Software Diagnostics Library

Crash Dump Analysis Patterns (Part 85)

Sometimes we look at a stack trace collection and we see dozens of threads running through some 3rd-party component. We do not normally expect this component to appear or expect only one or two threads running through it. Here is an example from my IE after installing a 3rd-party toolbar that becomes Ubiquitous Component (the component has been renamed not “to awaken a sleeping giant and fill him with a terrible resolve”):

0:087> ~*kc

# 0 Id: 136c.fa0 Suspend: 0 Teb: 7ffdf000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx user32!RealMsgWaitForMultipleObjectsEx ieui!CoreSC::Wait ieui!CoreSC::WaitMessage ieui!WaitMessageEx ieframe!CBrowserFrame::FrameMessagePump ieframe!BrowserThreadProc ieframe!BrowserNewThreadProc ieframe!SHOpenFolderWindow ieframe!IEWinMain iexplore!wWinMain iexplore!_initterm_e kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

1 Id: 136c.12c0 Suspend: 0 Teb: 7ffdc000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects ntdll!TppWaiterpThread kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

2 Id: 136c.1120 Suspend: 0 Teb: 7ffda000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx user32!RealMsgWaitForMultipleObjectsEx ieui!CoreSC::Wait ieui!CoreSC::xwProcessNL ieui!GetMessageExA ieui!ResourceManager::SharedThreadProc msvcrt!_endthreadex msvcrt!_endthreadex kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

3 Id: 136c.1588 Suspend: 0 Teb: 7ffd9000 Unfrozen

ntdll!KiFastSystemCallRet user32!NtUserWaitMessage ieframe!CTabWindow::_TabWindowThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

4 Id: 136c.15a4 Suspend: 0 Teb: 7ffd8000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllGetClassObject ToolbarA!ToolBarMain ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

5 Id: 136c.111c Suspend: 0 Teb: 7ffd6000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForWorkViaWorkerFactory ntdll!TppWorkerThread kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

6 Id: 136c.10a8 Suspend: 0 Teb: 7ffd5000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForSingleObject kernel32!WaitForSingleObjectEx kernel32!WaitForSingleObject WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllGetClassObject ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

7 Id: 136c.fb0 Suspend: 0 Teb: 7ffd3000 Unfrozen

8 Id: 136c.1728 Suspend: 0 Teb: 7ffae000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

9 Id: 136c.918 Suspend: 0 Teb: 7ffad000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

10 Id: 136c.11c4 Suspend: 0 Teb: 7ffd4000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForSingleObject mswsock!SockWaitForSingleObject mswsock!WSPSelect ws2_32!select wininet!ICAsyncThread::SelectThread wininet!ICAsyncThread::SelectThreadWrapper kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

11 Id: 136c.13bc Suspend: 0 Teb: 7ffa8000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForSingleObject kernel32!WaitForSingleObjectEx kernel32!WaitForSingleObject WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllGetClassObject ToolbarA!ToolBarMain ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

12 Id: 136c.178 Suspend: 0 Teb: 7ffab000 Unfrozen

ntdll!KiFastSystemCallRet user32!NtUserGetMessage user32!GetMessageA winmm!mciwindow kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

13 Id: 136c.1594 Suspend: 0 Teb: 7ffa9000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx wdmaud!CWorker::_ThreadProc wdmaud!CWorker::_StaticThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

14 Id: 136c.b50 Suspend: 0 Teb: 7ffa0000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

15 Id: 136c.eec Suspend: 0 Teb: 7ff9e000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

16 Id: 136c.664 Suspend: 0 Teb: 7ff9d000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

17 Id: 136c.2cc Suspend: 0 Teb: 7ff9b000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

18 Id: 136c.e00 Suspend: 0 Teb: 7ff9c000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForSingleObject kernel32!WaitForSingleObjectEx kernel32!WaitForSingleObject mshtml!CTimerMan::ThreadExec mshtml!CExecFT::ThreadProc mshtml!CExecFT::StaticThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

19 Id: 136c.620 Suspend: 0 Teb: 7ff95000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

20 Id: 136c.1158 Suspend: 0 Teb: 7ff91000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

21 Id: 136c.10cc Suspend: 0 Teb: 7ff90000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

22 Id: 136c.1264 Suspend: 0 Teb: 7ff8f000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

23 Id: 136c.13fc Suspend: 0 Teb: 7ffde000 Unfrozen

ntdll!KiFastSystemCallRet user32!NtUserWaitMessage ieframe!CTabWindow::_TabWindowThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

24 Id: 136c.914 Suspend: 0 Teb: 7ffdb000 Unfrozen

25 Id: 136c.1194 Suspend: 0 Teb: 7ffac000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

26 Id: 136c.1548 Suspend: 0 Teb: 7ffa6000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

27 Id: 136c.a00 Suspend: 0 Teb: 7ff99000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

28 Id: 136c.1360 Suspend: 0 Teb: 7ff97000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

29 Id: 136c.dc0 Suspend: 0 Teb: 7ff96000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

30 Id: 136c.a80 Suspend: 0 Teb: 7ff94000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

31 Id: 136c.1390 Suspend: 0 Teb: 7ffa1000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForSingleObject kernel32!WaitForSingleObjectEx kernel32!WaitForSingleObject WARNING: Stack unwind information not available. Following frames may be wrong. Flash10b!DllUnregisterServer ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

32 Id: 136c.123c Suspend: 0 Teb: 7ff9f000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForSingleObject kernel32!WaitForSingleObjectEx kernel32!WaitForSingleObject WARNING: Stack unwind information not available. Following frames may be wrong. Flash10b!DllUnregisterServer ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

33 Id: 136c.1398 Suspend: 0 Teb: 7ff82000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects winmm!timeThread kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

34 Id: 136c.ca0 Suspend: 0 Teb: 7ff7d000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx user32!RealMsgWaitForMultipleObjectsEx ieui!CoreSC::Wait ieui!CoreSC::WaitMessage ieui!WaitMessageEx ieframe!CBrowserFrame::FrameMessagePump ieframe!BrowserThreadProc ieframe!BrowserNewThreadProc ieframe!SHOpenFolderWindow kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

35 Id: 136c.135c Suspend: 0 Teb: 7ff7c000 Unfrozen

ntdll!KiFastSystemCallRet user32!NtUserWaitMessage ieframe!CTabWindow::_TabWindowThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

36 Id: 136c.c34 Suspend: 0 Teb: 7ff7b000 Unfrozen

37 Id: 136c.a08 Suspend: 0 Teb: 7ff7a000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

38 Id: 136c.1108 Suspend: 0 Teb: 7ff79000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

39 Id: 136c.c20 Suspend: 0 Teb: 7ff77000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

40 Id: 136c.e48 Suspend: 0 Teb: 7ff74000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

41 Id: 136c.298 Suspend: 0 Teb: 7ff73000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

42 Id: 136c.11c8 Suspend: 0 Teb: 7ff72000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

43 Id: 136c.1180 Suspend: 0 Teb: 7ff68000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

44 Id: 136c.1750 Suspend: 0 Teb: 7ff66000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

45 Id: 136c.16d8 Suspend: 0 Teb: 7ff65000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

46 Id: 136c.15b8 Suspend: 0 Teb: 7ff64000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

47 Id: 136c.b88 Suspend: 0 Teb: 7ff6f000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

48 Id: 136c.434 Suspend: 0 Teb: 7ff6e000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

49 Id: 136c.16e8 Suspend: 0 Teb: 7ff6d000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

50 Id: 136c.f04 Suspend: 0 Teb: 7ff6c000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

51 Id: 136c.128c Suspend: 0 Teb: 7ff67000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

52 Id: 136c.1074 Suspend: 0 Teb: 7ff63000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

53 Id: 136c.2dc Suspend: 0 Teb: 7ff62000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

54 Id: 136c.172c Suspend: 0 Teb: 7ff60000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

55 Id: 136c.1240 Suspend: 0 Teb: 7ff69000 Unfrozen

ntdll!KiFastSystemCallRet user32!NtUserWaitMessage ieframe!CTabWindow::_TabWindowThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

56 Id: 136c.1604 Suspend: 0 Teb: 7ff61000 Unfrozen

57 Id: 136c.6a4 Suspend: 0 Teb: 7ff5f000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

58 Id: 136c.1258 Suspend: 0 Teb: 7ff5e000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

59 Id: 136c.8c0 Suspend: 0 Teb: 7ff5b000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

60 Id: 136c.868 Suspend: 0 Teb: 7ff58000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

61 Id: 136c.a54 Suspend: 0 Teb: 7ff57000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

62 Id: 136c.77c Suspend: 0 Teb: 7ff56000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

63 Id: 136c.1290 Suspend: 0 Teb: 7ff59000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

64 Id: 136c.1480 Suspend: 0 Teb: 7ff55000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

65 Id: 136c.1270 Suspend: 0 Teb: 7ff54000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

66 Id: 136c.b8c Suspend: 0 Teb: 7ff53000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

67 Id: 136c.167c Suspend: 0 Teb: 7ff92000 Unfrozen

ntdll!KiFastSystemCallRet user32!NtUserWaitMessage ieframe!CTabWindow::_TabWindowThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

68 Id: 136c.176c Suspend: 0 Teb: 7ff8e000 Unfrozen

69 Id: 136c.80c Suspend: 0 Teb: 7ff8b000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

70 Id: 136c.1570 Suspend: 0 Teb: 7ff8a000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

71 Id: 136c.e74 Suspend: 0 Teb: 7ff78000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

72 Id: 136c.1490 Suspend: 0 Teb: 7ff76000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

73 Id: 136c.d28 Suspend: 0 Teb: 7ff6a000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

74 Id: 136c.8d8 Suspend: 0 Teb: 7ff5c000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

75 Id: 136c.1064 Suspend: 0 Teb: 7ff4a000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

76 Id: 136c.1478 Suspend: 0 Teb: 7ff47000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

77 Id: 136c.1470 Suspend: 0 Teb: 7ff44000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

78 Id: 136c.aa0 Suspend: 0 Teb: 7ff43000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

79 Id: 136c.1210 Suspend: 0 Teb: 7ff48000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

80 Id: 136c.954 Suspend: 0 Teb: 7ff46000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

81 Id: 136c.9d4 Suspend: 0 Teb: 7ff45000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

82 Id: 136c.f30 Suspend: 0 Teb: 7ff42000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

83 Id: 136c.cc4 Suspend: 0 Teb: 7ff34000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

84 Id: 136c.1018 Suspend: 0 Teb: 7ff33000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

85 Id: 136c.940 Suspend: 0 Teb: 7ff32000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

86 Id: 136c.bd8 Suspend: 0 Teb: 7ff31000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

87 Id: 136c.1714 Suspend: 0 Teb: 7ff84000 Unfrozen

ntdll!KiFastSystemCallRet user32!NtUserWaitMessage user32!DialogBox2 user32!InternalDialogBox user32!SoftModalMessageBox user32!MessageBoxWorker user32!MessageBoxTimeoutW user32!MessageBoxTimeoutA user32!MessageBoxExA ieframe!Detour_MessageBoxExA user32!MessageBoxA WARNING: Stack unwind information not available. Following frames may be wrong. MathMLMimer!DllUnregisterServer MathMLMimer!DllUnregisterServer MathMLMimer!DllUnregisterServer

88 Id: 136c.1744 Suspend: 0 Teb: 7ff83000 Unfrozen

89 Id: 136c.9cc Suspend: 0 Teb: 7ff81000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

90 Id: 136c.f68 Suspend: 0 Teb: 7ff5a000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

91 Id: 136c.17f4 Suspend: 0 Teb: 7ff49000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

92 Id: 136c.13c Suspend: 0 Teb: 7ff41000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

93 Id: 136c.110 Suspend: 0 Teb: 7ff3f000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

94 Id: 136c.8e4 Suspend: 0 Teb: 7ff3e000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

95 Id: 136c.fcc Suspend: 0 Teb: 7ff4c000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx user32!RealMsgWaitForMultipleObjectsEx ieui!CoreSC::Wait ieui!CoreSC::WaitMessage ieui!WaitMessageEx ieframe!CBrowserFrame::FrameMessagePump ieframe!BrowserThreadProc ieframe!BrowserNewThreadProc ieframe!SHOpenFolderWindow kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

96 Id: 136c.1378 Suspend: 0 Teb: 7ff4b000 Unfrozen

ntdll!KiFastSystemCallRet user32!NtUserWaitMessage ieframe!CTabWindow::_TabWindowThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

97 Id: 136c.8ec Suspend: 0 Teb: 7ff40000 Unfrozen

98 Id: 136c.ac Suspend: 0 Teb: 7ff3d000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

99 Id: 136c.79c Suspend: 0 Teb: 7ff3c000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects WARNING: Stack unwind information not available. Following frames may be wrong. ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ToolbarA!DllCanUnloadNow ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

100 Id: 136c.bd0 Suspend: 0 Teb: 7ff3a000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForMultipleObjects kernel32!WaitForMultipleObjectsEx kernel32!WaitForMultipleObjects msiltcfg!WorkerThread kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

101 Id: 136c.1504 Suspend: 0 Teb: 7ff36000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

102 Id: 136c.5c0 Suspend: 0 Teb: 7ff35000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

103 Id: 136c.17a0 Suspend: 0 Teb: 7ff2d000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

104 Id: 136c.17c4 Suspend: 0 Teb: 7ff2c000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

105 Id: 136c.f08 Suspend: 0 Teb: 7ffaa000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

106 Id: 136c.1268 Suspend: 0 Teb: 7ff28000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

107 Id: 136c.12c8 Suspend: 0 Teb: 7ff27000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

108 Id: 136c.1634 Suspend: 0 Teb: 7ff26000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

109 Id: 136c.120c Suspend: 0 Teb: 7ff21000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

110 Id: 136c.13f4 Suspend: 0 Teb: 7ff20000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

111 Id: 136c.1494 Suspend: 0 Teb: 7ff1f000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

112 Id: 136c.16ec Suspend: 0 Teb: 7ff1e000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus dxtrans!TMThreadProc kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

113 Id: 136c.d68 Suspend: 0 Teb: 7ffa4000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwRemoveIoCompletion kernel32!GetQueuedCompletionStatus rpcrt4!COMMON_ProcessCalls rpcrt4!LOADABLE_TRANSPORT::ProcessIOEvents rpcrt4!ProcessIOEventsWrapper rpcrt4!BaseCachedThreadRoutine rpcrt4!ThreadStartRoutine kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

114 Id: 136c.5fc Suspend: 0 Teb: 7ffdd000 Unfrozen

ntdll!KiFastSystemCallRet ntdll!ZwWaitForWorkViaWorkerFactory ntdll!TppWorkerThread kernel32!BaseThreadInitThunk ntdll!__RtlUserThreadStart ntdll!_RtlUserThreadStart

In contrast, Flash10b module (shown in magenta above) is not ubiquitous, it is present on just 2 threads.

- Dmitry Vostokov @ DumpAnalysis.org -

This entry was posted on Tuesday, June 23rd, 2009 at 11:50 pm and is filed under Crash Dump Analysis, Crash Dump Patterns. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

2 Responses to “Crash Dump Analysis Patterns (Part 85)”

Crash Dump Analysis » Blog Archive » Old Mental Dumps from June 23rd Says:
June 23rd, 2010 at 11:18 am
[…] Crash Dump Analysis Patterns (Part 85) - Ubiquitous Component pattern. Appears also in the following cases study: Stack trace collection, […]
Crash Dump Analysis » Blog Archive » Crash Dump Analysis Patterns (Part 111) Says:
October 26th, 2010 at 9:23 pm
[…] with as opposed to intended module variety. At one extreme modules from pervasive system can be ubiquitous and at the other end hidden. In such cases troubleshooting consists of the total removal of […]

You must be logged in to post a comment.

Crash Dump Analysis Patterns (Part 85)

2 Responses to “Crash Dump Analysis Patterns (Part 85)”

Leave a Reply