0xc3 (TrapFrame @ ffffd000`231f5900) ffffd000`231f5a90 fffff802`c57dc3f5 nt!PspUserThreadStartup+0x18 ffffd000`231f5b00 fffff802`c57dc377 nt!KiStartUserThread+0x16 ffffd000`231f5c40 00007ffe`1e2a43b4 nt!KiStartUserThreadReturn (TrapFrame @ ffffd000`231f5c40) 00000000`0e7ffc48 00000000`00000000 0x00007ffe`1e2a43b4 THREAD ffffe0000114b800 Cid 0214.0ec0 Teb: 00007ff70c228000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 ffffe0000114bae0 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 266491 Ticks: 21961 (0:00:05:43.140) Context Switch Count 1 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe14aed6bc Stack Init ffffd00021263dd0 Current ffffd00021263500 Base ffffd00021264000 Limit ffffd0002125e000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`21263540 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`21263680 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`21263720 fffff802`c56c39a8 nt!KiCommitThreadWait+0x127 ffffd000`21263780 fffff802`c577ce64 nt!KeWaitForSingleObject+0x248 ffffd000`21263820 fffff802`c572e289 nt!KiSchedulerApc+0x94 ffffd000`21263880 fffff802`c57daa23 nt!KiDeliverApc+0x209 ffffd000`21263900 fffff802`c5ac325c nt!KiApcInterrupt+0xc3 (TrapFrame @ ffffd000`21263900) ffffd000`21263a90 fffff802`c57dc3f5 nt!PspUserThreadStartup+0x18 ffffd000`21263b00 fffff802`c57dc377 nt!KiStartUserThread+0x16 ffffd000`21263c40 00007ffe`1e2a43b4 nt!KiStartUserThreadReturn (TrapFrame @ ffffd000`21263c40) 00000000`14d8fd18 00000000`00000000 0x00007ffe`1e2a43b4 THREAD ffffe00000818080 Cid 0214.04f4 Teb: 00007ff70c212000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 ffffe00000818360 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 266722 Ticks: 21730 (0:00:05:39.531) Context Switch Count 1 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe14aed6bc Stack Init ffffd000233d3dd0 Current ffffd000233d3500 Base ffffd000233d4000 Limit ffffd000233ce000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`233d3540 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`233d3680 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`233d3720 fffff802`c56c39a8 nt!KiCommitThreadWait+0x127 ffffd000`233d3780 fffff802`c577ce64 nt!KeWaitForSingleObject+0x248 ffffd000`233d3820 fffff802`c572e289 nt!KiSchedulerApc+0x94 ffffd000`233d3880 fffff802`c57daa23 nt!KiDeliverApc+0x209 ffffd000`233d3900 fffff802`c5ac325c nt!KiApcInterrupt+0xc3 (TrapFrame @ ffffd000`233d3900) ffffd000`233d3a90 fffff802`c57dc3f5 nt!PspUserThreadStartup+0x18 ffffd000`233d3b00 fffff802`c57dc377 nt!KiStartUserThread+0x16 ffffd000`233d3c40 00007ffe`1e2a43b4 nt!KiStartUserThreadReturn (TrapFrame @ ffffd000`233d3c40) 00000000`1533fef8 00000000`00000000 0x00007ffe`1e2a43b4 THREAD ffffe000029cc080 Cid 0214.09b4 Teb: 00007ff70c366000 Win32Thread: 0000000000000000 WAIT: (Suspended) KernelMode Non-Alertable SuspendCount 1 ffffe000029cc360 NotificationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 267564 Ticks: 20888 (0:00:05:26.375) Context Switch Count 1 IdealProcessor: 0 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe14aed6bc Stack Init ffffd0002396bdd0 Current ffffd0002396b500 Base ffffd0002396c000 Limit ffffd00023966000 Call 0 Priority 8 BasePriority 8 UnusualBoost 0 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`2396b540 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`2396b680 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`2396b720 fffff802`c56c39a8 nt!KiCommitThreadWait+0x127 ffffd000`2396b780 fffff802`c577ce64 nt!KeWaitForSingleObject+0x248 ffffd000`2396b820 fffff802`c572e289 nt!KiSchedulerApc+0x94 ffffd000`2396b880 fffff802`c57daa23 nt!KiDeliverApc+0x209 ffffd000`2396b900 fffff802`c5ac325c nt!KiApcInterrupt+0xc3 (TrapFrame @ ffffd000`2396b900) ffffd000`2396ba90 fffff802`c57dc3f5 nt!PspUserThreadStartup+0x18 ffffd000`2396bb00 fffff802`c57dc377 nt!KiStartUserThread+0x16 ffffd000`2396bc40 00007ffe`1e2a43b4 nt!KiStartUserThreadReturn (TrapFrame @ ffffd000`2396bc40) 00000000`0d58fb18 00000000`00000000 0x00007ffe`1e2a43b4 THREAD ffffe0000286c080 Cid 0214.0a00 Teb: 00007ff70c208000 Win32Thread: fffff90140680b70 WAIT: (WrQueue) UserMode Alertable ffffe0000210a3c0 QueueObject Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 288270 Ticks: 182 (0:00:00:02.843) Context Switch Count 99 IdealProcessor: 0 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe1e26b5c0 Stack Init ffffd00023ceddd0 Current ffffd00023ced580 Base ffffd00023cee000 Limit ffffd00023ce8000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`23ced5c0 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`23ced700 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`23ced7a0 fffff802`c572bc25 nt!KiCommitThreadWait+0x127 ffffd000`23ced800 fffff802`c572b79a nt!KeRemoveQueueEx+0x275 ffffd000`23ced890 fffff802`c572ad3a nt!IoRemoveIoCompletion+0x8a ffffd000`23ced9b0 fffff802`c57e14b3 nt!NtWaitForWorkViaWorkerFactory+0x30a ffffd000`23cedbd0 00007ffe`1e2c806a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`23cedc40) 00000000`153bf708 00000000`00000000 0x00007ffe`1e2c806a THREAD ffffe000006bf880 Cid 0214.0cf4 Teb: 00007ff70c200000 Win32Thread: fffff90144024b70 WAIT: (WrQueue) UserMode Alertable ffffe0000210a3c0 QueueObject Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 287567 Ticks: 885 (0:00:00:13.828) Context Switch Count 20 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe1e26b5c0 Stack Init ffffd00021673dd0 Current ffffd00021673580 Base ffffd00021674000 Limit ffffd0002166e000 Call 0 Priority 10 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`216735c0 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`21673700 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`216737a0 fffff802`c572bc25 nt!KiCommitThreadWait+0x127 ffffd000`21673800 fffff802`c572b79a nt!KeRemoveQueueEx+0x275 ffffd000`21673890 fffff802`c572ad3a nt!IoRemoveIoCompletion+0x8a ffffd000`216739b0 fffff802`c57e14b3 nt!NtWaitForWorkViaWorkerFactory+0x30a ffffd000`21673bd0 00007ffe`1e2c806a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`21673c40) 00000000`154af818 00000000`00000000 0x00007ffe`1e2c806a THREAD ffffe0000075e880 Cid 0214.02f0 Teb: 00007ff70c1ea000 Win32Thread: fffff901406d2b70 WAIT: (UserRequest) UserMode Non-Alertable ffffe000021ffd10 NotificationEvent ffffe000021ffd90 Semaphore Limit 0xffff ffffe0000075e460 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 287842 Ticks: 610 (0:00:00:09.531) Context Switch Count 57 IdealProcessor: 1 UserTime 00:00:00.015 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe1e26b5c0 Stack Init ffffd00023914dd0 Current ffffd00023914120 Base ffffd00023915000 Limit ffffd0002390f000 Call 0 Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`23914160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`239142a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`23914340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`239143a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`23914460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`23914970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`23914bd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`23914c40) 00000000`190eef18 00000000`00000000 0x00007ffe`1e2c6b2a THREAD ffffe00002636080 Cid 0214.0e1c Teb: 00007ff70c1e6000 Win32Thread: fffff90144025800 WAIT: (WrQueue) UserMode Alertable ffffe0000210a3c0 QueueObject Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 287375 Ticks: 1077 (0:00:00:16.828) Context Switch Count 151 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe1e26b5c0 Stack Init ffffd000217efdd0 Current ffffd000217ef580 Base ffffd000217f0000 Limit ffffd000217ea000 Call 0 Priority 11 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`217ef5c0 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`217ef700 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`217ef7a0 fffff802`c572bc25 nt!KiCommitThreadWait+0x127 ffffd000`217ef800 fffff802`c572b79a nt!KeRemoveQueueEx+0x275 ffffd000`217ef890 fffff802`c572ad3a nt!IoRemoveIoCompletion+0x8a ffffd000`217ef9b0 fffff802`c57e14b3 nt!NtWaitForWorkViaWorkerFactory+0x30a ffffd000`217efbd0 00007ffe`1e2c806a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`217efc40) 00000000`19baf6e8 00000000`00000000 0x00007ffe`1e2c806a THREAD ffffe0000070a880 Cid 0214.0f14 Teb: 00007ff70c36c000 Win32Thread: fffff90144294680 WAIT: (UserRequest) UserMode Alertable ffffe000023981a0 SynchronizationEvent ffffe000020700f0 SynchronizationEvent Not impersonating DeviceMap ffffc00001c145c0 Owning Process ffffe000021fd900 Image: explorer.exe Attached Process N/A Image: N/A Wait Start TickCount 287524 Ticks: 928 (0:00:00:14.500) Context Switch Count 21 IdealProcessor: 1 UserTime 00:00:00.000 KernelTime 00:00:00.000 Win32 Start Address 0x00007ffe102dbd38 Stack Init ffffd000238ebdd0 Current ffffd000238eb120 Base ffffd000238ec000 Limit ffffd000238e6000 Call 0 Priority 9 BasePriority 8 UnusualBoost 1 ForegroundBoost 0 IoPriority 2 PagePriority 5 Child-SP RetAddr Call Site ffffd000`238eb160 fffff802`c572c90e nt!KiSwapContext+0x76 ffffd000`238eb2a0 fffff802`c572c3a7 nt!KiSwapThread+0x14e ffffd000`238eb340 fffff802`c572a028 nt!KiCommitThreadWait+0x127 ffffd000`238eb3a0 fffff802`c5ab65a9 nt!KeWaitForMultipleObjects+0x228 ffffd000`238eb460 fffff802`c5ab6306 nt!ObWaitForMultipleObjects+0x289 ffffd000`238eb970 fffff802`c57e14b3 nt!NtWaitForMultipleObjects+0xde ffffd000`238ebbd0 00007ffe`1e2c6b2a nt!KiSystemServiceCopyEnd+0x13 (TrapFrame @ ffffd000`238ebc40) 00000000`0b22f9b8 00000000`00000000 0x00007ffe`1e2c6b2a .process /p /r 0