Hi,
On a xp-x64 machine, ocasionally the system becomes slow. I triggered a blue screen to dump all kernal data. From the dump file, the ERESOURCE [0xfffffadf37c52800] was already exclusively acquired by thread [fffffadf379117a0]. It seems the ERESOURCE [0xfffffadf37c52800] is for the VCB data. Could you please give some suggestions about what is the thread [fffffadf379117a0] doing? Trying to accquire the same eresource or another eresource?
Our driver is not invloved in all the threads for the ERESOURCE [0xfffffadf37c52800].
========================================================
0: kd> !thread fffffadf379117a0
THREAD fffffadf379117a0 Cid 0364.05b8 Teb: 000007fffff6a000 Win32Thread: 0000000000000000 STANDBY
IRP List:
fffffadf35b3b010: (0006,03a0) Flags: 00000404 Mdl: 00000000
Impersonation token: fffffa800331ebb0 (Level Impersonation)
Owning Process fffffadf39dd86c0 Image: svchost.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32144 Ticks: 15 (0:00:00:00.234)
Context Switch Count 156
UserTime 00:00:00.000
KernelTime 00:00:00.000
Start Address 0x000007ff769360d0
Stack Init fffffadf2a50ce00 Current fffffadf2a50c410
Base fffffadf2a50d000 Limit fffffadf2a507000 Call 0
Priority 9 BasePriority 8 PriorityDecrement 1
Child-SP RetAddr : Args to Child : Call Site
fffffadf2a50c450 fffff800
01027602 : fffffadf2a50c6d8 fffffadf
2ac92b27 fffffadf37bb70c0 fffffadf
36c3e010 : nt!KiSwapContext+0x85
fffffadf2a50c5d0 fffff800
0102820e : 000000012dbf9ea0 fffff800
011b5dc0 fffffadf37911838 fffffadf
379117a0 : nt!KiSwapThread+0x3c9
fffffadf2a50c630 fffff800
010b0343 : 0000000000000090 fffffadf
0000001b fffffadf37bb7000 00000000
00000000 : nt!KeWaitForSingleObject+0x5a6
fffffadf2a50c6b0 fffff800
01047549 : fffffadf37c52800 00000000
00000000 0000000000000001 fffffadf
379117a0 : nt!ExpWaitForResource+0x275 ===> it is waiting for [fffffadf`37c52800]. Isn’t it already owned the thread?
fffffadf2a50c720 fffffadf
2ab9aa74 : fffffadf36c715f0 fffffadf
2a50c970 0000000000000000 fffffa80
0084ab00 : nt!ExAcquireResourceExclusiveLite+0x1ab
fffffadf2a50c750 fffffadf
2abb2915 : fffffadf36c715f0 fffffa80
0084ac00 fffffa800084ab00 fffffadf
37c521c8 : Ntfs!NtfsCommonClose+0xcd
fffffadf2a50c7f0 fffffadf
2ac96542 : fffffadf35b3b000 fffffadf
35b3b010 fffffadf35b3b010 fffffadf
39e789e0 : Ntfs!NtfsFsdClose+0x392
fffffadf2a50c8e0 fffffadf
2ac968df : 0000000000000000 fffffadf
35b3b010 fffffadf35b3b000 fffffadf
35b3b010 : fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf2a50c950 fffffadf
2b71cff7 : 0000000500000000 fffffadf
367dac10 fffffadf35c95050 fffffadf
35b3b010 : fltMgr!FltpDispatch+0x17f
fffffadf2a50c9b0 fffffadf
2b7245ba : 0000000000000001 00000000
00000000 0000000000000001 fffffadf
3787f460 : TmPreFlt!TmpAddRdr+0xc87
fffffadf2a50c9e0 fffff800
01284120 : fffffadf35c95050 fffffadf
35c95050 fffffadf35c95050 00000000
00000000 : TmPreFlt!TmpQueryFullName+0x7526
fffffadf2a50ca10 fffff800
01284e30 : fffffadf35c95020 fffffadf
35c95050 fffffadf35c95050 00000000
00000000 : nt!IopDeleteFile+0x301
fffffadf2a50cab0 fffff800
0103c22e : fffffadf35c95020 00000000
0000075c fffffadf35c95050 00000000
00000000 : nt!ObpRemoveObjectRoutine+0x14f
fffffadf2a50cb20 fffff800
01288e97 : fffffa80035d2d70 fffffa80
035d2d70 fffffa8002cac770 00000000
00000000 : nt!ObfDereferenceObject+0x83
fffffadf2a50cb50 fffff800
01285a54 : fffffadf379117a0 00000000
0000075c fffffadf39dd86c0 fffffadf
379117a0 : nt!ObpCloseHandleTableEntry+0x24b
fffffadf2a50cbf0 fffff800
0102e2bd : fffffadf379117a0 fffffadf
2a50ccf0 0000000000000000 00000000
00000000 : nt!ObpCloseHandle+0xb0
fffffadf2a50cc70 00000000
77ef0ada : 0000000000000000 00000000
00000000 0000000000000000 00000000
00000000 : nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf2a50cc70) 00000000
02edf018 0000000000000000 : 00000000
00000000 0000000000000000 00000000
00000000 00000000`00000000 : 0x77ef0ada
=================================================
0: kd> !locks -v 0xfffffadf37c52800
Resource @ 0xfffffadf37c52800 Exclusively owned
Contention Count = 3214
NumberOfSharedWaiters = 10
Threads: fffffadf379117a0-01<*>
THREAD fffffadf379117a0 Cid 0364.05b8 Teb: 000007fffff6a000 Win32Thread: 0000000000000000 STANDBY
IRP List:
fffffadf35b3b010: (0006,03a0) Flags: 00000404 Mdl: 00000000
Impersonation token: fffffa800331ebb0 (Level Impersonation)
Owning Process fffffadf39dd86c0 Image: svchost.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32144 Ticks: 15 (0:00:00:00.234)
Context Switch Count 156
UserTime 00:00:00.000
KernelTime 00:00:00.000
Start Address 0x000007ff769360d0
Stack Init fffffadf2a50ce00 Current fffffadf2a50c410
Base fffffadf2a50d000 Limit fffffadf2a507000 Call 0
Priority 9 BasePriority 8 PriorityDecrement 1
Child-SP RetAddr Call Site
fffffadf2a50c450 fffff800
01027602 nt!KiSwapContext+0x85
fffffadf2a50c5d0 fffff800
0102820e nt!KiSwapThread+0x3c9
fffffadf2a50c630 fffff800
010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf2a50c6b0 fffff800
01047549 nt!ExpWaitForResource+0x275
fffffadf2a50c720 fffffadf
2ab9aa74 nt!ExAcquireResourceExclusiveLite+0x1ab
fffffadf2a50c750 fffffadf
2abb2915 Ntfs!NtfsCommonClose+0xcd
fffffadf2a50c7f0 fffffadf
2ac96542 Ntfs!NtfsFsdClose+0x392
fffffadf2a50c8e0 fffffadf
2ac968df fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf2a50c950 fffffadf
2b71cff7 fltMgr!FltpDispatch+0x17f
fffffadf2a50c9b0 fffffadf
2b7245ba TmPreFlt!TmpAddRdr+0xc87
fffffadf2a50c9e0 fffff800
01284120 TmPreFlt!TmpQueryFullName+0x7526
fffffadf2a50ca10 fffff800
01284e30 nt!IopDeleteFile+0x301
fffffadf2a50cab0 fffff800
0103c22e nt!ObpRemoveObjectRoutine+0x14f
fffffadf2a50cb20 fffff800
01288e97 nt!ObfDereferenceObject+0x83
fffffadf2a50cb50 fffff800
01285a54 nt!ObpCloseHandleTableEntry+0x24b
fffffadf2a50cbf0 fffff800
0102e2bd nt!ObpCloseHandle+0xb0
fffffadf2a50cc70 00000000
77ef0ada nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf2a50cc70) 00000000
02edf018 00000000`00000000 0x77ef0ada
fffffadf368c3a50-01
THREAD fffffadf368c3a50 Cid 0388.0d50 Teb: 000007fffff8a000 Win32Thread: fffffa8004fc5010 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf368c3b08 NotificationTimer
IRP List:
fffffadf367da870: (0006,03a0) Flags: 00000404 Mdl: 00000000
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36ce4040 Image: explorer.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32159 Ticks: 0
Context Switch Count 6088 LargeStack
UserTime 00:00:00.343
KernelTime 00:00:00.515
Start Address 0x0000000077d6b6a0
Stack Init fffffadf1220be00 Current fffffadf1220b3f0
Base fffffadf1220c000 Limit fffffadf12205000 Call 0
Priority 8 BasePriority 8 PriorityDecrement 0
Child-SP RetAddr Call Site
fffffadf1220b430 fffff800
01027602 nt!KiSwapContext+0x85
fffffadf1220b5b0 fffff800
0102820e nt!KiSwapThread+0x3c9
fffffadf1220b610 fffff800
010474c8 nt!KeWaitForSingleObject+0x5a6
fffffadf1220b690 fffff800
01010fd4 nt!ExpWaitForResource+0x48
fffffadf1220b700 fffffadf
2abb2a3f nt!ExAcquireResourceSharedLite+0x32e
fffffadf1220b750 fffffadf
2abb2915 Ntfs!NtfsCommonClose+0xa3
fffffadf1220b7f0 fffffadf
2ac96542 Ntfs!NtfsFsdClose+0x392
fffffadf1220b8e0 fffffadf
2ac968df fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf1220b950 fffffadf
2b71cff7 fltMgr!FltpDispatch+0x17f
fffffadf1220b9b0 fffffadf
2b7245ba TmPreFlt!TmpAddRdr+0xc87
fffffadf1220b9e0 fffff800
01284120 TmPreFlt!TmpQueryFullName+0x7526
fffffadf1220ba10 fffff800
01284e30 nt!IopDeleteFile+0x301
fffffadf1220bab0 fffff800
0103c22e nt!ObpRemoveObjectRoutine+0x14f
fffffadf1220bb20 fffff800
01288e97 nt!ObfDereferenceObject+0x83
fffffadf1220bb50 fffff800
01285a54 nt!ObpCloseHandleTableEntry+0x24b
fffffadf1220bbf0 fffff800
0102e2bd nt!ObpCloseHandle+0xb0
fffffadf1220bc70 00000000
77ef0ada nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf1220bc70) 00000000
043ed798 00000000`00000000 0x77ef0ada
fffffadf36a7ba40-01
THREAD fffffadf36a7ba40 Cid 0b20.0d64 Teb: 000000007ef9d000 Win32Thread: fffffa80007b5920 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf36a7baf8 NotificationTimer
IRP List:
fffffadf35bb4b50: (0006,03a0) Flags: 00000884 Mdl: 00000000
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf37bc6870 Image: vmware-tray.exe
Attached Process N/A Image: N/A
Wait Start TickCount 31952 Ticks: 207 (0:00:00:03.234)
Context Switch Count 1140 LargeStack
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x0000000003a4ac60
Start Address 0x000000007d4d1504
Stack Init fffffadf15382e00 Current fffffadf153818a0
Base fffffadf15383000 Limit fffffadf1537c000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 6
Child-SP RetAddr Call Site
fffffadf153818e0 fffff800
01027602 nt!KiSwapContext+0x85
fffffadf15381a60 fffff800
0102820e nt!KiSwapThread+0x3c9
fffffadf15381ac0 fffff800
010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf15381b40 fffff800
01010fd4 nt!ExpWaitForResource+0x275
fffffadf15381bb0 fffffadf
2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf15381c00 fffffadf
2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf15381c40 fffffadf
2abbd2c6 Ntfs!NtfsCommonCreate+0x200
fffffadf15382020 fffffadf
2ac96542 Ntfs!NtfsFsdCreate+0x218
fffffadf153821b0 fffffadf
2acb1e1d fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf15382220 fffffadf
2ac79289 fltMgr!FltpCreate+0x3bd
fffffadf153822b0 fffffadf
2b72455d sr!SrCreate+0x1c9
fffffadf15382350 fffff800
01283749 TmPreFlt!TmpQueryFullName+0x74c9
fffffadf15382460 fffff800
012810e4 nt!IopParseDevice+0x1088
fffffadf15382610 fffff800
01285807 nt!ObpLookupObjectName+0x931
fffffadf15382720 fffff800
01292dcd nt!ObOpenObjectByName+0x180
fffffadf15382910 fffff800
01299e87 nt!IopCreateFile+0x630
fffffadf15382aa0 fffff800
01295889 nt!IoCreateFile+0x12f
fffffadf15382b80 fffff800
0102e2bd nt!NtOpenFile+0x49
fffffadf15382c00 00000000
77ef0d1a nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf15382c70) 00000000
03f1e798 00000000`00000000 0x77ef0d1a
fffffadf36825040-01
THREAD fffffadf36825040 Cid 0ba4.0ac8 Teb: 000007fffff7e000 Win32Thread: 0000000000000000 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf368250f8 NotificationTimer
IRP List:
fffffadf35c15010: (0006,03a0) Flags: 00000884 Mdl: 00000000
Not impersonating
DeviceMap fffffa80000037b0
Owning Process fffffadf36bc2040 Image: TmListen.exe
Attached Process N/A Image: N/A
Wait Start TickCount 31966 Ticks: 193 (0:00:00:03.015)
Context Switch Count 117
UserTime 00:00:00.000
KernelTime 00:00:00.000
Start Address 0x0000000077d6b6a0
Stack Init fffffadf2a5bbe00 Current fffffadf2a5ba8a0
Base fffffadf2a5bc000 Limit fffffadf2a5b6000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 6
Child-SP RetAddr Call Site
fffffadf2a5ba8e0 fffff800
01027602 nt!KiSwapContext+0x85
fffffadf2a5baa60 fffff800
0102820e nt!KiSwapThread+0x3c9
fffffadf2a5baac0 fffff800
010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf2a5bab40 fffff800
01010fd4 nt!ExpWaitForResource+0x275
fffffadf2a5babb0 fffffadf
2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf2a5bac00 fffffadf
2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf2a5bac40 fffffadf
2abbd2c6 Ntfs!NtfsCommonCreate+0x200
fffffadf2a5bb020 fffffadf
2ac96542 Ntfs!NtfsFsdCreate+0x218
fffffadf2a5bb1b0 fffffadf
2acb1e1d fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf2a5bb220 fffffadf
2ac79289 fltMgr!FltpCreate+0x3bd
fffffadf2a5bb2b0 fffffadf
2b72455d sr!SrCreate+0x1c9
fffffadf2a5bb350 fffff800
01283749 TmPreFlt!TmpQueryFullName+0x74c9
fffffadf2a5bb460 fffff800
012810e4 nt!IopParseDevice+0x1088
fffffadf2a5bb610 fffff800
01285807 nt!ObpLookupObjectName+0x931
fffffadf2a5bb720 fffff800
01292dcd nt!ObOpenObjectByName+0x180
fffffadf2a5bb910 fffff800
01299e87 nt!IopCreateFile+0x630
fffffadf2a5bbaa0 fffff800
01295889 nt!IoCreateFile+0x12f
fffffadf2a5bbb80 fffff800
0102e2bd nt!NtOpenFile+0x49
fffffadf2a5bbc00 00000000
77ef0d1a nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf2a5bbc70) 00000000
064cf298 00000000`00000000 0x77ef0d1a
fffffadf3a5f9040-01
THREAD fffffadf3a5f9040 Cid 0004.0024 Teb: 0000000000000000 Win32Thread: 0000000000000000 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf3a5f90f8 NotificationTimer
IRP List:
fffffadf35c13c60: (0006,03a0) Flags: 00000004 Mdl: 00000000
Not impersonating
DeviceMap fffffa80000037b0
Owning Process fffffadf3a5fe040 Image: System
Attached Process N/A Image: N/A
Wait Start TickCount 31972 Ticks: 187 (0:00:00:02.921)
Context Switch Count 8746
UserTime 00:00:00.000
KernelTime 00:00:00.093
Start Address nt!ExpWorkerThread (0xfffff80001003970)
Stack Init fffffadf2ba63e00 Current fffffadf2ba63350
Base fffffadf2ba64000 Limit fffffadf2ba5e000 Call 0
Priority 14 BasePriority 12 PriorityDecrement 1
Child-SP RetAddr Call Site
fffffadf2ba63390 fffff800
01027602 nt!KiSwapContext+0x85
fffffadf2ba63510 fffff800
0102820e nt!KiSwapThread+0x3c9
fffffadf2ba63570 fffff800
010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf2ba635f0 fffff800
01010fd4 nt!ExpWaitForResource+0x275
fffffadf2ba63660 fffffadf
2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf2ba636b0 fffffadf
2aba106e Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf2ba636f0 fffffadf
2aba153a Ntfs!NtfsCommonFlushBuffers+0x1ac
fffffadf2ba637b0 fffffadf
2ac96922 Ntfs!NtfsFsdFlushBuffers+0xc3
fffffadf2ba63830 fffffadf
2b71cff7 fltMgr!FltpDispatch+0x1c2
fffffadf2ba63890 fffff800
01264b2b TmPreFlt!TmpAddRdr+0xc87
fffffadf2ba638c0 fffff800
0102e2bd nt!NtFlushBuffersFile+0x2bd
fffffadf2ba63950 fffff800
0102e780 nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf2ba63950) fffffadf
2ba63ae8 fffff8000125a3c5 nt!KiServiceLinkage fffffadf
2ba63af0 fffff8000125e49b nt!CmpFileFlush+0x68 fffffadf
2ba63b40 fffff8000125999f nt!HvpWriteLog+0x20f fffffadf
2ba63c10 fffff8000125e33c nt!HvSyncHive+0x94 fffffadf
2ba63c40 fffff8000125d42d nt!CmpDoFlushNextHive+0xf0 fffffadf
2ba63cc0 fffff8000103754a nt!CmpLazyFlushWorker+0xef fffffadf
2ba63d00 fffff8000124b932 nt!ExpWorkerThread+0x13b fffffadf
2ba63d70 fffff80001020196 nt!PspSystemThreadStartup+0x3e fffffadf
2ba63dd0 00000000`00000000 nt!KxStartSystemThread+0x16
fffffadf367d9bf0-01
THREAD fffffadf367d9bf0 Cid 0448.0f30 Teb: 000007fffff88000 Win32Thread: 0000000000000000 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf367d9ca8 NotificationTimer
Not impersonating
DeviceMap fffffa80000037b0
Owning Process fffffadf3787ac20 Image: spoolsv.exe
Attached Process N/A Image: N/A
Wait Start TickCount 31974 Ticks: 185 (0:00:00:02.890)
Context Switch Count 8
UserTime 00:00:00.000
KernelTime 00:00:00.000
Win32 Start Address 0x00000000000bed80
Start Address 0x0000000077d6b6a0
Stack Init fffffadf153c8e00 Current fffffadf153c7970
Base fffffadf153c9000 Limit fffffadf153c3000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 6
*** ERROR: Module load completed but symbols could not be loaded for sptd.sys
Child-SP RetAddr Call Site
fffffadf153c79b0 fffff800
01027602 nt!KiSwapContext+0x85
fffffadf153c7b30 fffff800
0102820e nt!KiSwapThread+0x3c9
fffffadf153c7b90 fffff800
010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf153c7c10 fffff800
01010fd4 nt!ExpWaitForResource+0x275
fffffadf153c7c80 fffffadf
2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf153c7cd0 fffffadf
2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf153c7d10 fffffadf
2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf153c80f0 fffffadf
2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf153c83a0 fffffadf
2ac94d27 sptd+0x69313
fffffadf153c83d0 fffffadf
2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf153c8440 fffffadf
2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf153c8480 fffffadf
2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf153c8520 fffffadf
2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf153c8550 fffff800
0129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf153c8580 fffff800
012810e4 nt!IopParseDevice+0xf52
fffffadf153c8730 fffff800
01285807 nt!ObpLookupObjectName+0x931
fffffadf153c8840 fffff800
012959cd nt!ObOpenObjectByName+0x180
fffffadf153c8a30 fffff800
0102e2bd nt!NtQueryAttributesFile+0x133
fffffadf153c8c70 00000000
77ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf153c8c70) 00000000
0302f158 00000000`00000000 0x77ef0dba
fffffadf36983bf0-01
THREAD fffffadf36983bf0 Cid 0b68.0d38 Teb: 000007fffff98000 Win32Thread: 0000000000000000 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf36983ca8 NotificationTimer
IRP List:
fffffadf35b3bc60: (0006,03a0) Flags: 00000884 Mdl: 00000000
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36b34040 Image: PccNTMon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32039 Ticks: 120 (0:00:00:01.875)
Context Switch Count 113
UserTime 00:00:00.000
KernelTime 00:00:00.000
Start Address 0x0000000077d6b6a0
Stack Init fffffadf11a0ae00 Current fffffadf11a098a0
Base fffffadf11a0b000 Limit fffffadf11a05000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 6
Child-SP RetAddr Call Site
fffffadf11a098e0 fffff800
01027602 nt!KiSwapContext+0x85
fffffadf11a09a60 fffff800
0102820e nt!KiSwapThread+0x3c9
fffffadf11a09ac0 fffff800
010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf11a09b40 fffff800
01010fd4 nt!ExpWaitForResource+0x275
fffffadf11a09bb0 fffffadf
2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf11a09c00 fffffadf
2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf11a09c40 fffffadf
2abbd2c6 Ntfs!NtfsCommonCreate+0x200
fffffadf11a0a020 fffffadf
2ac96542 Ntfs!NtfsFsdCreate+0x218
fffffadf11a0a1b0 fffffadf
2acb1e1d fltMgr!FltpLegacyProcessingAfterPreCallbacksCompleted+0x3f2
fffffadf11a0a220 fffffadf
2ac79289 fltMgr!FltpCreate+0x3bd
fffffadf11a0a2b0 fffffadf
2b72455d sr!SrCreate+0x1c9
fffffadf11a0a350 fffff800
01283749 TmPreFlt!TmpQueryFullName+0x74c9
fffffadf11a0a460 fffff800
012810e4 nt!IopParseDevice+0x1088
fffffadf11a0a610 fffff800
01285807 nt!ObpLookupObjectName+0x931
fffffadf11a0a720 fffff800
01292dcd nt!ObOpenObjectByName+0x180
fffffadf11a0a910 fffff800
01299e87 nt!IopCreateFile+0x630
fffffadf11a0aaa0 fffff800
01295889 nt!IoCreateFile+0x12f
fffffadf11a0ab80 fffff800
0102e2bd nt!NtOpenFile+0x49
fffffadf11a0ac00 00000000
77ef0d1a nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf11a0ac70) 00000000
03bcf4b8 00000000`00000000 0x77ef0d1a
fffffadf37883890-01
THREAD fffffadf37883890 Cid 0f20.0390 Teb: 000000007efdb000 Win32Thread: fffffa8006b08620 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf37883948 NotificationTimer
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36ade870 Image: EventMonitor.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32043 Ticks: 116 (0:00:00:01.812)
Context Switch Count 11389 LargeStack
UserTime 00:00:00.328
KernelTime 00:00:00.312
Win32 Start Address 0x00000000004137d1
Start Address 0x0000000077d59620
Stack Init fffffadf2b40e570 Current fffffadf2b40d0e0
Base fffffadf2b410000 Limit fffffadf2b404000 Call fffffadf2b40e770
Priority 14 BasePriority 8 PriorityDecrement 5
Child-SP RetAddr Call Site
fffffadf2b40d120 fffff800
01027602 nt!KiSwapContext+0x85
fffffadf2b40d2a0 fffff800
0102820e nt!KiSwapThread+0x3c9
fffffadf2b40d300 fffff800
010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf2b40d380 fffff800
01010fd4 nt!ExpWaitForResource+0x275
fffffadf2b40d3f0 fffffadf
2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf2b40d440 fffffadf
2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf2b40d480 fffffadf
2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf2b40d860 fffffadf
2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf2b40db10 fffffadf
2ac94d27 sptd+0x69313
fffffadf2b40db40 fffffadf
2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf2b40dbb0 fffffadf
2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf2b40dbf0 fffffadf
2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf2b40dc90 fffffadf
2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf2b40dcc0 fffff800
0129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf2b40dcf0 fffff800
012810e4 nt!IopParseDevice+0xf52
fffffadf2b40dea0 fffff800
01285807 nt!ObpLookupObjectName+0x931
fffffadf2b40dfb0 fffff800
012959cd nt!ObOpenObjectByName+0x180
fffffadf2b40e1a0 fffff800
0102e2bd nt!NtQueryAttributesFile+0x133
fffffadf2b40e3e0 00000000
77ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf2b40e3e0) 00000000
0012c508 fffff800010265c0 0x77ef0dba fffffadf
2b40e770 fffffadf2b40ef50 nt!KiCallUserMode fffffadf
2b40e778 000000000012d578 0xfffffadf
2b40ef50
fffffadf2b40e780 00000000
0012d4b0 0x12d578
fffffadf2b40e788 00000000
00000000 0x12d4b0
fffffadf36b3a7f0-01
THREAD fffffadf36b3a7f0 Cid 0b68.0b6c Teb: 000007fffffdb000 Win32Thread: fffffa8002a86d80 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf36b3a8a8 NotificationTimer
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36b34040 Image: PccNTMon.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32071 Ticks: 88 (0:00:00:01.375)
Context Switch Count 7789 LargeStack
UserTime 00:00:00.015
KernelTime 00:00:00.109
Win32 Start Address 0x00000001400a4100
Start Address 0x0000000077d59620
Stack Init fffffadf1547ae00 Current fffffadf15479970
Base fffffadf1547b000 Limit fffffadf15470000 Call 0
Priority 14 BasePriority 8 PriorityDecrement 2
Child-SP RetAddr Call Site
fffffadf154799b0 fffff800
01027602 nt!KiSwapContext+0x85
fffffadf15479b30 fffff800
0102820e nt!KiSwapThread+0x3c9
fffffadf15479b90 fffff800
010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf15479c10 fffff800
01010fd4 nt!ExpWaitForResource+0x275
fffffadf15479c80 fffffadf
2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf15479cd0 fffffadf
2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf15479d10 fffffadf
2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf1547a0f0 fffffadf
2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf1547a3a0 fffffadf
2ac94d27 sptd+0x69313
fffffadf1547a3d0 fffffadf
2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf1547a440 fffffadf
2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf1547a480 fffffadf
2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf1547a520 fffffadf
2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf1547a550 fffff800
0129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf1547a580 fffff800
012810e4 nt!IopParseDevice+0xf52
fffffadf1547a730 fffff800
01285807 nt!ObpLookupObjectName+0x931
fffffadf1547a840 fffff800
012959cd nt!ObOpenObjectByName+0x180
fffffadf1547aa30 fffff800
0102e2bd nt!NtQueryAttributesFile+0x133
fffffadf1547ac70 00000000
77ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf1547ac70) 00000000
0023f608 00000000`00000000 0x77ef0dba
fffffadf39d9b880-01
THREAD fffffadf39d9b880 Cid 0a3c.0a44 Teb: 000000007efdb000 Win32Thread: fffffa8005352190 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf39d9b938 NotificationTimer
Not impersonating
DeviceMap fffffa8000b19f00
Owning Process fffffadf36ae3890 Image: Dbgview.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32071 Ticks: 88 (0:00:00:01.375)
Context Switch Count 15962 LargeStack
UserTime 00:00:00.531
KernelTime 00:00:00.828
Win32 Start Address 0x00000000004153b7
Start Address 0x0000000077d59620
Stack Init fffffadf10afc010 Current fffffadf10afab80
Base fffffadf10afd000 Limit fffffadf10af2000 Call fffffadf10afc210
Priority 14 BasePriority 8 PriorityDecrement 6
Child-SP RetAddr Call Site
fffffadf10afabc0 fffff800
01027602 nt!KiSwapContext+0x85
fffffadf10afad40 fffff800
0102820e nt!KiSwapThread+0x3c9
fffffadf10afada0 fffff800
010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf10afae20 fffff800
01010fd4 nt!ExpWaitForResource+0x275
fffffadf10afae90 fffffadf
2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf10afaee0 fffffadf
2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf10afaf20 fffffadf
2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf10afb300 fffffadf
2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf10afb5b0 fffffadf
2ac94d27 sptd+0x69313
fffffadf10afb5e0 fffffadf
2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf10afb650 fffffadf
2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf10afb690 fffffadf
2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf10afb730 fffffadf
2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf10afb760 fffff800
0129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf10afb790 fffff800
012810e4 nt!IopParseDevice+0xf52
fffffadf10afb940 fffff800
01285807 nt!ObpLookupObjectName+0x931
fffffadf10afba50 fffff800
012959cd nt!ObOpenObjectByName+0x180
fffffadf10afbc40 fffff800
0102e2bd nt!NtQueryAttributesFile+0x133
fffffadf10afbe80 00000000
77ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf10afbe80) 00000000
0012d468 fffff800010265c0 0x77ef0dba fffffadf
10afc210 00000000`00000000 nt!KiCallUserMode
fffffadf36cbbbf0-01
THREAD fffffadf36cbbbf0 Cid 0388.086c Teb: 000007fffffd5000 Win32Thread: fffffa80045b4d80 WAIT: (Unknown) KernelMode Non-Alertable
fffffadf39f4a330 Semaphore Limit 0x7fffffff
fffffadf36cbbca8 NotificationTimer
Not impersonating
DeviceMap fffffa8002d356d0
Owning Process fffffadf36ce4040 Image: explorer.exe
Attached Process N/A Image: N/A
Wait Start TickCount 32107 Ticks: 52 (0:00:00:00.812)
Context Switch Count 19024 LargeStack
UserTime 00:00:00.046
KernelTime 00:00:00.203
Win32 Start Address 0x00000000000afb90
Start Address 0x0000000077d6b6a0
Stack Init fffffadf15669100 Current fffffadf15667c70
Base fffffadf1566a000 Limit fffffadf1565f000 Call fffffadf15669300
Priority 14 BasePriority 9 PriorityDecrement 1
Child-SP RetAddr Call Site
fffffadf15667cb0 fffff800
01027602 nt!KiSwapContext+0x85
fffffadf15667e30 fffff800
0102820e nt!KiSwapThread+0x3c9
fffffadf15667e90 fffff800
010b0343 nt!KeWaitForSingleObject+0x5a6
fffffadf15667f10 fffff800
01010fd4 nt!ExpWaitForResource+0x275
fffffadf15667f80 fffffadf
2abbad9c nt!ExAcquireResourceSharedLite+0x32e
fffffadf15667fd0 fffffadf
2abbb228 Ntfs!NtfsAcquireSharedVcb+0x2c
fffffadf15668010 fffffadf
2abaa0cb Ntfs!NtfsCommonCreate+0x200
fffffadf156683f0 fffffadf
2b129313 Ntfs!NtfsNetworkOpenCreate+0xcc
fffffadf156686a0 fffffadf
2ac94d27 sptd+0x69313
fffffadf156686d0 fffffadf
2ac95041 fltMgr!FltpPerformFastIoCall+0x457
fffffadf15668740 fffffadf
2acb0b2a fltMgr!FltpPassThroughFastIo+0xa1
fffffadf15668780 fffffadf
2ac7daba fltMgr!FltpFastIoQueryOpen+0x16a
fffffadf15668820 fffffadf
2b72529f sr!SrFastIoQueryOpen+0x5a
fffffadf15668850 fffff800
0129a56d TmPreFlt!TmpQueryFullName+0x820b
fffffadf15668880 fffff800
012810e4 nt!IopParseDevice+0xf52
fffffadf15668a30 fffff800
01285807 nt!ObpLookupObjectName+0x931
fffffadf15668b40 fffff800
012959cd nt!ObOpenObjectByName+0x180
fffffadf15668d30 fffff800
0102e2bd nt!NtQueryAttributesFile+0x133
fffffadf15668f70 00000000
77ef0dba nt!KiSystemServiceCopyEnd+0x3 (TrapFrame @ fffffadf15668f70) 00000000
02b7e2a8 fffff800010265c0 0x77ef0dba fffffadf
15669300 fffffadf15658000 nt!KiCallUserMode fffffadf
15669308 0000000000000000 0xfffffadf
15658000
1 total locks, 1 locks currently held