Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations wOOdy-Soft on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Mini Dump

Status
Not open for further replies.
Argo131

Argo131

MIS
Dec 1, 2005
9
US
Can anyone take a look at this and maybe point me in the right direction?

This is a production server running our EDI Innovis software. I suspect the issue is with the software, but I need proof. So far, the debugger has told me little that I understand.


Windows Server 2003 Kernel Version 3790 MP (4 procs) Free x86 compatible
Product: Server, suite: TerminalServer SingleUserTS
Kernel base = 0x804de000 PsLoadedModuleList = 0x8057b6a8
Debug session time: Thu Dec 1 00:06:37.122 2005 (GMT-5)
System Uptime: 3 days 10:56:04.711
Unable to load image \WINDOWS\system32\ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
Loading Kernel Symbols
..................................................................................................
Loading unloaded module list
..
Loading User Symbols
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck C2, {a, 874af6c8, 65ec6946, 656c6946}

Probably caused by : ntoskrnl.exe ( nt!PoRunDownDeviceObject+9f )

Followup: MachineOwner
---------

0: kd> !analyze -show
Unknown bugcheck code (0)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000a, Attempt to free some other component's protected pool.
Arg2: 874af6c8, Address of pool
Arg3: 65ec6946, Pool allocation's tag
Arg4: 656c6946, Quota process pointer (bad).

Debugging Details:
------------------


BUGCHECK_STR: 0xc2_a

CUSTOMER_CRASH_COUNT: 1

DEFAULT_BUCKET_ID: DRIVER_FAULT_SERVER_MINIDUMP

CURRENT_IRQL: 42

LAST_CONTROL_TRANSFER: from 80568ad0 to 80543ac9

STACK_TEXT:
b4c01c34 80568ad0 000000c2 0000000a 874af6c8 nt!PoRunDownDeviceObject+0x9f
b4c01c94 8058692d 874af6c8 e56c6946 89b84900 nt!RtlpValidatePeChecksum+0x98
b4c01cb4 805869c2 00000000 874af6d0 00000000 nt!MiLargePageRanges+0x16d
b4c01cd0 804f1e98 874af6e8 00000000 0000068c nt!MiLargePageRangeIndex+0x2
874af6e8 00000000 00000000 00000000 00000000 nt!MmProbeAndLockSelectedPages+0x333


FOLLOWUP_IP:
nt!PoRunDownDeviceObject+9f
80543ac9 5d pop ebp

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!PoRunDownDeviceObject+9f

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 40b53739

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xc2_a_nt!PoRunDownDeviceObject+9f

BUCKET_ID: 0xc2_a_nt!PoRunDownDeviceObject+9f

Followup: MachineOwner
 
Sort by date Sort by votes
It's a kernel mode device driver calling at the wrong IRQ level, you'll need more than a mini dump to figure this out.

 
Upvote 0 Downvote
Yea, you'll need a kernel dump at the VERY least. However, a full dump is highly recommended.

Microsoft Certified Nut.

 
Upvote 0 Downvote
My bet would be a network or storage driver, but you would need at least a kernel dump to figure it out. Some memory leak scernios might require a full dump to detect, but those are fairly rare. Most of the time a kernel dump will do. How much memory is in the box, and how large is the pagefile on C:. This may limit the type of memory dump you are able to collect.





 
Upvote 0 Downvote
The pagefile is 2 GB. The box has 2 GB of RAM, and 3.6 GB free on the C partition.

I have a 345 MB kernal dump, but I haven't ever been able to debug it. It crashes windbg every time I tell it to open the crash dump.

I have it set to do a kernal dump, not a complete dump at this time.

Anything different about opening the kernal dump opposed to the mini-dump?
 
Upvote 0 Downvote
Ok, I figured out how to open the kernal dump, it is a bit different.

Anyway, it tells me I have the wrong symbols. I am 99% sure I have the right symbols. it gives me the same message when I use Microsoft symbol site.

Any thoughts?

*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000a, Attempt to free some other component's protected pool.
Arg2: 874af6c8, Address of pool
Arg3: 65ec6946, Pool allocation's tag
Arg4: 656c6946, Quota process pointer (bad).

Debugging Details:
------------------

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

*************************************************************************
*** ***
*** ***
*** Your debugger is not using the correct symbols ***
*** ***
*** In order for this command to work properly, your symbol path ***
*** must point to .pdb files that have full type information. ***
*** ***
*** Certain .pdb files (such as the public OS symbols) do not ***
*** contain the required information. Contact the group that ***
*** provided you with these symbols if you need this command to ***
*** work. ***
*** ***
*** Type referenced: nt!_KPRCB ***
*** ***
*************************************************************************

MODULE_NAME: nt

FAULTING_MODULE: 804de000 nt

DEBUG_FLR_IMAGE_TIMESTAMP: 40b53739

BUGCHECK_STR: 0xc2_a

DEFAULT_BUCKET_ID: DRIVER_FAULT

LAST_CONTROL_TRANSFER: from 80568ad0 to 80543ac9

STACK_TEXT:
WARNING: Stack unwind information not available. Following frames may be wrong.
b4c01c34 80568ad0 000000c2 0000000a 874af6c8 nt!KeBugCheckEx+0x19
b4c01c94 8058692d 874af6c8 e56c6946 89b84900 nt!ExFreePool+0x16a0
b4c01cb4 805869c2 00000000 874af6d0 00000000 nt!IoSetIoCompletion+0x2cd
b4c01cd0 804f1e98 874af6e8 00000000 0000068c nt!IoSetIoCompletion+0x362
b4c01cec 80586cae efa59340 8866a540 88246498 nt!IoQueueWorkItem+0x158
00000000 00000000 00000000 00000000 00000000 nt!IoSetIoCompletion+0x64e


STACK_COMMAND: .bugcheck ; kb

FOLLOWUP_NAME: MachineOwner

BUCKET_ID: WRONG_SYMBOLS

Followup: MachineOwner
 
Upvote 0 Downvote
Added additional Symbols....this is what I now get..

Thanks in advance if you guys see anything special.




0: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

BAD_POOL_CALLER (c2)
The current thread is making a bad pool request. Typically this is at a bad IRQL level or double freeing the same allocation, etc.
Arguments:
Arg1: 0000000a, Attempt to free some other component's protected pool.
Arg2: 874af6c8, Address of pool
Arg3: 65ec6946, Pool allocation's tag
Arg4: 656c6946, Quota process pointer (bad).

Debugging Details:
------------------


BUGCHECK_STR: 0xc2_a

DEFAULT_BUCKET_ID: DRIVER_FAULT

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 80568ad0 to 80543ac9

STACK_TEXT:
b4c01c34 80568ad0 000000c2 0000000a 874af6c8 nt!KeBugCheckEx+0x19
b4c01c94 8058692d 874af6c8 e56c6946 89b84900 nt!ExFreePoolWithTag+0x514
b4c01cb4 805869c2 00000000 874af6d0 00000000 nt!ObpFreeObject+0x18b
b4c01cd0 804f1e98 874af6e8 00000000 0000068c nt!ObpRemoveObjectRoutine+0xeb
b4c01cec 80586cae efa59340 8866a540 88246498 nt!ObfDereferenceObject+0x4b
b4c01d04 80586d24 efa59340 874af6e8 0000068c nt!ObpCloseHandleTableEntry+0x137
b4c01d4c 80586d87 0000068c 00000001 804dfd24 nt!ObpCloseHandle+0x80
b4c01d58 804dfd24 0000068c 00000000 00000000 nt!NtClose+0x17
b4c01d58 7ffe0304 0000068c 00000000 00000000 nt!KiSystemService+0xd0
00114af8 00000000 00000000 00000000 00000000 SharedUserData!SystemCallStub+0x4


FOLLOWUP_IP:
nt!ExFreePoolWithTag+514
80568ad0 8bbacc040000 mov edi,[edx+0x4cc]

SYMBOL_STACK_INDEX: 1

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!ExFreePoolWithTag+514

MODULE_NAME: nt

IMAGE_NAME: ntkrnlmp.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 40b53739

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xc2_a_nt!ExFreePoolWithTag+514

BUCKET_ID: 0xc2_a_nt!ExFreePoolWithTag+514

Followup: MachineOwner
---------

0: kd> !analyze -show
Unknown bugcheck code (0)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000
 
Upvote 0 Downvote
Pool tags are enabled by default on windows 2003, so that's the easy way.

 
Upvote 0 Downvote
Sorry about the length and thanks for the help.

0: kd> !poolused 2
Sorting by NonPaged Pool Consumed

Pool Used:
NonPaged Paged
Tag Allocs Used Allocs Used
File 47952 7447664 0 0 File objects
Ntfr 99378 6361160 0 0 ERESOURCE , Binary: ntfs.sys
MmCa 45374 4715088 0 0 Mm control areas for mapped files , Binary: nt!mm
LSwi 1 2576384 0 0 initial work context
NtFs 64000 2562496 74044 3717024 StrucSup.c , Binary: ntfs.sys
Ntfn 63995 2561280 0 0 SCB_NONPAGED , Binary: ntfs.sys
MmSd 32441 1816696 0 0 extended subsections used to map data files , Binary: nt!mm
MmCm 17 1184288 0 0 Calls made to MmAllocateContiguousMemory , Binary: nt!mm
Pool 3 1105920 0 0 Pool tables, etc.
FSfm 13453 538120 0 0 File System Run Time Fast Mutex Lookaside List , Binary: nt!fsrtl
LSwr 128 406528 0 0 raw work context
Thre 569 364160 0 0 Thread objects , Binary: nt!ps
Devi 257 305816 0 0 Device objects
ReEv 11766 282384 0 0 Resource Event
CcSc 754 235248 0 0 Cache Manager Shared Cache Map , Binary: nt!cc
Mm 12 222296 5 608 general Mm Allocations , Binary: nt!mm
Ntf0 3 196608 54811 1449840 general pool allocation , Binary: ntfs.sys
TCPt 26 185408 0 0 TCP/IP network protocol , Binary: TCP
Irp 555 179088 0 0 Io, IRP packets
Vmem 119 178688 120 46776320 Volume Manager Extension , Binary: volmgrx.sys
AfdC 862 137920 0 0 Afd connection structure , Binary: afd.sys
CcBc 1005 136680 0 0 Cache Manager Bcb from pool , Binary: nt!cc
Vad 2737 131376 0 0 Mm virtual address descriptors , Binary: nt!mm
AmlH 2 131072 0 0 ACPI AMLI Pooltags
Even 2621 129344 0 0 Event objects
Dump 7 106928 0 0 Bugcheck dump allocations
NtFL 8 105744 700 28000 LogSup.c , Binary: ntfs.sys
MmCi 453 100184 0 0 Mm control areas for images , Binary: nt!mm
TCPC 1050 89208 0 0 TCP connection pool , Binary: TCP
Mdl 672 86016 0 0 Io, Mdls
Io 120 79400 88 3608 general IO allocations , Binary: nt!io
brcm 6 74080 0 0 UNKNOWN pooltag 'brcm', please update pooltag.txt
Ntfi 255 69360 0 0 IRP_CONTEXT , Binary: ntfs.sys
NDpp 22 66016 0 0 packet pool , Binary: ndis.sys
IpSI 1027 53272 0 0 initial allocations , Binary: ipsec.sys
TCPc 1107 53136 0 0 TCP/IP network protocol , Binary: TCP
VadS 1624 51968 0 0 Mm virtual address descriptors (short) , Binary: nt!mm
UlCO 64 51200 0 0 Connection , Binary: http.sys
CcVa 1 49152 0 0 Cache Manager Initial array of Vacbs , Binary: nt!cc
Vadl 721 46144 0 0 Mm virtual address descriptors (long) , Binary: nt!mm
Sema 795 44632 0 0 Semaphore objects
usbp 10 38912 1 48 UNKNOWN pooltag 'usbp', please update pooltag.txt
Proc 54 35856 0 0 Process objects , Binary: nt!ps
Lfsr 2 32768 0 0 UNKNOWN pooltag 'Lfsr', please update pooltag.txt
VoSb 2 32768 0 0 Buffer allocations , Binary: volsnap.sys
AmlC 4 32768 0 0 ACPI AMLI Pooltags
PooL 4 32768 0 0 Phase 0 initialization of the executive component, paged and nonpaged small pool lookaside structures
Dnod 107 30816 0 0 Device node structure
AfdE 107 29960 0 0 Afd endpoint structure , Binary: afd.sys
AfdB 17 27952 0 0 Afd data buffer , Binary: afd.sys
LScn 38 26144 0 0 connection
CMpa 401 25664 0 0 registry post apcs , Binary: nt!cm
ReTa 614 25536 0 0 Resource Extended Table
Ddk 3 25408 9 632 Default for driver allocated memory (user's of ntddk.h)
TCPB 17 24600 0 0 TCP/IP network protocol , Binary: TCP
Driv 99 23920 0 0 Driver objects
AcpD 64 21920 0 0 ACPI Pooltags , Binary: acpi.sys
UlOT 5 20480 0 0 Opaque ID Table , Binary: http.sys
Muta 293 20352 0 0 Mutant objects
Ioin 9 18720 0 0 Io interrupts
CcVl 20 16704 0 0 Cache Manager Vacb Level structures (large streams) , Binary: nt!cc
TChe 4 16384 0 0 TCP/IP header pools , Binary: TCP
MmSP 2 16384 0 0 SLIST entries for system PTE NB queues , Binary: nt!mm
TChc 4 16384 0 0 TCP/IP header pools , Binary: TCP
TCht 4 16384 0 0 TCP/IP header pools , Binary: TCP
TChi 4 16384 0 0 TCP/IP header pools , Binary: TCP
TChu 4 16384 0 0 TCP/IP header pools , Binary: TCP
TCPA 46 16192 0 0 TCP/IP network protocol , Binary: TCP
CPnp 65 16120 0 0 ClassPnP transfer packets , Binary: classpnp.sys
Nbtl 103 14832 0 0 NetBT allocations
ObjT 29 13456 0 0 object type objects , Binary: nt!ob
CM44 408 13016 0 0 Internal Configuration manager allocations , Binary: nt!cm
PciB 15 11488 35 5864 PnP pci bus enumerator , Binary: pci.sys
MmLd 99 11128 0 0 Mm load module database , Binary: nt!mm
NpFc 137 10960 137 18632 CCB, client control block , Binary: npfs.sys
TCPT 26 10608 0 0 TCB pool , Binary: TCP
TMLF 2 10248 0 0 UNKNOWN pooltag 'TMLF', please update pooltag.txt
SmMm 11 9976 0 0 smbmini managed datastructures
SeTd 140 8960 140 11192 Security Token dynamic part , Binary: nt!se
Wait 29 8872 0 0 NtWaitForMultipleObjects
WmiG 38 8512 0 0 Allocation of WMIGUID
Usfd 1 8192 0 0 UNKNOWN pooltag 'Usfd', please update pooltag.txt
ScPh 1 8192 0 0 HwDevice Ext
Time 44 8160 0 0 Timer objects , Binary: nt!ke
Gsem 99 7888 0 0 Gdi Semaphores
Port 236 7552 418 77664 Port objects
IoCo 103 7416 0 0 UNKNOWN pooltag 'IoCo', please update pooltag.txt
NbL0 42 7392 0 0 NetBT allocations
NDw1 6 7368 0 0 NDIS_TAG_WMI_GUID_TO_OID , Binary: ndis.sys
SePa 53 7360 1 16 Process audit image names and captured polity structures , Binary: nt!se
ReSe 230 7360 0 0 Resource Semaphore
LStb 42 6752 114 7904 table
NbtD 38 5776 0 0 NetBT allocations
NbL1 31 5456 0 0 NetBT allocations
IpTI 3 5400 0 0 timers , Binary: ipsec.sys
TMsc 133 5320 0 0 UNKNOWN pooltag 'TMsc', please update pooltag.txt
NbL2 30 5280 0 0 NetBT allocations
Ntft 14 4992 0 0 SCB (Prerestart) , Binary: ntfs.sys
MuoC 3 4944 0 0 MOUSE_POOL_TAG Mouse Class Driver
LSwq 2 4704 0 0 BlockTypeWorkQueue
NDpf 17 4536 0 0 NDIS_TAG_FILTER , Binary: ndis.sys
IdeP 21 4496 0 0 atapi IDE
Cont 4 4312 0 0 Contiguous physical memory allocations for device drivers
AcpR 11 4304 6 1024 ACPI Pooltags , Binary: acpi.sys
ScFt 5 4280 7 752 Mass storage driver tags
PlBd 2 4192 0 0 UNKNOWN pooltag 'PlBd', please update pooltag.txt
NDPt 2 4176 0 0 TCPIP , Binary: ndis.sys
NDPw 2 4176 0 0 WAN_PACKET_TAG , Binary: ndis.sys
Wmit 1 4096 11 655688 Wmi Trace
MmPd 1 4096 0 0 Mm page table commitment bitmaps , Binary: nt!mm
Ksec 5 4040 1 32 Security device driver , Binary: ksecdd.sys
L2T4 1 4016 0 0 ndis\l2tp / MTAG_VCTABLE
PTPc 1 4008 0 0 UNKNOWN pooltag 'PTPc', please update pooltag.txt
ScPC 2 3952 0 0 reset bus code
8042 4 3944 0 0 PS/2 kb and mouse , Binary: i8042prt.sys
NpFn 66 3688 0 0 Name block , Binary: npfs.sys
CcVp 16 3512 0 0 Cache Manager Array of Vacb pointers for a cached stream , Binary: nt!cc
TDIk 4 3480 0 0 TDI resource
WmiR 54 3456 0 0 Wmi Registration info blocks
MmWe 20 3360 0 0 Work entries for writing out modified filesystem pages. , Binary: nt!mm
FSrm 26 3328 49 73880 File System Run Time , Binary: nt!fsrtl
Wmip 136 3264 165 16688 Wmi General purpose allocation
LSsh 44 3168 22 10072 share
Ica 14 3168 0 0 UNKNOWN pooltag 'Ica ', please update pooltag.txt
Mdp 8 3072 0 0 UNKNOWN pooltag 'Mdp ', please update pooltag.txt
TCIt 2 3040 0 0 TCP/IP network protocol , Binary: TCP
NpFr 75 3000 0 0 DATA_ENTRY records (read/write buffers) , Binary: npfs.sys
RxIr 3 2688 0 0 RxContext (IrpContext)
MntA 6 2680 40 3248 UNKNOWN pooltag 'MntA', please update pooltag.txt
AcpS 105 2616 2 160 ACPI Pooltags , Binary: acpi.sys
NDmo 11 2592 0 0 UNKNOWN pooltag 'NDmo', please update pooltag.txt
MmIn 16 2560 0 0 Mm inpaged io structures , Binary: nt!mm
MmDm 32 2560 0 0 deferred MmUnlock entries , Binary: nt!mm
KbdC 3 2544 0 0 Keyboard Class Driver
ScPD 5 2440 0 0 SRB_DATA allocations
NBSf 2 2280 0 0 FCB
NDdb 5 2264 0 0 DMA block , Binary: ndis.sys
Nb01 2 2208 0 0 NetBT allocations
WanO 1 2064 0 0 NdisWan Tags (PPP Framing module for Remote Access)
Io.. 1 2056 0 0 UNKNOWN pooltag ' Io', please update pooltag.txt
Mapr 1 2056 0 0 arc firmware registry routines
PXl. 1 2008 0 0 UNKNOWN pooltag ' PXl', please update pooltag.txt
PX2. 1 2008 0 0 UNKNOWN pooltag ' PX2', please update pooltag.txt
Desk 10 1920 0 0 UNKNOWN pooltag 'Desk', please update pooltag.txt
Ntff 9 1872 35456 28932096 FCB_DATA , Binary: ntfs.sys
IpEQ 1 1808 0 0 event queue , Binary: ipsec.sys
Nb27 2 1760 0 0 NetBT allocations
FLli 42 1680 0 0 per-file lock information
Nb05 10 1600 0 0 NetBT allocations
LSep 4 1568 0 0 endpoint
TCPr 19 1560 0 0 TCP request pool , Binary: TCP
CcPc 16 1536 0 0 Cache Manager Private Cache Map , Binary: nt!cc
AfdL 38 1520 0 0 Afd local address buffer , Binary: afd.sys
Wrpa 4 1440 0 0 WAN_ADAPTER_TAG
NDpb 6 1344 0 0 protocol block , Binary: ndis.sys
WanJ 4 1344 0 0 LineUpInfo
MmSy 24 1344 0 0 Mm PTE and IO tracking logs , Binary: nt!mm
DOPE 15 1320 0 0 Device Object Power Extension (po component)
ScRp 6 1296 2 168 Partition entry
MmDT 3 1272 112 8160 Mm debug , Binary: nt!mm
Hal 6 1264 0 0 Hardware Abstraction Layer , Binary: hal.dll
Adap 9 1240 0 0 Adapter objects
TCIZ 24 1224 0 0 TCP/IP network protocol , Binary: TCP
Nb07 4 1216 0 0 NetBT allocations
FstB 1 1208 0 0 ntos\fstub
CM 30 1200 0 0 Configuration Manager (registry) , Binary: nt!cm
PX3. 2 1200 0 0 UNKNOWN pooltag ' PX3', please update pooltag.txt
Vpb 12 1152 0 0 Io, vpb's
NDan 13 1152 0 0 adapter name , Binary: ndis.sys
NDco 11 1112 0 0 NDIS_TAG_CO , Binary: ndis.sys
AcdN 2 1072 0 0 TDI AcdObjectInfoG
L2T1 1 1064 0 0 ndis\l2tp / MTAG_ADAPTERCB
FSmg 3 1056 0 0 File System Run Time , Binary: nt!fsrtl
Dmio 2 1040 1 128 UNKNOWN pooltag 'Dmio', please update pooltag.txt
PTIa 1 1024 0 0 UNKNOWN pooltag 'PTIa', please update pooltag.txt
Wind 7 1008 0 0 UNKNOWN pooltag 'Wind', please update pooltag.txt
Nbt0 6 912 0 0 NetBT allocations
FSrt 1 904 0 0 File System Run Time allocations (DO NOT USE!) , Binary: nt!fsrtl
IoEr 7 904 0 0 Io error log packets , Binary: nt!io
rx.. 2 832 0 0 UNKNOWN pooltag ' rx', please update pooltag.txt
Afdr 4 832 0 0 Afd ERESOURCE buffer , Binary: afd.sys
NDwh 6 824 0 0 UNKNOWN pooltag 'NDwh', please update pooltag.txt
SeSd 7 816 15 1784 Security Descriptor , Binary: nt!se
AfdP 6 800 0 0 Afd poll info , Binary: afd.sys
Nb16 5 800 0 0 NetBT allocations
ObCi 14 784 0 0 captured information for ObCreateObject , Binary: nt!ob
Ussy 22 776 4 296 SYSTEM , Binary: win32k!xxxDesktopThread
NbtC 6 720 0 0 NetBT allocations
UlTT 10 720 0 0 Thread Tracker , Binary: http.sys
NDoa 2 704 0 0 NDIS_TAG_OID_ARRAY , Binary: ndis.sys
WanN 1 680 0 0 NdisPacketPool Desc
TCIw 1 680 0 0 TCP/IP network protocol , Binary: TCP
NDfm 6 672 0 0 UNKNOWN pooltag 'NDfm', please update pooltag.txt
aEoP 1 672 0 0 UNKNOWN pooltag 'aEoP', please update pooltag.txt
AfdF 1 664 0 0 Afd TransmitFile info , Binary: afd.sys
TDIc 8 640 0 0 TDI resource
UlNP 3 632 0 0 Non-Paged Data , Binary: http.sys
PXb. 1 608 0 0 UNKNOWN pooltag ' PXb', please update pooltag.txt
LBmb 1 584 0 0 Mailslot Buffer
RxNr 1 584 0 0 NetRoot
LBxp 1 576 0 0 Transport
Qpct 5 560 0 0 Client blocks
ObCI 4 544 0 0 object creation lookaside list , Binary: nt!ob
PTPa 1 544 0 0 UNKNOWN pooltag 'PTPa', please update pooltag.txt
ObNM 4 544 0 0 name buffer per processor lookaside pointers , Binary: nt!ob
CcWK 4 544 0 0 Kernel Cache Manager lookaside list , Binary: nt!cc
Gdwd 6 528 1 24 Gdi watchdog support objects , Binary: win32k.sys
TDIa 6 528 0 0 UNKNOWN pooltag 'TDIa', please update pooltag.txt
FatV 1 520 0 0 Fat Vcb stat bucket , Binary: fastfat.sys
MmHt 1 520 0 0 session space PTE data , Binary: nt!mm
PsQb 7 504 0 0 Process quota block , Binary: nt!ps
ArbM 21 504 0 0 ARBITER_MISC_TAG , Binary: nt!arb
UlFU 1 488 0 0 Full Tracker , Binary: http.sys
UlIC 1 488 0 0 Irp Context , Binary: http.sys
UlIR 1 488 0 0 Internal Response , Binary: http.sys
UlHR 1 488 0 0 Internal Request , Binary: http.sys
UlEB 1 488 0 0 tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; , Binary: http.sys
UlFW 1 488 0 0 Filter Write Tracker , Binary: http.sys
UlRB 1 488 0 0 Receive Buffer , Binary: http.sys
UlLL 1 488 0 0 Log File Buffer , Binary: http.sys
UlRP 1 488 0 0 Request Buffer , Binary: http.sys
UlCK 1 488 0 0 Chunk Tracker , Binary: http.sys
UlLT 1 488 0 0 Binary Log Data Buffer , Binary: http.sys
UlLS 1 488 0 0 Ansi Log Data Buffer , Binary: http.sys
LSnh 15 480 0 0 nonpaged block header
TDId 8 472 0 0 TDI resource
WanM 5 464 0 0 Connection Table
VoSc 5 456 0 0 Snapshot context allocations , Binary: volsnap.sys
UHUB 4 448 2 152 Universal Serial Bus Hub
Icp 11 440 0 0 I/O completion packets queue on a completion ports
Nbtw 3 440 0 0 NetBT allocations
TDIf 6 432 0 0 TDI resource
Job 1 432 0 0 UNKNOWN pooltag 'Job ', please update pooltag.txt
Qpph 12 416 0 0 PathHash
TCI4 1 408 0 0 TCP/IP network protocol , Binary: TCP
TCPY 1 408 0 0 SYN-TCB pool , Binary: TCP
AmlI 2 392 0 0 ACPI AMLI Pooltags
Qppt 1 392 0 0 Protocol
AcpP 5 392 0 0 ACPI Pooltags , Binary: acpi.sys
IoSh 16 384 0 0 Io shutdown packet , Binary: nt!io
TCPi 2 384 0 0 TCP/IP network protocol , Binary: TCP
IoTi 12 384 0 0 Io timers , Binary: nt!io
Call 5 360 0 0 kernel callback object signature , Binary: nt!ex
Vprt 9 360 1 128 ntos\video\port
FatF 1 352 1 352 Fat Fcbs , Binary: fastfat.sys
TCiA 4 352 0 0 TCP/IP network protocol , Binary: TCP
NtfT 4 352 0 0 SCB_SNAPSHOT , Binary: ntfs.sys
PXd. 1 344 0 0 UNKNOWN pooltag ' PXd', please update pooltag.txt
CcWk 14 336 0 0 Kernel Cache Manager lookaside list , Binary: nt!cc
Usla 3 336 0 0 LOOKASIDE , Binary: win32k!InitLockRecordLookaside
RxSc 1 336 0 0 SrvCall
UlCC 3 336 0 0 Control Channel , Binary: http.sys
ScpP 2 320 0 0 scsi PortConfig copies
ScLq 2 320 0 0 Release queue , Binary: classpnp.sys
ScFs 3 312 0 0 Mass storage driver tags
ScB4 4 304 0 0 ClassPnP misc allocations , Binary: classpnp.sys
AfdT 3 304 0 0 Afd transport info , Binary: afd.sys
Qphf 4 304 0 0 HandleFactory
Ke 1 296 1 8192 Kernel data structures
UlEP 1 296 0 0 Endpoint , Binary: http.sys
ScPq 2 296 0 0 inquiry data
TCiQ 4 288 0 0 TCP/IP network protocol , Binary: TCP
SmTp 5 280 0 0 server transport tag
Mup 1 280 75 12672 Multiple UNC provider allocations, generic , Binary: mup.sys
Nuio 2 280 0 0 UNKNOWN pooltag 'Nuio', please update pooltag.txt
NDpk 3 272 0 0 NDIS_TAG_PKT_PATTERN , Binary: ndis.sys
TCIV 2 272 0 0 TCP/IP network protocol , Binary: TCP
Npfs 1 272 0 0 Npfs Allocations , Binary: npfs.sys
MsFf 1 272 0 0 Mailslot FCB, File control block, Service side block for each created mailslot.
TCI5 1 264 0 0 TCP/IP network protocol , Binary: TCP
DrDr 3 264 0 0 UNKNOWN pooltag 'DrDr', please update pooltag.txt
MsFD 1 264 1 16 Mailslot root DCB and its name buffer
Qpcf 3 264 0 0 ClassificationFamily
Dmiq 1 264 0 0 UNKNOWN pooltag 'Dmiq', please update pooltag.txt
PXh. 2 256 0 0 UNKNOWN pooltag ' PXh', please update pooltag.txt
RxVn 1 256 0 0 VNetRoot
FLex 4 256 0 0 exclusive file lock
PpEB 1 248 0 0 PNP_POOL_EVENT_BUFFER , Binary: nt!pnp
IpLA 1 248 0 0 lookaside lists , Binary: ipsec.sys
NDfa 3 248 0 0 NDIS_TAG_FILTER_ADDR , Binary: ndis.sys
TDIu 2 248 0 0 TDI resource
AcpA 4 248 1 504 ACPI Pooltags , Binary: acpi.sys
Qprz 10 240 0 0 Rhizome
SmVr 1 240 0 0 VNetroot (special build only)
SeCL 3 240 0 0 Security CONTEXT_TAG , Binary: nt!se
PX9. 2 224 0 0 UNKNOWN pooltag ' PX9', please update pooltag.txt
TAPI 4 224 0 0 ntos\ndis\ndistapi
ScPr 2 224 0 0 resource list copy
LBtn 3 216 0 0 Transport name
SWfd 1 216 0 0 POOLTAG_DEVICE_FDOEXTENSION
LfsS 2 208 2 736 UNKNOWN pooltag 'LfsS', please update pooltag.txt
NDar 1 208 0 0 UNKNOWN pooltag 'NDar', please update pooltag.txt
NDch 1 208 0 0 UNKNOWN pooltag 'NDch', please update pooltag.txt
idle 2 208 0 0 Power Manager idle handler
NPLL 2 208 0 0 UNKNOWN pooltag 'NPLL', please update pooltag.txt
Umrx 1 200 0 0 UNKNOWN pooltag 'Umrx', please update pooltag.txt
TCIv 1 200 0 0 TCP/IP network protocol , Binary: TCP
AcpF 5 200 0 0 ACPI Pooltags , Binary: acpi.sys
UlCJ 1 192 0 0 Config Group Object Pool , Binary: http.sys
FatE 3 192 0 0 Fat EResources , Binary: fastfat.sys
FSrN 4 192 129 12384 File System Run Time , Binary: nt!fsrtl
TDIe 2 192 0 0 TDI resource
CcWq 8 192 0 0 Cache Manager Work Queue Item , Binary: nt!cc
AfdR 6 192 0 0 Afd remote address buffer , Binary: afd.sys
User 3 192 0 0 ERESOURCE , Binary: win32k!InitCreateUserCrit
NDpc 1 192 0 0 UNKNOWN pooltag 'NDpc', please update pooltag.txt
NtfV 2 192 0 0 VPB , Binary: ntfs.sys
ScLM 2 192 0 0 Media Change Detection , Binary: classpnp.sys
RxCt 2 176 4 176 connection engine transport
REMP 2 176 0 0 UNKNOWN pooltag 'REMP', please update pooltag.txt
Qppd 6 176 0 0 GenPatternDb
Acpg 1 168 0 0 ACPI Pooltags , Binary: acpi.sys
FLsh 3 168 0 0 shared file lock
MmSc 3 168 0 0 subsections used to map data files , Binary: nt!mm
LBdi 1 168 0 0 POOL_DOMAIN_INFO
NBqh 5 160 0 0 Non-blocking queue entries used to carry the real data in the queue.
Mmpv 4 160 0 0 Physical view VAD info , Binary: nt!mm
Nb39 2 160 0 0 NetBT allocations
CBRe 4 160 0 0 CallbackRegistration
NtfI 4 160 0 0 NTFS_IO_CONTEXT , Binary: ntfs.sys
FatI 2 160 0 0 Fat IrpContexts , Binary: fastfat.sys
PTCD 1 152 0 0 UNKNOWN pooltag 'PTCD', please update pooltag.txt
NbtR 1 152 0 0 NetBT allocations
LSdb 1 152 5 472 data buffer
WanF 1 152 0 0 NdisWan Tags (PPP Framing module for Remote Access)
TCij 1 152 0 0 TCP/IP network protocol , Binary: TCP
PXg. 2 144 0 0 UNKNOWN pooltag ' PXg', please update pooltag.txt
Scs$ 2 144 0 0 Tag for pnp class driver's SRB lookaside list
MmHi 3 144 0 0 Mm image entry - allocated per session , Binary: nt!mm
PpUB 1 144 0 0 PNP_USER_BLOCK_TAG , Binary: nt!pnp
WanS 2 144 0 0 AfCB/SapCB/VcCB
MmDb 1 144 0 0 NtMapViewOfSection service , Binary: nt!mm
PX5. 2 144 0 0 UNKNOWN pooltag ' PX5', please update pooltag.txt
TDIg 5 144 0 0 TDI resource
Acpi 1 136 0 0 ACPI Pooltags , Binary: acpi.sys
UlSO 1 136 0 0 Site Counter Entry , Binary: http.sys
Wrps 2 128 0 0 WAN_STRING_TAG
IdeX 2 128 0 0 PCI IDE
NBSn 1 128 0 0 copy of user NCB
FatN 2 128 0 0 Fat Nonpaged Fcbs , Binary: fastfat.sys
Prcr 4 128 5 352 Processr hal driver allocations , Binary: processr.sys
TCPa 4 128 0 0 TCP/IP network protocol , Binary: TCP
RBrg 1 120 0 0 RedBook Filter Driver, static allocations
NDcs 5 120 0 0 UNKNOWN pooltag 'NDcs', please update pooltag.txt
UlAO 1 120 0 0 App Pool Object , Binary: http.sys
Mmpr 3 120 0 0 Mm physical VAD roots , Binary: nt!mm
Nb17 1 120 0 0 NetBT allocations
TMpf 1 120 0 0 UNKNOWN pooltag 'TMpf', please update pooltag.txt
Wrpi 1 120 0 0 WAN_INTERFACE_TAG
WanI 1 112 0 0 IoPacket
Gla@ 1 112 163 20864 Gdi handle manager specific object types allocated from lookaside memory: defined in w32\ntgdi\inc\ntgdistr.h , Binary: win32k.sys
Gla4 1 112 229 40304 Gdi handle manager specific object types allocated from lookaside memory: defined in w32\ntgdi\inc\ntgdistr.h , Binary: win32k.sys
Gla1 1 112 174 278400 Gdi handle manager specific object types allocated from lookaside memory: defined in w32\ntgdi\inc\ntgdistr.h , Binary: win32k.sys
Gla5 1 112 246 96432 Gdi handle manager specific object types allocated from lookaside memory: defined in w32\ntgdi\inc\ntgdistr.h , Binary: win32k.sys
TOBJ 1 112 0 0 UNKNOWN pooltag 'TOBJ', please update pooltag.txt
Gla8 1 112 27 4320 Gdi handle manager specific object types allocated from lookaside memory: defined in w32\ntgdi\inc\ntgdistr.h , Binary: win32k.sys
Gla: 1 112 97 63632 Gdi handle manager specific object types allocated from lookaside memory: defined in w32\ntgdi\inc\ntgdistr.h , Binary: win32k.sys
Gla; 1 112 0 0 Gdi handle manager specific object types allocated from lookaside memory: defined in w32\ntgdi\inc\ntgdistr.h , Binary: win32k.sys
AcpO 2 104 0 0 ACPI Pooltags , Binary: acpi.sys
TCIa 1 104 0 0 TCP/IP network protocol , Binary: TCP
VoSt 1 104 0 0 Temp table allocations , Binary: volsnap.sys
UlFT 1 104 0 0 Filter Channel , Binary: http.sys
SmMt 2 104 0 0 mailslot buffer (special build only)
Afdh 2 96 0 0 Afd address list change buffer , Binary: afd.sys
TCIy 2 96 0 0 TCP/IP network protocol , Binary: TCP
MupI 2 96 0 0 Windows Server 2003 and prior versions: DFS Irp Context allocation , Binary: mup.sys
L2Ti 2 96 0 0 ndis\l2tp / MTAG_UTIL
Fatv 1 96 0 0 Fat events , Binary: fastfat.sys
ScPI 1 96 0 0 Init data chain
UlWI 1 88 0 0 Work Item , Binary: http.sys
UlLF 1 88 0 0 Log File Entry , Binary: http.sys
mEoP 1 88 0 0 UNKNOWN pooltag 'mEoP', please update pooltag.txt
RBev 1 88 0 0 RedBook Filter Driver, static allocations
PpEL 1 88 0 0 PNP_DEVICE_EVENT_LIST_TAG , Binary: nt!pnp
NDst 3 88 0 0 NDIS_TAG_STRING , Binary: ndis.sys
ScCF 1 88 0 0 ClassPnP misc allocations , Binary: classpnp.sys
ScC9 1 80 0 0 ClassPnP misc allocations , Binary: classpnp.sys
Gfsm 2 80 0 0 Gdi Fast mutex
UlTD 1 80 0 0 UL_TRANSPORT_ADDRESS , Binary: http.sys
FLln 2 80 0 0 shared lock tree node
Flop 2 80 1 40 floppy driver
ScRV 2 80 2 256 Volume entry
PnPi 1 80 0 0 UNKNOWN pooltag 'PnPi', please update pooltag.txt
FSro 2 80 2 80 File System Run Time , Binary: nt!fsrtl
Cdic 1 72 0 0 CDFS Irp Context , Binary: cdfs.sys
Acpt 1 72 0 0 ACPI Pooltags , Binary: acpi.sys
UlAP 1 72 0 0 App Pool Process , Binary: http.sys
Ntfc 1 72 4882 351504 CCB_DATA , Binary: ntfs.sys
Wrpc 1 72 0 0 WAN_CONN_TAG
TCIm 1 64 0 0 TCP/IP network protocol , Binary: TCP
MsFg 1 64 0 0 Mailslot global resource
DfsP 1 64 1 2352 UNKNOWN pooltag 'DfsP', please update pooltag.txt
Gini 3 64 0 0 Gdi fast mutex
MmEx 2 64 0 0 Mm events , Binary: nt!mm
RsfD 1 64 0 0 UNKNOWN pooltag 'RsfD', please update pooltag.txt
SmEc 1 64 0 0 echo buffer (special build only)
CMpe 2 64 0 0 registry post events , Binary: nt!cm
RxCa 2 64 0 0 connection engine address
NtFf 1 56 7 131264 FsCtrl.c , Binary: ntfs.sys
Nb37 1 56 0 0 NetBT allocations
TSQ 1 56 0 0 UNKNOWN pooltag ' TSQ', please update pooltag.txt
PTIw 1 48 0 0 UNKNOWN pooltag 'PTIw', please update pooltag.txt
ScPB 1 48 0 0 Queuetag BitMap
LSmi 1 48 0 0 BlockTypeMisc
sidg 2 48 0 0 GDI spooler events
IoUs 2 48 0 0 I/O SubSystem completion Context Allocation , Binary: nt!io
Qpfd 2 48 0 0 FragmentDb
NtfR 2 48 0 0 READ_AHEAD_THREAD , Binary: ntfs.sys
TC2r 2 48 0 0 TCP/IP network protocol , Binary: TCP
UlFP 1 48 0 0 Filter Process , Binary: http.sys
COMX 2 48 12 1152 serial driver allocations , Binary: serial.sys
TCiJ 1 40 0 0 TCP/IP network protocol , Binary: TCP
TCiK 1 40 0 0 TCP/IP network protocol , Binary: TCP
ScPm 1 40 0 0 address mapping lists
Nbta 1 40 0 0 NetBT allocations
Qppi 1 40 0 0 Pending Irp structures
Usbg 1 40 0 0 DEBUG , Binary: win32k!xxxLogClipData
Uspp 1 40 5 816 PNP , Binary: win32k!AllocateAndLinkHidTLCInf
Gdde 1 40 0 0 Gdi ddraw event
Nb02 1 40 0 0 NetBT allocations
Uspo 1 40 0 0 POWER , Binary: win32k!QueuePowerRequest
ScCI 1 32 0 0 sense info buffers , Binary: classpnp.sys
Nbtg 2 32 0 0 NetBT allocations
Usev 1 32 0 0 EVENT , Binary: win32k!xxxPollAndWaitForSingleO
Nb36 1 32 0 0 NetBT allocations
PSwt 1 32 0 0 Power switch structure , Binary: nt!po
ScDs 1 32 0 0 start device paths
AmlR 1 32 0 0 ACPI AMLI Pooltags
MmSe 1 32 0 0 Mm secured VAD allocation , Binary: nt!mm
TDIv 2 32 0 0 TDI resource
VadF 1 32 0 0 VADs created by a FreeVM splitting , Binary: nt!mm
Psta 2 32 0 0 Power management system state , Binary: nt!ps
MmMl 1 32 0 0 physical memory range information , Binary: nt!mm
SmSr 1 32 0 0 Server (special build only)
jEoP 1 24 0 0 UNKNOWN pooltag 'jEoP', please update pooltag.txt
Fsrc 1 24 0 0 Filesystem recognizer (fsrec.sys) , Binary: fsrec.sys
TCiS 1 24 0 0 TCP/IP network protocol , Binary: TCP
FLwl 1 24 0 0 waiting lock
Evel 1 24 0 0 EFS file system filter driver lookaside list
vPrt 1 24 17 2816 UNKNOWN pooltag 'vPrt', please update pooltag.txt
iEoP 1 24 0 0 UNKNOWN pooltag 'iEoP', please update pooltag.txt
ApcS 1 24 0 0 UNKNOWN pooltag 'ApcS', please update pooltag.txt
Nb03 1 16 0 0 NetBT allocations
Sc?? 1 16 0 0 Mass storage driver tags
fEoP 1 16 0 0 UNKNOWN pooltag 'fEoP', please update pooltag.txt
Nbt8 1 16 0 0 NetBT allocations
ScPG 1 16 0 0 Global memory
Isap 1 16 2 192 Pnp Isa bus extender
CM39 0 0 576 158208 Internal Configuration manager allocations , Binary: nt!cm
LfsI 0 0 2 131072 Lfs allocations
WmGE 0 0 1 49152 Wmi GuidEntry chunks
CM11 0 0 2 8192 Internal Configuration manager allocations , Binary: nt!cm
Usac 0 0 6 584 ACCEL , Binary: win32k!_CreateAcceleratorTable
FatB 0 0 1 2512 Fat allocation bitmaps , Binary: fastfat.sys
ObDi 0 0 1002 16032 object directory , Binary: nt!ob
Uswd 0 0 2 352 WINDOW , Binary: win32k!xxxCreateWindowEx
CM27 0 0 11 4248 Internal Configuration manager allocations , Binary: nt!cm
LBpn 0 0 3 120 Paged Name
ArbA 0 0 21 86016 ARBITER_ALLOCATION_STATE_TAG , Binary: nt!arb
GreA 0 0 1 32 UNKNOWN pooltag 'GreA', please update pooltag.txt
SWbr 0 0 1 104 bus reference
CMAl 0 0 53 217088 internal registry memory allocator pool tag , Binary: nt!cm
Uskb 0 0 1 80 KBDLAYOUT , Binary: win32k!xxxLoadKeyboardLayoutEx
Usqu 0 0 117 30888 Q , Binary: win32k!InitQEntryLookaside
RAGE 0 0 35 125752 UNKNOWN pooltag 'RAGE', please update pooltag.txt
Usdc 0 0 18 864 DCE , Binary: win32k!CreateCacheDC
Gpfe 0 0 101 19152 UNKNOWN pooltag 'Gpfe', please update pooltag.txt
GFil 0 0 2 168 Gdi engine descriptor list
Gcsl 0 0 1 488 Gdi string resource script names
LBbn 0 0 3 176 Name
Usti 0 0 114 40128 THREADINFO , Binary: win32k!AllocateW32Thread
LSfn 0 0 2 64 BlockTypeFSName
Lfs 0 0 61 5848 Lfs allocations
Uscl 0 0 20 1320 CLASS , Binary: win32k!ClassAlloc
CMNb 0 0 1835 90152 notification block pool tag , Binary: nt!cm
CMVa 0 0 4895 290320 value cache value tag , Binary: nt!cm
UlCE 0 0 1 96 Config Group Tree Entry , Binary: http.sys
SeFS 0 0 1 16 SEP_FILE_SYSTEM_NOTIFY_CONTEXT , Binary: nt!se
CM32 0 0 12 49152 Internal Configuration manager allocations , Binary: nt!cm
CM26 0 0 11 90112 Internal Configuration manager allocations , Binary: nt!cm
Pp 0 0 313 24632 UNKNOWN pooltag 'Pp ', please update pooltag.txt
CMIn 0 0 232 6768 index hint pool tag , Binary: nt!cm
Gmap 0 0 1 304 Gdi font map signature table
Dire 0 0 35 7280 Directory objects
FatW 0 0 1 24 Fat FAT windowing structure , Binary: fastfat.sys
NtFS 0 0 341 82984 SecurSup.c , Binary: ntfs.sys
Ussm 0 0 4 288 SMS , Binary: win32k!InitSMSLookaside
CM10 0 0 15 21000 Internal Configuration manager allocations , Binary: nt!cm
SmAd 0 0 1 208 session setup/admin exchange
Dacl 0 0 1 96 Temp allocations for object DACLs
AUva 0 0 1 48 UNKNOWN pooltag 'AUva', please update pooltag.txt
NtFd 0 0 102 9680 DirCtrl.c , Binary: ntfs.sys
NtfM 0 0 33 1584 NTFS_MCB_ENTRY , Binary: ntfs.sys
Ussw 0 0 1 360 SWP , Binary: win32k!_BeginDeferWindowPos
UlDR 0 0 1 24 Deferred Remove Item , Binary: http.sys
PsIm 0 0 108 2592 Thread impersonation (PS_IMPERSONATE_INFORMATION) , Binary: nt!ps
Glnk 0 0 373 5968 Gdi PFELINK
LBpt 0 0 1 408 Paged transport
LBbs 0 0 5 144 Browser server
CMpb 0 0 411 19728 registry post blocks , Binary: nt!cm
thdd 0 0 1 20480 DirectDraw/3D handle manager table
NtfS 0 0 6 2448 SCB_INDEX , Binary: ntfs.sys
SeLs 0 0 9 288 Security Logon Session , Binary: nt!se
UlCL 0 0 2 672 Config Group LogDir , Binary: http.sys
RxMx 0 0 3 264 minirdr dispatch table
Gbaf 0 0 51 35904 UNKNOWN pooltag 'Gbaf', please update pooltag.txt
CMVI 0 0 720 36320 value index cache tag , Binary: nt!cm
Urdr 0 0 6 240 REDIRECT , Binary: win32k!SetRedirectionBitmap
Key 0 0 1788 185880 Key objects
LBsl 0 0 1 32 Browser server list
LSpc 0 0 37 6512 paged connection
SWid 0 0 1 88 device ID
FatT 0 0 1 72 Fat directory allocation bitmaps , Binary: fastfat.sys
ScPT 0 0 1 112 interface mapping
UlCY 0 0 1 24 Connection Count Entry , Binary: http.sys
Gh05 0 0 183 1199560 UNKNOWN pooltag 'Gh05', please update pooltag.txt
CMDc 0 0 1 24576 Configuration Manager Cache (registry) , Binary: nt!cm
Vga 0 0 1 3208 UNKNOWN pooltag 'Vga ', please update pooltag.txt
Gxlt 0 0 8 696 Gdi Xlate
Gddf 0 0 1 56 Gdi ddraw driver heaps
Afdt 0 0 2 320 Afd transport address buffer , Binary: afd.sys
ObNm 0 0 1025 53760 object names , Binary: nt!ob
UMDM 0 0 1 120 UNKNOWN pooltag 'UMDM', please update pooltag.txt
FSim 0 0 13378 1712384 File System Run Time Mcb Initial Mapping Lookaside List , Binary: nt!fsrtl
CM25 0 0 6 98304 Internal Configuration manager allocations , Binary: nt!cm
SePr 0 0 3 104 Security Privilege Set , Binary: nt!se
Gdrs 0 0 16 39704 Gdi GDITAG_DRVSUP
FLfl 0 0 42 3024 exported (non-private) file lock
Gfnt 0 0 35 26880 UNKNOWN pooltag 'Gfnt', please update pooltag.txt
NtfF 0 0 28575 26746200 FCB_INDEX , Binary: ntfs.sys
CM17 0 0 11 90112 Internal Configuration manager allocations , Binary: nt!cm
Usci 0 0 3 456 CLIENTTHREADINFO , Binary: win32k!InitSystemThread
UsDI 0 0 4 1152 DEVICEINFO , Binary: win32k!CreateDeviceInfo
Sdba 0 0 560 47672 Application compatibility Sdb* allocations
MmSt 0 0 78264 145090032 Mm section object prototype ptes , Binary: nt!mm
CMnb 0 0 210 11760 registry notify blocks , Binary: nt!cm
Gglb 0 0 1 4096 Gdi temp buffer
Gdev 0 0 1 232 Gdi GDITAG_DEVMODE
SWdr 0 0 2 272 device reference
RxMs 0 0 1 24 misc.
SmNr 0 0 1 40 NetRoot (special build only)
NpfF 0 0 66 7920 Npfs Allocations , Binary: npfs.sys
Gh0< 0 0 101 3232 UNKNOWN pooltag 'Gh0<', please update pooltag.txt
SeAc 0 0 6 624 Security ACL , Binary: nt!se
Ntfs 0 0 2 672 SCB_DATA , Binary: ntfs.sys
Ppin 0 0 1 40 plug-and-play initialization , Binary: nt!pnp
Ttfd 0 0 191 337416 TrueType Font driver
Usih 0 0 9 288 IMEHOTKEY , Binary: win32k!SetImeHotKey
ObSc 0 0 206 30808 Object security descriptor cache block , Binary: nt!ob
WmDS 0 0 1 8192 Wmi DataSource chunks
AtmA 0 0 498 31520 Atoms
Gffv 0 0 101 7272 Gdi FONTFILEVIEW
ArbR 0 0 42 1344 ARBITER_RANGE_LIST_TAG , Binary: nt!arb
LSac 0 0 4 168 BlockTypeAdminCheck
Gfsb 0 0 1 8192 Gdi font sustitution list
LStr 0 0 13 2288 transaction
Vtfd 0 0 4 1088 Font file/context
Obtb 0 0 142 328624 object tables via EX handle.c , Binary: nt!ob
Uskt 0 0 1 2680 KBDTABLE , Binary: win32k!ReadLayoutFile
IoNm 0 0 36566 4656448 Io parsing names , Binary: nt!io
MmSg 0 0 1 72 Mm segments , Binary: nt!mm
cbuf 0 0 1 24 UNKNOWN pooltag 'cbuf', please update pooltag.txt
Usse 0 0 1 32 SECURITY , Binary: win32k!SetDisconnectDesktopSecu
LSsr 0 0 22 616 search
CM24 0 0 1 4096 Internal Configuration manager allocations , Binary: nt!cm
Uspi 0 0 164 24208 PROCESSINFO , Binary: win32k!MapDesktop
Gh09 0 0 1 616 UNKNOWN pooltag 'Gh09', please update pooltag.txt
Ghab 0 0 196 21952 UNKNOWN pooltag 'Ghab', please update pooltag.txt
MmSm 0 0 45138 2527728 segments used to map data files , Binary: nt!mm
Usqm 0 0 18 1008 QMSG , Binary: win32k!InitQEntryLookaside
LSsd 0 0 18 2016 BlockTypeShareSecurityDescriptor
NtfE 0 0 105 21000 INDEX_CONTEXT , Binary: ntfs.sys
ScPV 0 0 1 40 Device map allocations
CM16 0 0 65 278528 Internal Configuration manager allocations , Binary: nt!cm
ScDN 0 0 4 208 disk name code
Ntfm 0 0 2 928 NTFS_MCB_ARRAY , Binary: ntfs.sys
NpFD 0 0 1 112 DCB, directory block , Binary: npfs.sys
Gtmw 0 0 23 1840 Gdi TMW_INTERNAL
NpFC 0 0 2 48 ROOT_DCB CCB , Binary: npfs.sys
Ntfl 0 0 9796 1567360 LCB , Binary: ntfs.sys
Gcac 0 0 24 125216 Gdi glyph cache
NpFs 0 0 74 5328 Client security context , Binary: npfs.sys
CMSb 0 0 1 4096 internal stash buffer pool tag , Binary: nt!cm
ObDm 0 0 5 280 object device map , Binary: nt!ob
MsvC 0 0 2 752 Msv/Ntlm client package
CM7 0 0 2 64 Internal Configuration manager allocations , Binary: nt!cm
HT40 0 0 1 8192 UNKNOWN pooltag 'HT40', please update pooltag.txt
GDev 0 0 5 16880 Gdi pdev
Ushk 0 0 20 640 HOTKEY , Binary: win32k!_RegisterHotKey
IoFs 0 0 2 48 Io shutdown packet , Binary: nt!io
LSss 0 0 2 368 session
Strg 0 0 25 1696 Dynamic Translated strings
Usd9 0 0 1 48 DDE9 , Binary: win32k!xxxCsDdeInitialize
Senm 0 0 6 272 Serenum (RS-232 serial bus enumerator)
Ntfo 0 0 28565 3989416 SCB_INDEX normalized named buffer , Binary: ntfs.sys
ScPA 0 0 1 24 Access Ranges
RRle 0 0 432 20736 RTL_RANGE_LIST_ENTRY_TAG
CMVw 0 0 588 28224 registry mapped view of file , Binary: nt!cm
CMSc 0 0 233 60448 security cache pooltag , Binary: nt!cm
Gpft 0 0 2 480 Gdi font table
ScPR 0 0 1 136 Scsiport
AcpM 0 0 2 152 ACPI Pooltags , Binary: acpi.sys
TunP 0 0 11 2048 Tunnel cache oddsized pool-allocated elements
CMDa 0 0 1456 191392 value data cache pool tag , Binary: nt!cm
SeLS 0 0 1 72 Security Logon Session tracking array , Binary: nt!se
MsFN 0 0 1 72 Mailslot FCB name buffer, name for each created mailslot
AtmT 0 0 8 4928 Atom tables
Uswl 0 0 1 280 WINDOWLIST , Binary: win32k!BuildHwndList
Toke 0 0 140 125456 Token objects , Binary: nt!se
Ustx 0 0 4 152 TEXT , Binary: win32k!NtUserDrawCaptionTemp
WmIS 0 0 1 118784 Wmi InstanceSet chunks
ScDg 0 0 2 2096 update disk geometry paths
VoSs 0 0 1 128 Short term allocations , Binary: volsnap.sys
Gh08 0 0 8 8016 UNKNOWN pooltag 'Gh08', please update pooltag.txt
NtfD 0 0 2 336 DEALLOCATED_RECORDS , Binary: ntfs.sys
Gdcf 0 0 52 2912 UNKNOWN pooltag 'Gdcf', please update pooltag.txt
Gebr 0 0 3 1008 Gdi ENGBRUSH
CM29 0 0 10 81920 Internal Configuration manager allocations , Binary: nt!cm
Ppre 0 0 89 10544 resource allocation and translation , Binary: nt!pnp
Gspr 0 0 1 304 Gdi sprite grow range
Ppio 0 0 3 288 plug-and-play IO system APIs , Binary: nt!pnp
Gddp 0 0 1 96 Gdi ddraw driver caps
ScCs 0 0 1 48 ClassPnP misc allocations , Binary: classpnp.sys
VMem 0 0 8 5922816 Volume Manager , Binary: volmgr.sys
Usvl 0 0 1 32 VWPL , Binary: win32k!VWPLAdd
WmMR 0 0 1 544 Wmi MofResouce chunks
CM45 0 0 3 72 Internal Configuration manager allocations , Binary: nt!cm
Uscu 0 0 143 13728 CURSOR , Binary: win32k!_CreateEmptyCursorObject
Ggdv 0 0 6 704 Gdi GDITAG_GDEVICE
Gpff 0 0 101 19248 Gdi physical font file
Gpat 0 0 4 16160 UNKNOWN pooltag 'Gpat', please update pooltag.txt
UlHT 0 0 1 8392704 Hash Table , Binary: http.sys
ObHd 0 0 75 3456 object handle count data base , Binary: nt!ob
SeSi 0 0 28 664 Security SID , Binary: nt!se
Uskf 0 0 1 104 KBDFILE , Binary: win32k!LoadKeyboardLayoutFile
HT1H 0 0 1 57344 UNKNOWN pooltag 'HT1H', please update pooltag.txt
Uscb 0 0 3 128 CLIPBOARD , Binary: win32k!_ConvertMemHandle
CM19 0 0 1 368 Internal Configuration manager allocations , Binary: nt!cm
FatS 0 0 1 48 Fat stashed Bpb , Binary: fastfat.sys
PsTp 0 0 412 9888 Thread termination port block , Binary: nt!ps
LpcM 0 0 4 1440 Local procedure call message blocks
Bmfd 0 0 35 82984 Font related stuff
NtFC 0 0 16 1120 Create.c , Binary: ntfs.sys
ScRt 0 0 1 40 Table entry
Gh04 0 0 10 4768 UNKNOWN pooltag 'Gh04', please update pooltag.txt
WMca 0 0 1 792 WMI MCA Handling
NtFB 0 0 10 17864 BitmpSup.c , Binary: ntfs.sys
Symt 0 0 127 7232 Symbolic link target strings
Ggls 0 0 173 12776 Gdi glyphset
Ppsu 0 0 194 9256 plug-and-play subroutines for the I/O system , Binary: nt!pnp
CM13 0 0 1 4096 Internal Configuration manager allocations , Binary: nt!cm
Symb 0 0 127 10160 Symbolic link objects
CM22 0 0 1 768 Internal Configuration manager allocations , Binary: nt!cm
ArbL 0 0 42 11088 ARBITER_ORDERING_LIST_TAG , Binary: nt!arb
NtFI 0 0 102 13072 IndexSup.c , Binary: ntfs.sys
NDse 0 0 5 928 UNKNOWN pooltag 'NDse', please update pooltag.txt
Gsp 0 0 14 2576 Gdi sprite
NtfC 0 0 239 28680 CCB , Binary: ntfs.sys
ScC1 0 0 2 240 ClassPnP misc allocations , Binary: classpnp.sys
CM28 0 0 1 4096 Internal Configuration manager allocations , Binary: nt!cm
Ustm 0 0 20 1120 TIMER , Binary: win32k!InternalSetTimer
AfdX 0 0 104 29120 Afd context buffer , Binary: afd.sys
Cbrb 0 0 1 24 UNKNOWN pooltag 'Cbrb', please update pooltag.txt
SmMs 0 0 5 1064 misc.
Keye 0 0 1 64 UNKNOWN pooltag 'Keye', please update pooltag.txt
KrbC 0 0 3 184 Kerberos Client package
CM35 0 0 11 466944 Internal Configuration manager allocations , Binary: nt!cm
CMCa 0 0 2 16384 Configuration Manager Cache (registry) , Binary: nt!cm
UlCH 0 0 1 80 Config Group Tree Header , Binary: http.sys
UlPS 0 0 1 32 tags. Note: In-use tags are of the form "Ul??" or "Uc??".and Free tags are of the form "uL??" or "uC??"; , Binary: http.sys
Ifs 0 0 1 112 Default file system allocations (user's of ntifs.h)
Sect 0 0 979 86264 Section objects
Usct 0 0 4 192 CHECKPT , Binary: win32k!CkptRestore
Ppen 0 0 54 5416 routines to perform device enumeration , Binary: nt!pnp
SWda 0 0 1 40 POOLTAG_DEVICE_ASSOCIATION
LSbf 0 0 1 136 buffer descriptor
Gldv 0 0 8 4832 Gdi Ldev
Ggb 0 0 23 45888 Gdi glyph bits
PoSL 0 0 2 32 Power shutdown event list
Fatx 0 0 2 80 Fat delayed close contexts , Binary: fastfat.sys
IoCc 0 0 222 3552 Io completion context , Binary: nt!io
Fatn 0 0 1 24 Fat filename buffer , Binary: fastfat.sys
Ghas 0 0 3 1320 UNKNOWN pooltag 'Ghas', please update pooltag.txt
TOTAL 401902 36401328 437116 289889312
 
Upvote 0 Downvote
It doesn't look like non-paged pool is exhausted. What do the IRPs look like?

 
Upvote 0 Downvote
Good luck!!!

Irp [ Thread ] irpStack: (Mj,Mn) DevObj [Driver] MDL Process
8769c4d8 [895ff020] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
Page 76ab not present in the dump file. Type ".hh dbgerr004" for details
Page 7708 not present in the dump file. Type ".hh dbgerr004" for details
87751f68 [89593580] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
Page 775b not present in the dump file. Type ".hh dbgerr004" for details
Page 776d not present in the dump file. Type ".hh dbgerr004" for details
Page 7770 not present in the dump file. Type ".hh dbgerr004" for details
877a3938 [89a763d0] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
878f1be0 [88f948c0] irpStack: ( e, 0) 89b7fc50 [ \Driver\WMIxWDM]
878fddc0 [8962d530] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
8790e190 [8959e6c0] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
8796fc10 [899edc90] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
87999070 [8959e440] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
87e79b08 [89915798] irpStack: ( e, 9) 89a9d598 [ \Driver\AFD]
87f99b68 [8926f740] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
88113008 [899edc90] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
88197918 [899a93c0] irpStack: ( e, 0) 897fc988 [ \Driver\NetBT] 0x897a8ad0
881a06c8 [897553c0] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
8821a228 [87888c48] irpStack: ( e, 3) 89a9d598 [ \Driver\AFD]
883a5600 [895ff020] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
883e2380 [8959e440] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
88477480 [87c01c80] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896ff878
885c59f0 [898f9020] irpStack: ( e, 9) 89a9d598 [ \Driver\AFD]
885d1d60 [8926f740] irpStack: ( c, 2) 899043e8 [ \FileSystem\Ntfs]
8873a800 [8926f740] irpStack: ( d, 0) 899043e8 [ \FileSystem\Ntfs]
88817c40 [89a763d0] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
8886a008 [891f2020] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
88aa2168 [89621280] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
88aa6c78 [8968d020] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
88c0a840 [899fdda0] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
88c27db8 [8959e440] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
88d661e8 [899b8a00] irpStack: ( e, 9) 89a9d598 [ \Driver\AFD]
88d8a3c8 [8968d020] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
88da12e0 [899fdda0] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
88e12e80 [89ac7020] irpStack: ( e, 0) 897fc988 [ \Driver\NetBT] 0x897a8ad0
88e90920 [89a9e600] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
88ecf848 [89a763d0] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
88fd3c48 [8959e440] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
8901f9d8 [89255be0] irpStack: ( e, 3) 89a9d598 [ \Driver\AFD]
8910b550 [89a9e600] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
8910f198 [895eebe0] irpStack: ( e, 9) 89a9d598 [ \Driver\AFD]
891631b8 [8926f740] irpStack: ( d, 0) 89ad2558 [ \FileSystem\Ntfs]
891ac4a0 [899edc90] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
891b2e48 [899edc90] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
891b3378 [899edc90] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
891b9648 [89757650] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
Page 91bd not present in the dump file. Type ".hh dbgerr004" for details
891bec88 [8926f740] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
891c0350 [895b9020] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
891c1e50 [8926e020] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
891c3008 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
891c3480 [8968d020] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
891df5e8 [8961a020] irpStack: ( e, 9) 89a9d598 [ \Driver\AFD]
8921de58 [89a974e8] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8921ee80 [89606da0] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
89220a38 [8968d020] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89223338 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89224838 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
8922d208 [899edc90] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
8923a5a0 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89242be8 [899edc90] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
Page 9246 not present in the dump file. Type ".hh dbgerr004" for details
89247db0 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
8924e390 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
892524a8 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89252a50 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89255e70 [8960abe0] irpStack: ( e, 0) 897a4388 [ \FileSystem\MRxSmb] 0x89742350
8926b280 [89a974e8] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8926c458 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
8926c690 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
8926cbc8 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
8926d3f8 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
89270008 [89681908] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89270220 [89681908] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
892707a0 [89681908] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89270f68 [89644020] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
8956e008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x001c0707
Page 956f not present in the dump file. Type ".hh dbgerr004" for details
89572008 [89681908] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89572ac8 [89681908] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89585008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00610048
89588828 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89597008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00700005
89598848 [89653a20] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
8959dcb0 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
895a4a68 [89204020] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
895a4c48 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895a53d8 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895a5590 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895a5a38 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895a6448 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895abbb0 [899f83c8] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
895b1008 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895b11b0 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895b1688 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895b1b60 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895b2688 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895b2b60 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895b3368 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895b3840 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895b4238 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895b43f0 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895b4768 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895b5118 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895b52d0 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895b55b0 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895b5a88 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895b61f0 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895b63a8 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895b7148 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895bb008 [899c2320] irpStack: ( 3, 0) 899768c0 [ \Driver\TermDD]
895bc008 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
895bc240 [89220da0] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
895bd4a0 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895bd658 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895bdb30 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895be0e0 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895be298 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895be770 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895bec48 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895bf3b8 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895bf890 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895c03c0 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895c05a8 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895c0bc8 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895c1428 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895c15e0 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895c1a88 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895c2490 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895c25b8 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895c2928 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895c3ed0 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895c4008 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895c42b0 [89681908] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
895c4dd8 [89681908] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
895cc638 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
895ce958 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
895e78f0 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
895e8c48 [89a974e8] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
895ea008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0xf728a29c
895eb3f0 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
895ebdf8 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
895eeb00 [89227438] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
895f0898 [896485e0] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
895f1bf0 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
895f3008 [89a9e600] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
895fbc88 [895fb6a0] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
895fe1d8 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89605408 [8999d020] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
89606008 [896edda0] irpStack: ( 3, 0) 89973030 [ \Driver\Kbdclass]
896061a8 [8979ab48] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8960a968 [891c3768] irpStack: ( e, 0) 89a99730 [ \Driver\NDProxy]
8960c750 [8960abe0] irpStack: ( e, 0) 897a4388 [ \FileSystem\MRxSmb]
8960d910 [89a763d0] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89610008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
89610568 [89690470] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89614a08 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89617008 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89619c58 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
896218c8 [897648a0] irpStack: ( d, 0) 89b1fe58 [ \FileSystem\DfsDriver]
89624a38 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89624e48 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89625e48 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89627110 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
896272c8 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
896277a0 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
89627c48 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
89628210 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
89628588 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
8962d008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x89ad2638
8962d328 [8979ab48] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89631178 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
8963d748 [89681908] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89640008 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
896415b8 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89641a98 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89644460 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
896445e8 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
89647790 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
89648008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
89649eb8 [8968d020] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
8964e008 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
8964f628 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
89651008 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89652348 [89a08138] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
896526e0 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
89656b50 [89652da0] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8965b688 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
8965d008 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
8965e008 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89661718 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89661cc0 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89663138 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
896644e8 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
896655c8 [896b8da0] irpStack: ( e,2d) 89a9d598 [ \Driver\AFD]
89666008 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89666990 [89681908] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
8966de48 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89670e48 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
8967b780 [89a974e8] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8967bae8 [8979ab48] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8967e8e0 [8979ab48] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8967eda8 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
8967fb28 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
8967fcc8 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
8967fe68 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
896806c8 [8996a808] irpStack: ( e, 0) 897f89b0 [ \Driver\Tcpip]
89683450 [89593580] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
89684548 [89a08770] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8968b008 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
8968e368 [8979ab48] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8968e9a8 [8968d020] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
8968ea48 [8979ab48] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89695bd8 [899edc90] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
8969a230 [896aada0] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
896a1250 [89681908] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
896a1ae8 [8960abe0] irpStack: ( e, 0) 897a4388 [ \FileSystem\MRxSmb]
896a86d8 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
896a8e48 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
896aa008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x001c0707
896b0008 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
896b2bf0 [89925510] irpStack: ( e,2d) 89a9d598 [ \Driver\AFD]
896b8af0 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
896b9008 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
896c09a8 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
896c4008 [89653a20] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
896d53f0 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00700005
896d5610 [896d5a48] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
896d7008 [8978ac58] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x89a7e6b8
896d8008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
896d8ec0 [895a7b20] irpStack: ( d, 0) 89b1fe58 [ \FileSystem\DfsDriver]
896d9d10 [89712368] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
896e9108 [899a5980] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
896e9498 [898fc238] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
896ed1f8 [89a974e8] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
896ef430 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
896f17b8 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000001
896f2008 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
896f6f68 [892205c8] irpStack: ( e, 0) 897e8670 [ \Driver\NdisWan]
896f7778 [89a9e600] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
896f7d00 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x896ff878
896fc008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
896fc950 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
896fd008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x896474d8
896fe6c0 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
8970cbb8 [898f2678] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89712008 [89a93650] irpStack: ( e,2d) 89a9d598 [ \Driver\AFD]
89712c38 [89ac7488] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
89713538 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
89714838 [899bada0] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89716288 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
89716428 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
897165c8 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
89716768 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
89716b28 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
89716cc8 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
89716e68 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
897173f0 [89681908] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
89717518 [8960abe0] irpStack: ( e, 0) 897a4388 [ \FileSystem\MRxSmb]
89717868 [8961ab20] irpStack: ( e, 0) 897f89b0 [ \Driver\Tcpip]
89717a28 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
89717c48 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
89717e68 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
89718e70 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x001c0707
8971ad00 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
8971b008 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
8971d008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x896474d8
8971d300 [899c0c10] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8971f008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x000102fd
89721008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
89723008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00040001
89724008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
89725a40 [8968d020] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
89726008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
89728008 [89664be0] irpStack: ( e, 9) 89a9d598 [ \Driver\AFD]
8972a008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
8972ae90 [89a342e8] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
8972c008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x02070003
8972d008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x0a080003
8972e008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
8972f008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0xf78d6b00
89732008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x001c0707
89735008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x02070003
89738008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
89739008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
8973b008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x02070003
8973c008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x891b2b70
8973d008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x001c0707
8973d300 [8962dbe0] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8973e008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
8973f008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00700005
8973f2d0 [89a08770] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89740008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00700005
89740950 [89a7bb20] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89741008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00610048
897439a0 [89a974e8] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89745008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0xe4044000
89748008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x0a050003
8974a008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
8974b008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
8974b338 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
8974d008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x896474d8
89752530 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89753e70 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
89754008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
89754ed0 [897fd638] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89755008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x896474d8
89756008 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89758e70 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
8975d8b0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
8975e9a8 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89768008 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89769b18 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
8976a670 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x02070002
8976b138 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
8976dc88 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
8976e008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x02070003
8976eb10 [892205c8] irpStack: ( e, 0) 897e8670 [ \Driver\NdisWan]
8976f008 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89774500 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x001c0707
89774e50 [895b04d8] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89776008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x896474d8
89776300 [898fd470] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8977cb58 [89987260] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89786be8 [89683880] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89789e58 [8920f520] irpStack: ( e, 0) 89ac58d0 [ \Driver\NdisTapi]
89795268 [896abda0] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
89795398 [897956a0] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89798008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
8979a658 [89764b20] irpStack: ( d, 0) 89b1fe58 [ \FileSystem\DfsDriver]
8979a998 [89245020] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
897a1768 [89a85230] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
897ef348 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2)
897f9e70 [89a7dda0] irpStack: ( 3, 0) 89a0bbb8 [ \Driver\Mouclass]
89802908 [00000000] irpStack: (16, 0) 897dd030 [ \Driver\usbohci]
89803928 [89752da0] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89803ba8 [89a9e380] irpStack: ( e, 0) 898ea780 [ \Driver\IPSec]
89807af0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
898e06b0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
898e3920 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
898e5630 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
898e7910 [8979ab48] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
898e79b0 [8974bb28] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
898ecf68 [89683880] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
898ed3f0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
898edaf0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
898ee008 [00000000] irpStack: ( 0, 0) 89a865e0 [ \Driver\Cdrom] 0x00000000
898f2c88 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2)
898f5cb0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
898f99c0 [89a08770] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
898fc008 [00000000] irpStack: ( 0, 0) 00000000 [00000000: Could not read device object or _DEVICE_OBJECT not found
]
898fda78 [8999f348] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89904158 [89a974e8] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89905138 [89a08770] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8990c908 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000070
89912208 [89a70558] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
899124d0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89914220 [895ff020] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89915c40 [8967f890] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89915ce0 [89774bc0] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
89917008 [899edc90] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89919a18 [895ff020] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89924750 [89a08770] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89928bc8 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89929118 [89a342e8] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
8992f738 [895a7da0] irpStack: ( d, 0) 89b1fe58 [ \FileSystem\DfsDriver]
89932008 [89681908] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
899331b0 [899fdda0] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89937008 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89937a90 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
8993baf0 [896edda0] irpStack: ( 3, 0) 89a9ea10 [ \Driver\Kbdclass]
8993e9f0 [89238da0] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
89942a28 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
89942bc0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899498f8 [899c2ce0] irpStack: ( e, 0) 897f89b0 [ \Driver\Tcpip]
89949998 [89784510] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
8994a100 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
8994e008 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
8994eb80 [89683880] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8994ed58 [89a974e8] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8994eec8 [89984020] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8994ef68 [89757650] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8994f6a8 [89a08138] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8994f748 [89a7c290] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8994f978 [89a974e8] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8994fae8 [89683880] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8994fb88 [8979ab48] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8994fc28 [89a93650] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
89956388 [89a6eda0] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
89956468 [89a73da0] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
89961250 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89962a98 [89a08770] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
899667b8 [8968d020] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
89967160 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899674a0 [896f2da0] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8996b6c0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
8996f648 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x896474d8
89996348 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x8889d310
899998f8 [8979ab48] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
8999faf0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
8999fcd8 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
8999fe70 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899a0008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00000000
899a3008 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
899a78b0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899a8980 [89683880] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
899a8cb8 [897262c0] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899a9820 [89772da0] irpStack: ( e, 0) 897f89b0 [ \Driver\Tcpip]
899aa8b0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899aba60 [897553c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x899b0738
899ac600 [89905600] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
899adaf8 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899ae348 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899ae958 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899af860 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899b0e48 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899b14a0 [8968d020] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
899b25d8 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899b2b00 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899b3af0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899b6cd8 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899b86a8 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899e5d38 [899edc90] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899f1008 [899d7ce8] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
899f7008 [00000000] irpStack: ( f, 0) 897dd030 [ \Driver\usbohci]
899f88b0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899fa620 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899faa48 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899fb2f0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899fb718 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899fbb40 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899fe488 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
899ff488 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a002e0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a027c0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a04af0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a05f68 [89948be8] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
89a06860 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a0a100 [89a974e8] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89a0a958 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a0b860 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a0d340 [89255020] irpStack: ( e, 3) 89a9d598 [ \Driver\AFD]
89a0dcd8 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a0e5d8 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a0e958 [00000000] Irp is complete (CurrentLocation 4 > StackCount 3) 0x00000000
89a0f008 [8968d020] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x89742350
89a135d8 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a21d00 [89940798] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89a3f638 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89a3fbb0 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89a407e8 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89a44008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x001c0707
89a453b0 [898f9da0] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89a6c718 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a6cb40 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a6d620 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a6da48 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a6e620 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a6ea48 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a6f620 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a702f8 [897553c0] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
89a70a48 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a716b0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a722f8 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a74cd8 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a77958 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a7b650 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a7c958 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a7d860 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a804e0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a81008 [89681908] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89a85008 [89a08770] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89a85e70 [89769600] irpStack: ( e, 0) 897a4388 [ \FileSystem\MRxSmb] 0x899b0738
89a87418 [8959e6c0] irpStack: ( e,20) 89a9d598 [ \Driver\AFD] 0x896f2a08
89a88be8 [89a93650] irpStack: ( e,2d) 89a9d598 [ \Driver\AFD]
89a8e488 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a91620 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a91cd8 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a932f0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a93b40 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a94b40 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a952f0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a95718 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a95b40 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a966c8 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89a97b08 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00700005
89a99348 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89aa0798 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89aa15d8 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89aa2008 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0xe3ac3000
89aa2af0 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89aa3958 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89aadce0 [896aba88] irpStack: ( e, 0) 89a91030 [ \Driver\HTTP]
89abee70 [89a7dda0] irpStack: ( 3, 0) 899721d0 [ \Driver\Mouclass]
89ac4318 [89a974e8] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89ac4b40 [89684bf0] irpStack: ( e, 0) 899c1030 [ \Driver\HTTP] 0x899b0738
89ac84a0 [89757650] irpStack: ( 3, 0) 898ef928 [ \FileSystem\Npfs]
89aebf68 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1) 0x00000000
89aed170 [89a879d0] irpStack: ( d, 0) 898ef928 [ \FileSystem\Npfs]
89aed210 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89b44748 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
89b46570 [899b6600] irpStack: ( c, 2) 89ad2558 [ \FileSystem\Ntfs]
89b4c760 [00000000] irpStack: ( e, 0) 89bc4738 [ \Driver\ACPI]
89b5f4d0 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x02070003
89b5fb70 [89b9f3a0] Irp is complete (CurrentLocation 7 > StackCount 6) 0x00000000
89b5fe70 [89b9e3a0] irpStack: ( e, 0) 89b60e30 [ \Driver\Ftdisk]
89b7c378 [896c0da0] irpStack: ( 3, 0) 8974fe20 [ \Driver\Ndisuio] 0x89742350
89b7c538 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
89b7d8e8 [00000000] Irp is complete (CurrentLocation 3 > StackCount 2) 0x00630069
89b83c88 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1) 0x00000000
89b83f68 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1) 0x00000000
89ba2cc8 [00000000] Irp is complete (CurrentLocation 2 > StackCount 1)
89ba65b0 [89b9f3a0] Irp is complete (CurrentLocation 7 > StackCount 6) 0x00000000
89ba6af0 [89b9e3a0] irpStack: ( e, 0) 89b61608 [ \Driver\Ftdisk]
89baa6b0 [00000000] irpStack: (16, 0) 89b5c540 [ \Driver\ACPI]
89bc5650 [00000000] Irp is complete (CurrentLocation 21 > StackCount 20)

Searching NonPaged pool (f7be0000 : ffbe0000) for Tag: Irp?
 
Upvote 0 Downvote
You'll notice that a few of them weren't available. When looking for orphaned IRPs, this is one of the cases where you a full dump would be handy. However, we can note a few things. One is the number of pending IRPs down the network path, specifically at AFD.sys which is a tcp/ip helper dll for out of band IO like network printing. The other is:

898fc008 [00000000] irpStack: ( 0, 0) 00000000 [00000000: Could not read device object or _DEVICE_OBJECT not found
]


That's very interesting.

 
Upvote 0 Downvote
I'll see if I can get the full dump.

I did notice "Could not read device object or _DEVICE_OBJECT not found"

Thanks,

Argo


 
Upvote 0 Downvote
In the dump you had:

FOLLOWUP_IP:
nt!PoRunDownDeviceObject+9f
80543ac9 5d pop ebp

SYMBOL_STACK_INDEX: 0

FOLLOWUP_NAME: MachineOwner

SYMBOL_NAME: nt!PoRunDownDeviceObject+9f

MODULE_NAME: nt

IMAGE_NAME: ntoskrnl.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 40b53739

STACK_COMMAND: kb

FAILURE_BUCKET_ID: 0xc2_a_nt!PoRunDownDeviceObject+9f

BUCKET_ID: 0xc2_a_nt!PoRunDownDeviceObject+9f

Followup: MachineOwner




Notice the Bucket_ID - 0xc2_a_nt!PoRunDownDeviceObject+9f

Then when we list the IRPs, we see:

898fc008 [00000000] irpStack: ( 0, 0) 00000000 [00000000: Could not read device object or _DEVICE_OBJECT not found
]



What is the device object? Where did it go? I have seen this sort of thing when all the class entries for a filter driver have not been removed when the filter was upgraded or uninstalled. Dell used to have this problem when you upgraded openmangle; it would leave a class entry for a filter driver hanging. It would leave the class entry for afamgt.sys.





 
Upvote 0 Downvote
The server was built like 4 months ago. No hardware was removed, or added since the origional build. The only software running on it is our EDI Innovis software. The only software added to the server is windows security updates.

No wait... Dell came out and replaced the servers CPU's and RAM. The server completely died before it went into production.

I'm starting to think the fix is to move our EDI software off this server. Have Dell replace the guts. Start over with a fresh build. I am still looking to get a full dump though.

Thanks for the help...I'll see if I can get better info.
 
Upvote 0 Downvote
A class filter is a piece of software, a driver. The Dell OpenManage install/upgrade process has received a degree of notoriety in many of its iterations for leaving class entries hanging or installing bad versions of dlls. It basicly comes down to poor programming practices/poor quality control.


If you open regedit, and go to:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002 BE10318}

Then click on "UpperFilters" in the right hand pane. In the list, do you see afamgt.sys?

If it is there, delete the one entry. Then, go to:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Afamgt

Double click "start" in the right pane and set the value to 4. This will disable afamgt.sys.



 
Upvote 0 Downvote
At HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4D36E967-E325-11CE-BFC1-08002 BE10318} "Upper Filters" I see afamgt
PartMgr

I should leave PartMgr? Just kill afamgt.

ok....

Done

 
Upvote 0 Downvote
Status
Not open for further replies.

Similar threads

jmidd671
  • Locked
  • Helpful tip
Using Dumpsec - dump group members
Replies
1
Views
400
58sniper
58sniper
techseek
  • Locked
  • Question
W2008r2 on dell r720 with perc h710 mini
Replies
4
Views
203
gsavy
gsavy
NoCalAdmin
  • Locked
  • Question
alterntate application to dumpsec
Replies
0
Views
125
NoCalAdmin
NoCalAdmin
beefstew
  • Locked
  • Question
Using Dumpcfg.exe
Replies
0
Views
88
beefstew
beefstew
deros68
  • Locked
  • Question
dumping out the GPO on 600+ machines
Replies
0
Views
71
deros68
deros68

Part and Inventory Search

Sponsor

Back
Top