Re: iisstate output - help with interpretation

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Pat [MSFT] (patfilot_at_online.microsoft.com)
Date: 04/02/04 

Date: Fri, 2 Apr 2004 08:46:12 -0800

It looks like MSXML4.dll is having some serious contention which is causing
your problem. You might try installing MSXML4SP2 (msdn.microsoft.com/xml).

If that doesn't work, you will likely need to call ms-support.

Pat

"Jon Har-Ewen" <jon_harewen@hotmail.com> wrote in message
news:Or7Qn%23MGEHA.3032@TK2MSFTNGP09.phx.gbl...
> Hi all,
> I am running IIS 6 on a 2 CPU Windows Server 2003 box. I am getting
> very bad performance with it - the dllhost.exe process regularly
> hits 90-100% CPU with just 100 users running against it, and the
page
> response times are pretty shocking. I have run iisstate 3.4 against
> it, and I have pasted the logfile output below. I would be very
> grateful if someone could please indicate to me what sort of thing it's
> doing
> to be using so much CPU time.
>
> Any help or pointers are much appreciated.
>
> Thanks,
> Jon
>
> Logfile starts---------------------------------------
>
> Opened log file 'D:\buffer\iisstate\output\IISState-3800.log'
> ***********************
> Starting new log output
> IISState version 3.4
> Fri Apr 02 16:32:20 2004
> OS = Windows 2003 Server
> Executable: dllhost.exe
> PID = 3800
> Note: Thread times are formatted as HH:MM:SS.ms
> ***********************
>
>
> Thread ID: 0
> System Thread ID: edc
> Kernel Time: 0:0:0.15
> User Time: 0:0:0.0
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for C:\WINDOWS\system32\ole32.dll -
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0006fcd8 77f43741 SharedUserData!SystemCallStub+0x4
> 01 0006fcdc 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 0006fd4c 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 0006fd5c 77209dde kernel32!WaitForSingleObject+0xf
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 0006fd78 7720a854 ole32!CoPopServiceDomain+0x1187
> 05 00000001 00000000 ole32!CoRegisterSurrogateEx+0x1a4
>
>
> Thread ID: 1
> System Thread ID: ee4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 005bff10 77f4262b SharedUserData!SystemCallStub+0x4
> 01 005bff14 77e418ea ntdll!NtDelayExecution+0xc
> 02 005bff7c 77e416ee kernel32!SleepEx+0x68
> 03 005bff88 771623a1 kernel32!Sleep+0xb
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 005bff94 7716248a ole32+0x23a1
> 05 00090f78 00000000 ole32+0x248a
>
>
> Thread ID: 2
> System Thread ID: ee0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.171
> Thread Type: Other
> # ChildEBP RetAddr
> 00 005fff14 77d01758 SharedUserData!SystemCallStub+0x4
> 01 005fff34 7719964f USER32!NtUserGetMessage+0xc
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 02 005fff74 771995cd ole32!CoGetInterceptorFromTypeInfo+0x224a
> 03 005fff90 77199518 ole32!CoGetInterceptorFromTypeInfo+0x21c8
> 04 00000000 00000000 ole32!CoGetInterceptorFromTypeInfo+0x2113
>
>
> Thread ID: 3
> System Thread ID: eec
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0067ff9c 77f4262b SharedUserData!SystemCallStub+0x4
> 01 0067ffa0 77f6b5b2 ntdll!NtDelayExecution+0xc
> 02 0067ffb8 77e4a990 ntdll!RtlpTimerThread+0x45
> 03 0067ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
> Thread ID: 4
> System Thread ID: ef0
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.15
> Thread Type: Other
> # ChildEBP RetAddr
> 00 006bff70 77f430c7 SharedUserData!SystemCallStub+0x4
> 01 006bff74 77f7e6ae ntdll!ZwRemoveIoCompletion+0xc
> 02 006bffb8 77e4a990 ntdll!RtlpWorkerThread+0x3b
> 03 006bffec 00000000 kernel32!BaseThreadStart+0x34
>
>
> Thread ID: 5
> System Thread ID: ef4
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> 00 0070fee0 77f430c7 SharedUserData!SystemCallStub+0x4
> 01 0070fee4 77e430bc ntdll!ZwRemoveIoCompletion+0xc
> 02 0070ff10 7566a1d7 kernel32!GetQueuedCompletionStatus+0x27
> 03 0070ff78 7566a3a3 COMSVCS!WORK_QUEUE::WorkerLoop+0x49
> 04 0070ff84 77bc91ed COMSVCS!WORK_QUEUE::ThreadLoop+0x15
> 05 0070ffb8 77e4a990 msvcrt!_endthreadex+0x95
> 06 0070ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
> Thread ID: 6
> System Thread ID: f04
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Status: Thread is in a WAIT state.
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> 00 0099fe94 77f4372d SharedUserData!SystemCallStub+0x4
> 01 0099fe98 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 0099ff40 77e4b0e4 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 0099ff58 75615c49 kernel32!WaitForMultipleObjects+0x17
> 04 0099ffb8 77e4a990 COMSVCS!PostData+0x174
> 05 0099ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
> Thread ID: 7
> System Thread ID: f08
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.31
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> 00 009dfef0 77f43741 SharedUserData!SystemCallStub+0x4
> 01 009dfef4 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 009dff64 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 009dff74 75611e06 kernel32!WaitForSingleObject+0xf
> 04 009dff84 77bc91ed
> COMSVCS!CSTAThreadPool::LoadBalanceThreadControlLoop+0x25
> 05 009dffb8 77e4a990 msvcrt!_endthreadex+0x95
> 06 009dffec 00000000 kernel32!BaseThreadStart+0x34
>
>
> Thread ID: 8
> System Thread ID: f10
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.0
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> 00 00a1fee8 77f43741 SharedUserData!SystemCallStub+0x4
> 01 00a1feec 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 00a1ff5c 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 00a1ff6c 75611999 kernel32!WaitForSingleObject+0xf
> 04 00a1ff84 77bc91ed
> COMSVCS!CSTAThreadPool::KillThreadControlLoop+0x21
> 05 00a1ffb8 77e4a990 msvcrt!_endthreadex+0x95
> 06 00a1ffec 00000000 kernel32!BaseThreadStart+0x34
>
>
> Thread ID: 9
> System Thread ID: f0c
> Kernel Time: 0:1:2.531
> User Time: 0:7:45.390
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for C:\WINDOWS\system32\msxml4.dll -
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for C:\Program Files\Common Files\MSSoap\Binaries\MSSOAP30.dll -
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for -
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for -
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for C:\WINDOWS\system32\RPCRT4.dll -
> Thread Type: ASP
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> # ChildEBP RetAddr
> 00 00a5e52c 77f43741 SharedUserData!SystemCallStub+0x4
> 01 00a5e530 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 00a5e5a0 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 00a5e5b0 69b80e10 kernel32!WaitForSingleObject+0xf
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 00a5e5cc 69b8fca3 msxml4!DllUnregisterServer+0x1596
> 05 00a5e624 00e9a80f msxml4!DllUnregisterServer+0x10429
> 06 00a5e664 00eb1153 MSSOAP30!DllRegisterServer+0x9db6
> 07 00a5e6b8 00eb14ce MSSOAP30!DllRegisterServer+0x206fa
> 08 00a5e6e8 00eb150e MSSOAP30!DllRegisterServer+0x20a75
> 09 00a5e70c 00eb180b MSSOAP30!DllRegisterServer+0x20ab5
> 0a 00a5e730 00e9fa1b MSSOAP30!DllRegisterServer+0x20db2
> 0b 00a5e780 00ea0248 MSSOAP30!DllRegisterServer+0xefc2
> 0c 00a5e7c8 00e9cb42 MSSOAP30!DllRegisterServer+0xf7ef
> 0d 00a5e8f8 00e9b041 MSSOAP30!DllRegisterServer+0xc0e9
> 0e 00a5e958 167844be MSSOAP30!DllRegisterServer+0xa5e8
> 0f 00a5ebe4 770f6109 BAISOAPTransport!DllCanUnloadNow+0x948
> 10 00a5ec34 7359a2fb OLEAUT32!DispCallFunc+0x15d
> 11 00a5f590 7359a0f4 MSVBVM60!BASIC_CLASS_Invoke+0x259
> 12 00a5f5ec 7714d7ac MSVBVM60!BASIC_CLASS_Invoke+0x52
> 13 00a5f620 7714c5d4 OLEAUT32!IDispatch_Invoke_Stub+0x50
> 14 00a5f658 77ce847b OLEAUT32!IDispatch_RemoteInvoke_Thunk+0x30
> 15 00a5fa2c 77ce5862 RPCRT4!NdrProxyErrorHandler+0xa9b
> 16 00a5fa84 77114196 RPCRT4!CStdStubBuffer_Invoke+0x82
> 17 00a5faa4 77269ae0 OLEAUT32!CStubWrapper::Invoke+0x9d
> 18 00a5fae8 77269a8a ole32!StgGetIFillLockBytesOnFile+0x11069
> 19 00a5fb30 771cbc14 ole32!StgGetIFillLockBytesOnFile+0x11013
> 1a 00a5fba4 000b9290 ole32!CoSuspendClassObjects+0xa89
> 1b 0868b79c 77166460 0xb9290
> 1c 771662f0 771740c5 ole32!SetErrorInfo+0xd8c
> 1d 7717def5 56530c45 ole32!CoFreeAllLibraries+0x310
> 1e 8bec8b55 00000000 0x56530c45
>
>
> Thread ID: 10
> System Thread ID: f18
> Kernel Time: 0:0:57.515
> User Time: 0:16:0.703
> Thread Type: ASP
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 00 00a9dcf4 00eb14ce MSSOAP30!DllRegisterServer+0x243d8
> 01 00a9dd24 00eb150e MSSOAP30!DllRegisterServer+0x20a75
> 02 00a9dd48 00eb1aac MSSOAP30!DllRegisterServer+0x20ab5
> 03 00a9dfa0 00eae5bc MSSOAP30!DllRegisterServer+0x21053
> 04 00a9e2a4 00eaf953 MSSOAP30!DllRegisterServer+0x1db63
> 05 00a9e51c 00eb028c MSSOAP30!DllRegisterServer+0x1eefa
> 06 00a9e62c 00eb06a5 MSSOAP30!DllRegisterServer+0x1f833
> 07 00a9e720 00eaad49 MSSOAP30!DllRegisterServer+0x1fc4c
> 08 00a9e760 00e9fcad MSSOAP30!DllRegisterServer+0x1a2f0
> 09 00a9e784 00ea02ba MSSOAP30!DllRegisterServer+0xf254
> 0a 00a9e7c8 00e9cb42 MSSOAP30!DllRegisterServer+0xf861
> 0b 00a9e8f8 00e9b041 MSSOAP30!DllRegisterServer+0xc0e9
> 0c 00a9e958 167844be MSSOAP30!DllRegisterServer+0xa5e8
> 0d 00a9ebe4 770f6109 BAISOAPTransport!DllCanUnloadNow+0x948
> 0e 00a9ec34 7359a2fb OLEAUT32!DispCallFunc+0x15d
> 0f 00a9f590 7359a0f4 MSVBVM60!BASIC_CLASS_Invoke+0x259
> 10 00a9f5ec 7714d7ac MSVBVM60!BASIC_CLASS_Invoke+0x52
> 11 00a9f620 7714c5d4 OLEAUT32!IDispatch_Invoke_Stub+0x50
> 12 00a9f658 77ce847b OLEAUT32!IDispatch_RemoteInvoke_Thunk+0x30
> 13 00a9fa2c 77ce5862 RPCRT4!NdrProxyErrorHandler+0xa9b
> 14 00a9fa84 77114196 RPCRT4!CStdStubBuffer_Invoke+0x82
> 15 00a9faa4 77269ae0 OLEAUT32!CStubWrapper::Invoke+0x9d
> 16 00a9fae8 77269a8a ole32!StgGetIFillLockBytesOnFile+0x11069
> 17 00a9fb30 771cbc14 ole32!StgGetIFillLockBytesOnFile+0x11013
> 18 00a9fba4 000b9818 ole32!CoSuspendClassObjects+0xa89
> 19 0868b8bc 77166460 0xb9818
> 1a 771662f0 771740c5 ole32!SetErrorInfo+0xd8c
> 1b 7717def5 56530c45 ole32!CoFreeAllLibraries+0x310
> 1c 8bec8b55 00000000 0x56530c45
>
>
> Thread ID: 11
> System Thread ID: f14
> Kernel Time: 0:1:0.343
> User Time: 0:9:12.62
> Thread Type: ASP
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> # ChildEBP RetAddr
> 00 00adde68 77f43741 SharedUserData!SystemCallStub+0x4
> 01 00adde6c 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 00addedc 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 00addeec 69b80e10 kernel32!WaitForSingleObject+0xf
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 00addf08 69b90519 msxml4!DllUnregisterServer+0x1596
> 05 00addf60 00e9a826 msxml4!DllUnregisterServer+0x10c9f
> 06 00addf9c 00eae35a MSSOAP30!DllRegisterServer+0x9dcd
> 07 00ade2a4 00eaf982 MSSOAP30!DllRegisterServer+0x1d901
> 08 00ade51c 00eb028c MSSOAP30!DllRegisterServer+0x1ef29
> 09 00ade62c 00eb06a5 MSSOAP30!DllRegisterServer+0x1f833
> 0a 00ade720 00eaad49 MSSOAP30!DllRegisterServer+0x1fc4c
> 0b 00ade760 00e9fcad MSSOAP30!DllRegisterServer+0x1a2f0
> 0c 00ade784 00ea02ba MSSOAP30!DllRegisterServer+0xf254
> 0d 00ade7c8 00e9cb42 MSSOAP30!DllRegisterServer+0xf861
> 0e 00ade8f8 00e9b041 MSSOAP30!DllRegisterServer+0xc0e9
> 0f 00ade958 167844be MSSOAP30!DllRegisterServer+0xa5e8
> 10 00adebe4 770f6109 BAISOAPTransport!DllCanUnloadNow+0x948
> 11 00adec34 7359a2fb OLEAUT32!DispCallFunc+0x15d
> 12 00adf590 7359a0f4 MSVBVM60!BASIC_CLASS_Invoke+0x259
> 13 00adf5ec 7714d7ac MSVBVM60!BASIC_CLASS_Invoke+0x52
> 14 00adf620 7714c5d4 OLEAUT32!IDispatch_Invoke_Stub+0x50
> 15 00adf658 77ce847b OLEAUT32!IDispatch_RemoteInvoke_Thunk+0x30
> 16 00adfa2c 77ce5862 RPCRT4!NdrProxyErrorHandler+0xa9b
> 17 00adfa84 77114196 RPCRT4!CStdStubBuffer_Invoke+0x82
> 18 00adfaa4 77269ae0 OLEAUT32!CStubWrapper::Invoke+0x9d
> 19 00adfae8 77269a8a ole32!StgGetIFillLockBytesOnFile+0x11069
> 1a 00adfb30 771cbc14 ole32!StgGetIFillLockBytesOnFile+0x11013
> 1b 00adfba4 000ba008 ole32!CoSuspendClassObjects+0xa89
> 1c 0868b778 77166460 0xba008
> 1d 771662f0 771740c5 ole32!SetErrorInfo+0xd8c
> 1e 7717def5 56530c45 ole32!CoFreeAllLibraries+0x310
> 1f 8bec8b55 00000000 0x56530c45
>
>
> Thread ID: 12
> System Thread ID: ee8
> Kernel Time: 0:0:45.421
> User Time: 0:11:55.578
> Thread Type: ASP
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> # ChildEBP RetAddr
> 00 00b1db3c 77f43741 SharedUserData!SystemCallStub+0x4
> 01 00b1db40 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 00b1dbb0 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 00b1dbc0 69b80e10 kernel32!WaitForSingleObject+0xf
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 00b1dbdc 69b90519 msxml4!DllUnregisterServer+0x1596
> 05 00b1dc34 00e9a826 msxml4!DllUnregisterServer+0x10c9f
> 06 00b1dc70 00eb1e25 MSSOAP30!DllRegisterServer+0x9dcd
> 07 00b1dca8 00eb11c4 MSSOAP30!DllRegisterServer+0x213cc
> 08 00b1dcf4 00eb14ce MSSOAP30!DllRegisterServer+0x2076b
> 09 00b1dd24 00eb150e MSSOAP30!DllRegisterServer+0x20a75
> 0a 00b1dd48 00eb1aac MSSOAP30!DllRegisterServer+0x20ab5
> 0b 00b1dfa0 00eae5bc MSSOAP30!DllRegisterServer+0x21053
> 0c 00b1e2a4 00eaf953 MSSOAP30!DllRegisterServer+0x1db63
> 0d 00b1e51c 00eb028c MSSOAP30!DllRegisterServer+0x1eefa
> 0e 00b1e62c 00eb06a5 MSSOAP30!DllRegisterServer+0x1f833
> 0f 00b1e720 00eaad49 MSSOAP30!DllRegisterServer+0x1fc4c
> 10 00b1e760 00e9fcad MSSOAP30!DllRegisterServer+0x1a2f0
> 11 00b1e784 00ea02ba MSSOAP30!DllRegisterServer+0xf254
> 12 00b1e7c8 00e9cb42 MSSOAP30!DllRegisterServer+0xf861
> 13 00b1e8f8 00e9b041 MSSOAP30!DllRegisterServer+0xc0e9
> 14 00b1e958 167844be MSSOAP30!DllRegisterServer+0xa5e8
> 15 00b1ebe4 770f6109 BAISOAPTransport!DllCanUnloadNow+0x948
> 16 00b1ec34 7359a2fb OLEAUT32!DispCallFunc+0x15d
> 17 00b1f590 7359a0f4 MSVBVM60!BASIC_CLASS_Invoke+0x259
> 18 00b1f5ec 7714d7ac MSVBVM60!BASIC_CLASS_Invoke+0x52
> 19 00b1f620 7714c5d4 OLEAUT32!IDispatch_Invoke_Stub+0x50
> 1a 00b1f658 77ce847b OLEAUT32!IDispatch_RemoteInvoke_Thunk+0x30
> 1b 00b1fa2c 77ce5862 RPCRT4!NdrProxyErrorHandler+0xa9b
> 1c 00b1fa84 77114196 RPCRT4!CStdStubBuffer_Invoke+0x82
> 1d 00b1faa4 77269ae0 OLEAUT32!CStubWrapper::Invoke+0x9d
> 1e 00b1fae8 77269a8a ole32!StgGetIFillLockBytesOnFile+0x11069
> 1f 00b1fb30 771cbc14 ole32!StgGetIFillLockBytesOnFile+0x11013
> 20 00b1fba4 000ba7f8 ole32!CoSuspendClassObjects+0xa89
> 21 0868b898 77166460 0xba7f8
> 22 771662f0 771740c5 ole32!SetErrorInfo+0xd8c
> 23 7717def5 56530c45 ole32!CoFreeAllLibraries+0x310
> 24 8bec8b55 00000000 0x56530c45
>
>
> Thread ID: 13
> System Thread ID: f20
> Kernel Time: 0:0:20.125
> User Time: 0:3:45.640
> Thread Type: ASP
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> # ChildEBP RetAddr
> 00 00b5dd74 77f43741 SharedUserData!SystemCallStub+0x4
> 01 00b5dd78 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 00b5dde8 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 00b5ddf8 69b80e10 kernel32!WaitForSingleObject+0xf
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 00b5de14 69b92d48 msxml4!DllUnregisterServer+0x1596
> 05 00b5de6c 00e9a7e4 msxml4!DllUnregisterServer+0x134ce
> 06 00b5dea8 00eb3f2e MSSOAP30!DllRegisterServer+0x9d8b
> 07 00b5df98 00eae90b MSSOAP30!DllRegisterServer+0x234d5
> 08 00b5e2a4 00eaf982 MSSOAP30!DllRegisterServer+0x1deb2
> 09 00b5e51c 00eb028c MSSOAP30!DllRegisterServer+0x1ef29
> 0a 00b5e62c 00eb06a5 MSSOAP30!DllRegisterServer+0x1f833
> 0b 00b5e720 00eaad49 MSSOAP30!DllRegisterServer+0x1fc4c
> 0c 00b5e760 00e9fcad MSSOAP30!DllRegisterServer+0x1a2f0
> 0d 00b5e784 00ea02ba MSSOAP30!DllRegisterServer+0xf254
> 0e 00b5e7c8 00e9cb42 MSSOAP30!DllRegisterServer+0xf861
> 0f 00b5e8f8 00e9b041 MSSOAP30!DllRegisterServer+0xc0e9
> 10 00b5e958 167844be MSSOAP30!DllRegisterServer+0xa5e8
> 11 00b5ebe4 770f6109 BAISOAPTransport!DllCanUnloadNow+0x948
> 12 00b5ec34 7359a2fb OLEAUT32!DispCallFunc+0x15d
> 13 00b5f590 7359a0f4 MSVBVM60!BASIC_CLASS_Invoke+0x259
> 14 00b5f5ec 7714d7ac MSVBVM60!BASIC_CLASS_Invoke+0x52
> 15 00b5f620 7714c5d4 OLEAUT32!IDispatch_Invoke_Stub+0x50
> 16 00b5f658 77ce847b OLEAUT32!IDispatch_RemoteInvoke_Thunk+0x30
> 17 00b5fa2c 77ce5862 RPCRT4!NdrProxyErrorHandler+0xa9b
> 18 00b5fa84 77114196 RPCRT4!CStdStubBuffer_Invoke+0x82
> 19 00b5faa4 77269ae0 OLEAUT32!CStubWrapper::Invoke+0x9d
> 1a 00b5fae8 77269a8a ole32!StgGetIFillLockBytesOnFile+0x11069
> 1b 00b5fb30 771cbc14 ole32!StgGetIFillLockBytesOnFile+0x11013
> 1c 00b5fba4 000bafe8 ole32!CoSuspendClassObjects+0xa89
> 1d 04fe42f0 77166460 0xbafe8
> 1e 771662f0 771740c5 ole32!SetErrorInfo+0xd8c
> 1f 7717def5 56530c45 ole32!CoFreeAllLibraries+0x310
> 20 8bec8b55 00000000 0x56530c45
>
>
> Thread ID: 14
> System Thread ID: f24
> Kernel Time: 0:0:16.921
> User Time: 0:4:24.406
> Thread Type: ASP
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> # ChildEBP RetAddr
> 00 00b9dc0c 77f43741 SharedUserData!SystemCallStub+0x4
> 01 00b9dc10 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 00b9dc80 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 00b9dc90 69b80e10 kernel32!WaitForSingleObject+0xf
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 00b9dcac 69b91223 msxml4!DllUnregisterServer+0x1596
> 05 00b9dd04 69b9635f msxml4!DllUnregisterServer+0x119a9
> 06 00b9dd40 00eb1ac4 msxml4!DllUnregisterServer+0x16ae5
> 07 00b9dfa0 00eae5bc MSSOAP30!DllRegisterServer+0x2106b
> 08 00b9e2a4 00eaf982 MSSOAP30!DllRegisterServer+0x1db63
> 09 00b9e51c 00eb028c MSSOAP30!DllRegisterServer+0x1ef29
> 0a 00b9e62c 00eb06a5 MSSOAP30!DllRegisterServer+0x1f833
> 0b 00b9e720 00eaad49 MSSOAP30!DllRegisterServer+0x1fc4c
> 0c 00b9e760 00e9fcad MSSOAP30!DllRegisterServer+0x1a2f0
> 0d 00b9e784 00ea02ba MSSOAP30!DllRegisterServer+0xf254
> 0e 00b9e7c8 00e9cb42 MSSOAP30!DllRegisterServer+0xf861
> 0f 00b9e8f8 00e9b041 MSSOAP30!DllRegisterServer+0xc0e9
> 10 00b9e958 167844be MSSOAP30!DllRegisterServer+0xa5e8
> 11 00b9ebe4 770f6109 BAISOAPTransport!DllCanUnloadNow+0x948
> 12 00b9ec34 7359a2fb OLEAUT32!DispCallFunc+0x15d
> 13 00b9f590 7359a0f4 MSVBVM60!BASIC_CLASS_Invoke+0x259
> 14 00b9f5ec 7714d7ac MSVBVM60!BASIC_CLASS_Invoke+0x52
> 15 00b9f620 7714c5d4 OLEAUT32!IDispatch_Invoke_Stub+0x50
> 16 00b9f658 77ce847b OLEAUT32!IDispatch_RemoteInvoke_Thunk+0x30
> 17 00b9fa2c 77ce5862 RPCRT4!NdrProxyErrorHandler+0xa9b
> 18 00b9fa84 77114196 RPCRT4!CStdStubBuffer_Invoke+0x82
> 19 00b9faa4 77269ae0 OLEAUT32!CStubWrapper::Invoke+0x9d
> 1a 00b9fae8 77269a8a ole32!StgGetIFillLockBytesOnFile+0x11069
> 1b 00b9fb30 771cbc14 ole32!StgGetIFillLockBytesOnFile+0x11013
> 1c 00b9fba4 000bbd08 ole32!CoSuspendClassObjects+0xa89
> 1d 04fe42a8 77166460 0xbbd08
> 1e 771662f0 771740c5 ole32!SetErrorInfo+0xd8c
> 1f 7717def5 56530c45 ole32!CoFreeAllLibraries+0x310
> 20 8bec8b55 00000000 0x56530c45
>
>
> Thread ID: 15
> System Thread ID: f2c
> Kernel Time: 0:0:10.46
> User Time: 0:2:26.625
> Thread Status: Thread is in a WAIT state.
> Thread Type: Idle ASP thread
> # ChildEBP RetAddr
> 00 00bdfdcc 77f4372d SharedUserData!SystemCallStub+0x4
> 01 00bdfdd0 77e41bfa ntdll!NtWaitForMultipleObjects+0xc
> 02 00bdfe78 77d02695 kernel32!WaitForMultipleObjectsEx+0x11a
> 03 00bdfed4 77d037f0 USER32!RealMsgWaitForMultipleObjectsEx+0x13f
> 04 00bdfef0 75614e57 USER32!MsgWaitForMultipleObjects+0x1d
> 05 00bdff84 77bc91ed COMSVCS!CSTAThread::WorkerLoop+0x1e3
> 06 00bdffb8 77e4a990 msvcrt!_endthreadex+0x95
> 07 00bdffec 00000000 kernel32!BaseThreadStart+0x34
>
>
> Thread ID: 16
> System Thread ID: f28
> Kernel Time: 0:0:15.593
> User Time: 0:3:47.296
> Thread Type: ASP
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> # ChildEBP RetAddr
> 00 00c1db74 77f43741 SharedUserData!SystemCallStub+0x4
> 01 00c1db78 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 00c1dbe8 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 00c1dbf8 69b80e10 kernel32!WaitForSingleObject+0xf
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 00c1dc14 69b1fd1a msxml4!DllUnregisterServer+0x1596
> 05 00c1dc58 69b23c64 msxml4+0xfd1a
> 06 00c1dca0 00eb12d2 msxml4!DllGetClassObject+0x3654
> 07 00c1dcf4 00eb14ce MSSOAP30!DllRegisterServer+0x20879
> 08 00c1dd24 00eb150e MSSOAP30!DllRegisterServer+0x20a75
> 09 00c1dd48 00eb1aac MSSOAP30!DllRegisterServer+0x20ab5
> 0a 00c1dfa0 00eae5bc MSSOAP30!DllRegisterServer+0x21053
> 0b 00c1e2a4 00eaf953 MSSOAP30!DllRegisterServer+0x1db63
> 0c 00c1e51c 00eb028c MSSOAP30!DllRegisterServer+0x1eefa
> 0d 00c1e62c 00eb06a5 MSSOAP30!DllRegisterServer+0x1f833
> 0e 00c1e720 00eaad49 MSSOAP30!DllRegisterServer+0x1fc4c
> 0f 00c1e760 00e9fcad MSSOAP30!DllRegisterServer+0x1a2f0
> 10 00c1e784 00ea02ba MSSOAP30!DllRegisterServer+0xf254
> 11 00c1e7c8 00e9cb42 MSSOAP30!DllRegisterServer+0xf861
> 12 00c1e8f8 00e9b041 MSSOAP30!DllRegisterServer+0xc0e9
> 13 00c1e958 167844be MSSOAP30!DllRegisterServer+0xa5e8
> 14 00c1ebe4 770f6109 BAISOAPTransport!DllCanUnloadNow+0x948
> 15 00c1ec34 7359a2fb OLEAUT32!DispCallFunc+0x15d
> 16 00c1f590 7359a0f4 MSVBVM60!BASIC_CLASS_Invoke+0x259
> 17 00c1f5ec 7714d7ac MSVBVM60!BASIC_CLASS_Invoke+0x52
> 18 00c1f620 7714c5d4 OLEAUT32!IDispatch_Invoke_Stub+0x50
> 19 00c1f658 77ce847b OLEAUT32!IDispatch_RemoteInvoke_Thunk+0x30
> 1a 00c1fa2c 77ce5862 RPCRT4!NdrProxyErrorHandler+0xa9b
> 1b 00c1fa84 77114196 RPCRT4!CStdStubBuffer_Invoke+0x82
> 1c 00c1faa4 77269ae0 OLEAUT32!CStubWrapper::Invoke+0x9d
> 1d 00c1fae8 77269a8a ole32!StgGetIFillLockBytesOnFile+0x11069
> 1e 00c1fb30 771cbc14 ole32!StgGetIFillLockBytesOnFile+0x11013
> 1f 00c1fba4 000bcce8 ole32!CoSuspendClassObjects+0xa89
> 20 00094338 77166460 0xbcce8
> 21 771662f0 771740c5 ole32!SetErrorInfo+0xd8c
> 22 7717def5 56530c45 ole32!CoFreeAllLibraries+0x310
> 23 8bec8b55 00000000 0x56530c45
>
>
> Thread ID: 17
> System Thread ID: f30
> Kernel Time: 0:0:8.500
> User Time: 0:2:8.796
> Thread Type: ASP
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> # ChildEBP RetAddr
> 00 00c5dbd8 77f43741 SharedUserData!SystemCallStub+0x4
> 01 00c5dbdc 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 00c5dc4c 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 00c5dc5c 69b80e10 kernel32!WaitForSingleObject+0xf
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 00c5dc78 69b91cea msxml4!DllUnregisterServer+0x1596
> 05 00c5dcfc 69b9647c msxml4!DllUnregisterServer+0x12470
> 06 00c5dd40 00eb1ac4 msxml4!DllUnregisterServer+0x16c02
> 07 00c5dfa0 00eae5bc MSSOAP30!DllRegisterServer+0x2106b
> 08 00c5e2a4 00eaf953 MSSOAP30!DllRegisterServer+0x1db63
> 09 00c5e51c 00eb028c MSSOAP30!DllRegisterServer+0x1eefa
> 0a 00c5e62c 00eb06a5 MSSOAP30!DllRegisterServer+0x1f833
> 0b 00c5e720 00eaad49 MSSOAP30!DllRegisterServer+0x1fc4c
> 0c 00c5e760 00e9fcad MSSOAP30!DllRegisterServer+0x1a2f0
> 0d 00c5e784 00ea02ba MSSOAP30!DllRegisterServer+0xf254
> 0e 00c5e7c8 00e9cb42 MSSOAP30!DllRegisterServer+0xf861
> 0f 00c5e8f8 00e9b041 MSSOAP30!DllRegisterServer+0xc0e9
> 10 00c5e958 167844be MSSOAP30!DllRegisterServer+0xa5e8
> 11 00c5ebe4 770f6109 BAISOAPTransport!DllCanUnloadNow+0x948
> 12 00c5ec34 7359a2fb OLEAUT32!DispCallFunc+0x15d
> 13 00c5f590 7359a0f4 MSVBVM60!BASIC_CLASS_Invoke+0x259
> 14 00c5f5ec 7714d7ac MSVBVM60!BASIC_CLASS_Invoke+0x52
> 15 00c5f620 7714c5d4 OLEAUT32!IDispatch_Invoke_Stub+0x50
> 16 00c5f658 77ce847b OLEAUT32!IDispatch_RemoteInvoke_Thunk+0x30
> 17 00c5fa2c 77ce5862 RPCRT4!NdrProxyErrorHandler+0xa9b
> 18 00c5fa84 77114196 RPCRT4!CStdStubBuffer_Invoke+0x82
> 19 00c5faa4 77269ae0 OLEAUT32!CStubWrapper::Invoke+0x9d
> 1a 00c5fae8 77269a8a ole32!StgGetIFillLockBytesOnFile+0x11069
> 1b 00c5fb30 771cbc14 ole32!StgGetIFillLockBytesOnFile+0x11013
> 1c 00c5fba4 000bd748 ole32!CoSuspendClassObjects+0xa89
> 1d 0868b808 77166460 0xbd748
> 1e 771662f0 771740c5 ole32!SetErrorInfo+0xd8c
> 1f 7717def5 56530c45 ole32!CoFreeAllLibraries+0x310
> 20 8bec8b55 00000000 0x56530c45
>
>
> Thread ID: 18
> System Thread ID: f60
> Kernel Time: 0:0:0.0
> User Time: 0:0:0.15
> *** ERROR: Symbol file could not be found. Defaulted to export
> symbols for
>
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.WinHTTP_6595b64144ccf1df_5.1.0.0_x-w
> w_E0651936\WINHTTP.dll -
> Thread Type: Other
> # ChildEBP RetAddr
> 00 021dff34 77f4262b SharedUserData!SystemCallStub+0x4
> 01 021dff38 77e418ea ntdll!NtDelayExecution+0xc
> 02 021dffa0 77e416ee kernel32!SleepEx+0x68
> 03 021dffac 70c79ab1 kernel32!Sleep+0xb
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 021dffec 00000000 WINHTTP!WinHttpReceiveResponse+0x9c33
>
>
> Thread ID: 19
> System Thread ID: c08
> Kernel Time: 0:0:8.328
> User Time: 0:2:9.265
> Thread Type: ASP
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 00 0587db5c 69ba25c9 msxml4!DllCanUnloadNow+0x3f19
> 01 0587dbd4 69ba5bc7 msxml4!DllUnregisterServer+0x22d4f
> 02 0587dc3c 69ba5eb3 msxml4!DllUnregisterServer+0x2634d
> 03 0587dc6c 69b91c79 msxml4!DllUnregisterServer+0x26639
> 04 0587dcfc 69b9647c msxml4!DllUnregisterServer+0x123ff
> 05 0587dd40 00eb1ac4 msxml4!DllUnregisterServer+0x16c02
> 06 0587dfa0 00eae5bc MSSOAP30!DllRegisterServer+0x2106b
> 07 0587e2a4 00eaf982 MSSOAP30!DllRegisterServer+0x1db63
> 08 0587e51c 00eb028c MSSOAP30!DllRegisterServer+0x1ef29
> 09 0587e62c 00eb06a5 MSSOAP30!DllRegisterServer+0x1f833
> 0a 0587e720 00eaad49 MSSOAP30!DllRegisterServer+0x1fc4c
> 0b 0587e760 00e9fcad MSSOAP30!DllRegisterServer+0x1a2f0
> 0c 0587e784 00ea02ba MSSOAP30!DllRegisterServer+0xf254
> 0d 0587e7c8 00e9cb42 MSSOAP30!DllRegisterServer+0xf861
> 0e 0587e8f8 00e9b041 MSSOAP30!DllRegisterServer+0xc0e9
> 0f 0587e958 167844be MSSOAP30!DllRegisterServer+0xa5e8
> 10 0587ebe4 770f6109 BAISOAPTransport!DllCanUnloadNow+0x948
> 11 0587ec34 7359a2fb OLEAUT32!DispCallFunc+0x15d
> 12 0587f590 7359a0f4 MSVBVM60!BASIC_CLASS_Invoke+0x259
> 13 0587f5ec 7714d7ac MSVBVM60!BASIC_CLASS_Invoke+0x52
> 14 0587f620 7714c5d4 OLEAUT32!IDispatch_Invoke_Stub+0x50
> 15 0587f658 77ce847b OLEAUT32!IDispatch_RemoteInvoke_Thunk+0x30
> 16 0587fa2c 77ce5862 RPCRT4!NdrProxyErrorHandler+0xa9b
> 17 0587fa84 77114196 RPCRT4!CStdStubBuffer_Invoke+0x82
> 18 0587faa4 77269ae0 OLEAUT32!CStubWrapper::Invoke+0x9d
> 19 0587fae8 77269a8a ole32!StgGetIFillLockBytesOnFile+0x11069
> 1a 0587fb30 771cbc14 ole32!StgGetIFillLockBytesOnFile+0x11013
> 1b 0587fba4 04f35c40 ole32!CoSuspendClassObjects+0xa89
> 1c 04fe4260 77166460 0x4f35c40
> 1d 771662f0 771740c5 ole32!SetErrorInfo+0xd8c
> 1e 7717def5 56530c45 ole32!CoFreeAllLibraries+0x310
> 1f 8bec8b55 00000000 0x56530c45
>
>
> Thread ID: 20
> System Thread ID: 3b0
> Kernel Time: 0:0:10.609
> User Time: 0:2:48.546
> Thread Type: ASP
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> # ChildEBP RetAddr
> 00 058bdb50 77f43741 SharedUserData!SystemCallStub+0x4
> 01 058bdb54 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 058bdbc4 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 058bdbd4 69b80e10 kernel32!WaitForSingleObject+0xf
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 058bdbf0 69b91b9c msxml4!DllUnregisterServer+0x1596
> 05 058bdc60 69b96464 msxml4!DllUnregisterServer+0x12322
> 06 058bdca0 00eb0f1a msxml4!DllUnregisterServer+0x16bea
> 07 058bdcf4 00eb14ce MSSOAP30!DllRegisterServer+0x204c1
> 08 058bdd24 00eb150e MSSOAP30!DllRegisterServer+0x20a75
> 09 058bdd48 00eb1aac MSSOAP30!DllRegisterServer+0x20ab5
> 0a 058bdfa0 00eae5bc MSSOAP30!DllRegisterServer+0x21053
> 0b 058be2a4 00eaf953 MSSOAP30!DllRegisterServer+0x1db63
> 0c 058be51c 00eb028c MSSOAP30!DllRegisterServer+0x1eefa
> 0d 058be62c 00eb06a5 MSSOAP30!DllRegisterServer+0x1f833
> 0e 058be720 00eaad49 MSSOAP30!DllRegisterServer+0x1fc4c
> 0f 058be760 00e9fcad MSSOAP30!DllRegisterServer+0x1a2f0
> 10 058be784 00ea02ba MSSOAP30!DllRegisterServer+0xf254
> 11 058be7c8 00e9cb42 MSSOAP30!DllRegisterServer+0xf861
> 12 058be8f8 00e9b041 MSSOAP30!DllRegisterServer+0xc0e9
> 13 058be958 167844be MSSOAP30!DllRegisterServer+0xa5e8
> 14 058bebe4 770f6109 BAISOAPTransport!DllCanUnloadNow+0x948
> 15 058bec34 7359a2fb OLEAUT32!DispCallFunc+0x15d
> 16 058bf590 7359a0f4 MSVBVM60!BASIC_CLASS_Invoke+0x259
> 17 058bf5ec 7714d7ac MSVBVM60!BASIC_CLASS_Invoke+0x52
> 18 058bf620 7714c5d4 OLEAUT32!IDispatch_Invoke_Stub+0x50
> 19 058bf658 77ce847b OLEAUT32!IDispatch_RemoteInvoke_Thunk+0x30
> 1a 058bfa2c 77ce5862 RPCRT4!NdrProxyErrorHandler+0xa9b
> 1b 058bfa84 77114196 RPCRT4!CStdStubBuffer_Invoke+0x82
> 1c 058bfaa4 77269ae0 OLEAUT32!CStubWrapper::Invoke+0x9d
> 1d 058bfae8 77269a8a ole32!StgGetIFillLockBytesOnFile+0x11069
> 1e 058bfb30 771cbc14 ole32!StgGetIFillLockBytesOnFile+0x11013
> 1f 058bfba4 04f76338 ole32!CoSuspendClassObjects+0xa89
> 20 000943c8 77166460 0x4f76338
> 21 771662f0 771740c5 ole32!SetErrorInfo+0xd8c
> 22 7717def5 56530c45 ole32!CoFreeAllLibraries+0x310
> 23 8bec8b55 00000000 0x56530c45
>
>
> Thread ID: 21
> System Thread ID: f50
> Kernel Time: 0:0:14.765
> User Time: 0:3:50.250
> Thread Type: ASP
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> # ChildEBP RetAddr
> 00 0640d6c4 77f43741 SharedUserData!SystemCallStub+0x4
> 01 0640d6c8 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 0640d738 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 0640d748 69b80e10 kernel32!WaitForSingleObject+0xf
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 0640d764 69b91cea msxml4!DllUnregisterServer+0x1596
> 05 0640d7e8 00e9aca1 msxml4!DllUnregisterServer+0x12470
> 06 0640deac 00eb3faf MSSOAP30!DllRegisterServer+0xa248
> 07 0640df98 00eae90b MSSOAP30!DllRegisterServer+0x23556
> 08 0640e2a4 00eaf953 MSSOAP30!DllRegisterServer+0x1deb2
> 09 0640e51c 00eb028c MSSOAP30!DllRegisterServer+0x1eefa
> 0a 0640e62c 00eb06a5 MSSOAP30!DllRegisterServer+0x1f833
> 0b 0640e720 00eaad49 MSSOAP30!DllRegisterServer+0x1fc4c
> 0c 0640e760 00e9fcad MSSOAP30!DllRegisterServer+0x1a2f0
> 0d 0640e784 00ea02ba MSSOAP30!DllRegisterServer+0xf254
> 0e 0640e7c8 00e9cb42 MSSOAP30!DllRegisterServer+0xf861
> 0f 0640e8f8 00e9b041 MSSOAP30!DllRegisterServer+0xc0e9
> 10 0640e958 167844be MSSOAP30!DllRegisterServer+0xa5e8
> 11 0640ebe4 770f6109 BAISOAPTransport!DllCanUnloadNow+0x948
> 12 0640ec34 7359a2fb OLEAUT32!DispCallFunc+0x15d
> 13 0640f590 7359a0f4 MSVBVM60!BASIC_CLASS_Invoke+0x259
> 14 0640f5ec 7714d7ac MSVBVM60!BASIC_CLASS_Invoke+0x52
> 15 0640f620 7714c5d4 OLEAUT32!IDispatch_Invoke_Stub+0x50
> 16 0640f658 77ce847b OLEAUT32!IDispatch_RemoteInvoke_Thunk+0x30
> 17 0640fa2c 77ce5862 RPCRT4!NdrProxyErrorHandler+0xa9b
> 18 0640fa84 77114196 RPCRT4!CStdStubBuffer_Invoke+0x82
> 19 0640faa4 77269ae0 OLEAUT32!CStubWrapper::Invoke+0x9d
> 1a 0640fae8 77269a8a ole32!StgGetIFillLockBytesOnFile+0x11069
> 1b 0640fb30 771cbc14 ole32!StgGetIFillLockBytesOnFile+0x11013
> 1c 0640fba4 03898f40 ole32!CoSuspendClassObjects+0xa89
> 1d 086a85c0 77166460 0x3898f40
> 1e 771662f0 771740c5 ole32!SetErrorInfo+0xd8c
> 1f 7717def5 56530c45 ole32!CoFreeAllLibraries+0x310
> 20 8bec8b55 00000000 0x56530c45
>
>
> Thread ID: 22
> System Thread ID: f70
> Kernel Time: 0:0:8.515
> User Time: 0:2:9.0
> Thread Type: ASP
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> # ChildEBP RetAddr
> 00 064adb54 77f43741 SharedUserData!SystemCallStub+0x4
> 01 064adb58 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 064adbc8 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 064adbd8 69b80e10 kernel32!WaitForSingleObject+0xf
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 064adbf4 69b91b9c msxml4!DllUnregisterServer+0x1596
> 05 064adc64 69b96464 msxml4!DllUnregisterServer+0x12322
> 06 064adca4 00eb0dc7 msxml4!DllUnregisterServer+0x16bea
> 07 064adcf4 00eb14ce MSSOAP30!DllRegisterServer+0x2036e
> 08 064add24 00eb150e MSSOAP30!DllRegisterServer+0x20a75
> 09 064add48 00eb1aac MSSOAP30!DllRegisterServer+0x20ab5
> 0a 064adfa0 00eae5bc MSSOAP30!DllRegisterServer+0x21053
> 0b 064ae2a4 00eaf953 MSSOAP30!DllRegisterServer+0x1db63
> 0c 064ae51c 00eb028c MSSOAP30!DllRegisterServer+0x1eefa
> 0d 064ae62c 00eb06a5 MSSOAP30!DllRegisterServer+0x1f833
> 0e 064ae720 00eaad49 MSSOAP30!DllRegisterServer+0x1fc4c
> 0f 064ae760 00e9fcad MSSOAP30!DllRegisterServer+0x1a2f0
> 10 064ae784 00ea02ba MSSOAP30!DllRegisterServer+0xf254
> 11 064ae7c8 00e9cb42 MSSOAP30!DllRegisterServer+0xf861
> 12 064ae8f8 00e9b041 MSSOAP30!DllRegisterServer+0xc0e9
> 13 064ae958 167844be MSSOAP30!DllRegisterServer+0xa5e8
> 14 064aebe4 770f6109 BAISOAPTransport!DllCanUnloadNow+0x948
> 15 064aec34 7359a2fb OLEAUT32!DispCallFunc+0x15d
> 16 064af590 7359a0f4 MSVBVM60!BASIC_CLASS_Invoke+0x259
> 17 064af5ec 7714d7ac MSVBVM60!BASIC_CLASS_Invoke+0x52
> 18 064af620 7714c5d4 OLEAUT32!IDispatch_Invoke_Stub+0x50
> 19 064af658 77ce847b OLEAUT32!IDispatch_RemoteInvoke_Thunk+0x30
> 1a 064afa2c 77ce5862 RPCRT4!NdrProxyErrorHandler+0xa9b
> 1b 064afa84 77114196 RPCRT4!CStdStubBuffer_Invoke+0x82
> 1c 064afaa4 77269ae0 OLEAUT32!CStubWrapper::Invoke+0x9d
> 1d 064afae8 77269a8a ole32!StgGetIFillLockBytesOnFile+0x11069
> 1e 064afb30 771cbc14 ole32!StgGetIFillLockBytesOnFile+0x11013
> 1f 064afba4 05059940 ole32!CoSuspendClassObjects+0xa89
> 20 04fe4284 77166460 0x5059940
> 21 771662f0 771740c5 ole32!SetErrorInfo+0xd8c
> 22 7717def5 56530c45 ole32!CoFreeAllLibraries+0x310
> 23 8bec8b55 00000000 0x56530c45
>
>
> Thread ID: 23
> System Thread ID: 8a8
> Kernel Time: 0:0:6.390
> User Time: 0:1:25.531
> Thread Type: ASP
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> # ChildEBP RetAddr
> 00 0cc1de70 77f43741 SharedUserData!SystemCallStub+0x4
> 01 0cc1de74 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 0cc1dee4 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 0cc1def4 69b80e10 kernel32!WaitForSingleObject+0xf
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 0cc1df10 69b1fd1a msxml4!DllUnregisterServer+0x1596
> 05 0cc1df54 69b23c64 msxml4+0xfd1a
> 06 0cc1df9c 00eae66d msxml4!DllGetClassObject+0x3654
> 07 0cc1e2a4 00eaf953 MSSOAP30!DllRegisterServer+0x1dc14
> 08 0cc1e51c 00eb028c MSSOAP30!DllRegisterServer+0x1eefa
> 09 0cc1e62c 00eb06a5 MSSOAP30!DllRegisterServer+0x1f833
> 0a 0cc1e720 00eaad49 MSSOAP30!DllRegisterServer+0x1fc4c
> 0b 0cc1e760 00e9fcad MSSOAP30!DllRegisterServer+0x1a2f0
> 0c 0cc1e784 00ea02ba MSSOAP30!DllRegisterServer+0xf254
> 0d 0cc1e7c8 00e9cb42 MSSOAP30!DllRegisterServer+0xf861
> 0e 0cc1e8f8 00e9b041 MSSOAP30!DllRegisterServer+0xc0e9
> 0f 0cc1e958 167844be MSSOAP30!DllRegisterServer+0xa5e8
> 10 0cc1ebe4 770f6109 BAISOAPTransport!DllCanUnloadNow+0x948
> 11 0cc1ec34 7359a2fb OLEAUT32!DispCallFunc+0x15d
> 12 0cc1f590 7359a0f4 MSVBVM60!BASIC_CLASS_Invoke+0x259
> 13 0cc1f5ec 7714d7ac MSVBVM60!BASIC_CLASS_Invoke+0x52
> 14 0cc1f620 7714c5d4 OLEAUT32!IDispatch_Invoke_Stub+0x50
> 15 0cc1f658 77ce847b OLEAUT32!IDispatch_RemoteInvoke_Thunk+0x30
> 16 0cc1fa2c 77ce5862 RPCRT4!NdrProxyErrorHandler+0xa9b
> 17 0cc1fa84 77114196 RPCRT4!CStdStubBuffer_Invoke+0x82
> 18 0cc1faa4 77269ae0 OLEAUT32!CStubWrapper::Invoke+0x9d
> 19 0cc1fae8 77269a8a ole32!StgGetIFillLockBytesOnFile+0x11069
> 1a 0cc1fb30 771cbc14 ole32!StgGetIFillLockBytesOnFile+0x11013
> 1b 0cc1fba4 00142518 ole32!CoSuspendClassObjects+0xa89
> 1c 000ad120 77166460 0x142518
> 1d 771662f0 771740c5 ole32!SetErrorInfo+0xd8c
> 1e 7717def5 56530c45 ole32!CoFreeAllLibraries+0x310
> 1f 8bec8b55 00000000 0x56530c45
>
>
> Thread ID: 24
> System Thread ID: b70
> Kernel Time: 0:0:12.312
> User Time: 0:2:53.890
> Thread Type: ASP
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> # ChildEBP RetAddr
> 00 0cc5d070 77f43741 SharedUserData!SystemCallStub+0x4
> 01 0cc5d074 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 0cc5d0e4 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 0cc5d0f4 69b80e10 kernel32!WaitForSingleObject+0xf
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 0cc5d110 69b1fd1a msxml4!DllUnregisterServer+0x1596
> 05 0cc5d124 69b93b56 msxml4+0xfd1a
> 06 0cc5d178 69b6c05e msxml4!DllUnregisterServer+0x142dc
> 07 0cc5d1e4 00e9a4fb msxml4!DllRegisterServer+0x103bd
> 08 0cc5d22c 00e9a5ec MSSOAP30!DllRegisterServer+0x9aa2
> 09 0cc5dcc0 00eb1d66 MSSOAP30!DllRegisterServer+0x9b93
> 0a 0cc5dcf4 00eb14b5 MSSOAP30!DllRegisterServer+0x2130d
> 0b 0cc5dd24 00eb150e MSSOAP30!DllRegisterServer+0x20a5c
> 0c 0cc5dd48 00eb1aac MSSOAP30!DllRegisterServer+0x20ab5
> 0d 0cc5dfa0 00eae5bc MSSOAP30!DllRegisterServer+0x21053
> 0e 0cc5e2a4 00eaf953 MSSOAP30!DllRegisterServer+0x1db63
> 0f 0cc5e51c 00eb028c MSSOAP30!DllRegisterServer+0x1eefa
> 10 0cc5e62c 00eb06a5 MSSOAP30!DllRegisterServer+0x1f833
> 11 0cc5e720 00eaad49 MSSOAP30!DllRegisterServer+0x1fc4c
> 12 0cc5e760 00e9fcad MSSOAP30!DllRegisterServer+0x1a2f0
> 13 0cc5e784 00ea02ba MSSOAP30!DllRegisterServer+0xf254
> 14 0cc5e7c8 00e9cb42 MSSOAP30!DllRegisterServer+0xf861
> 15 0cc5e8f8 00e9b041 MSSOAP30!DllRegisterServer+0xc0e9
> 16 0cc5e958 167844be MSSOAP30!DllRegisterServer+0xa5e8
> 17 0cc5ebe4 770f6109 BAISOAPTransport!DllCanUnloadNow+0x948
> 18 0cc5ec34 7359a2fb OLEAUT32!DispCallFunc+0x15d
> 19 0cc5f590 7359a0f4 MSVBVM60!BASIC_CLASS_Invoke+0x259
> 1a 0cc5f5ec 7714d7ac MSVBVM60!BASIC_CLASS_Invoke+0x52
> 1b 0cc5f620 7714c5d4 OLEAUT32!IDispatch_Invoke_Stub+0x50
> 1c 0cc5f658 77ce847b OLEAUT32!IDispatch_RemoteInvoke_Thunk+0x30
> 1d 0cc5fa2c 77ce5862 RPCRT4!NdrProxyErrorHandler+0xa9b
> 1e 0cc5fa84 77114196 RPCRT4!CStdStubBuffer_Invoke+0x82
> 1f 0cc5faa4 77269ae0 OLEAUT32!CStubWrapper::Invoke+0x9d
> 20 0cc5fae8 77269a8a ole32!StgGetIFillLockBytesOnFile+0x11069
> 21 0cc5fb30 771cbc14 ole32!StgGetIFillLockBytesOnFile+0x11013
> 22 0cc5fba4 038dabf8 ole32!CoSuspendClassObjects+0xa89
> 23 0009435c 77166460 0x38dabf8
> 24 771662f0 771740c5 ole32!SetErrorInfo+0xd8c
> 25 7717def5 56530c45 ole32!CoFreeAllLibraries+0x310
> 26 8bec8b55 00000000 0x56530c45
>
>
> Thread ID: 25
> System Thread ID: b28
> Kernel Time: 0:0:6.421
> User Time: 0:1:49.984
> Thread Type: ASP
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> # ChildEBP RetAddr
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 00 0cf3db5c 69ba25c9 msxml4!DllCanUnloadNow+0x3f22
> 01 0cf3dbd4 69ba5bc7 msxml4!DllUnregisterServer+0x22d4f
> 02 0cf3dc3c 69ba5eb3 msxml4!DllUnregisterServer+0x2634d
> 03 0cf3dc6c 69b91c79 msxml4!DllUnregisterServer+0x26639
> 04 0cf3dcfc 69b9647c msxml4!DllUnregisterServer+0x123ff
> 05 0cf3dd40 00eb1ac4 msxml4!DllUnregisterServer+0x16c02
> 06 0cf3dfa0 00eae5bc MSSOAP30!DllRegisterServer+0x2106b
> 07 0cf3e2a4 00eaf982 MSSOAP30!DllRegisterServer+0x1db63
> 08 0cf3e51c 00eb028c MSSOAP30!DllRegisterServer+0x1ef29
> 09 0cf3e62c 00eb06a5 MSSOAP30!DllRegisterServer+0x1f833
> 0a 0cf3e720 00eaad49 MSSOAP30!DllRegisterServer+0x1fc4c
> 0b 0cf3e760 00e9fcad MSSOAP30!DllRegisterServer+0x1a2f0
> 0c 0cf3e784 00ea02ba MSSOAP30!DllRegisterServer+0xf254
> 0d 0cf3e7c8 00e9cb42 MSSOAP30!DllRegisterServer+0xf861
> 0e 0cf3e8f8 00e9b041 MSSOAP30!DllRegisterServer+0xc0e9
> 0f 0cf3e958 167844be MSSOAP30!DllRegisterServer+0xa5e8
> 10 0cf3ebe4 770f6109 BAISOAPTransport!DllCanUnloadNow+0x948
> 11 0cf3ec34 7359a2fb OLEAUT32!DispCallFunc+0x15d
> 12 0cf3f590 7359a0f4 MSVBVM60!BASIC_CLASS_Invoke+0x259
> 13 0cf3f5ec 7714d7ac MSVBVM60!BASIC_CLASS_Invoke+0x52
> 14 0cf3f620 7714c5d4 OLEAUT32!IDispatch_Invoke_Stub+0x50
> 15 0cf3f658 77ce847b OLEAUT32!IDispatch_RemoteInvoke_Thunk+0x30
> 16 0cf3fa2c 77ce5862 RPCRT4!NdrProxyErrorHandler+0xa9b
> 17 0cf3fa84 77114196 RPCRT4!CStdStubBuffer_Invoke+0x82
> 18 0cf3faa4 77269ae0 OLEAUT32!CStubWrapper::Invoke+0x9d
> 19 0cf3fae8 77269a8a ole32!StgGetIFillLockBytesOnFile+0x11069
> 1a 0cf3fb30 771cbc14 ole32!StgGetIFillLockBytesOnFile+0x11013
> 1b 0cf3fba4 050ca100 ole32!CoSuspendClassObjects+0xa89
> 1c 04fe435c 77166460 0x50ca100
> 1d 771662f0 771740c5 ole32!SetErrorInfo+0xd8c
> 1e 7717def5 56530c45 ole32!CoFreeAllLibraries+0x310
> 1f 8bec8b55 00000000 0x56530c45
>
>
> Thread ID: 26
> System Thread ID: 9bc
> Kernel Time: 0:0:17.625
> User Time: 0:2:27.125
> Thread Type: ASP
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> # ChildEBP RetAddr
> 00 0cf7dc0c 77f43741 SharedUserData!SystemCallStub+0x4
> 01 0cf7dc10 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 0cf7dc80 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 0cf7dc90 69b80e10 kernel32!WaitForSingleObject+0xf
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 0cf7dcac 69b91223 msxml4!DllUnregisterServer+0x1596
> 05 0cf7dd04 69b9635f msxml4!DllUnregisterServer+0x119a9
> 06 0cf7dd40 00eb1ac4 msxml4!DllUnregisterServer+0x16ae5
> 07 0cf7dfa0 00eae5bc MSSOAP30!DllRegisterServer+0x2106b
> 08 0cf7e2a4 00eaf982 MSSOAP30!DllRegisterServer+0x1db63
> 09 0cf7e51c 00eb028c MSSOAP30!DllRegisterServer+0x1ef29
> 0a 0cf7e62c 00eb06a5 MSSOAP30!DllRegisterServer+0x1f833
> 0b 0cf7e720 00eaad49 MSSOAP30!DllRegisterServer+0x1fc4c
> 0c 0cf7e760 00e9fcad MSSOAP30!DllRegisterServer+0x1a2f0
> 0d 0cf7e784 00ea02ba MSSOAP30!DllRegisterServer+0xf254
> 0e 0cf7e7c8 00e9cb42 MSSOAP30!DllRegisterServer+0xf861
> 0f 0cf7e8f8 00e9b041 MSSOAP30!DllRegisterServer+0xc0e9
> 10 0cf7e958 167844be MSSOAP30!DllRegisterServer+0xa5e8
> 11 0cf7ebe4 770f6109 BAISOAPTransport!DllCanUnloadNow+0x948
> 12 0cf7ec34 7359a2fb OLEAUT32!DispCallFunc+0x15d
> 13 0cf7f590 7359a0f4 MSVBVM60!BASIC_CLASS_Invoke+0x259
> 14 0cf7f5ec 7714d7ac MSVBVM60!BASIC_CLASS_Invoke+0x52
> 15 0cf7f620 7714c5d4 OLEAUT32!IDispatch_Invoke_Stub+0x50
> 16 0cf7f658 77ce847b OLEAUT32!IDispatch_RemoteInvoke_Thunk+0x30
> 17 0cf7fa2c 77ce5862 RPCRT4!NdrProxyErrorHandler+0xa9b
> 18 0cf7fa84 77114196 RPCRT4!CStdStubBuffer_Invoke+0x82
> 19 0cf7faa4 77269ae0 OLEAUT32!CStubWrapper::Invoke+0x9d
> 1a 0cf7fae8 77269a8a ole32!StgGetIFillLockBytesOnFile+0x11069
> 1b 0cf7fb30 771cbc14 ole32!StgGetIFillLockBytesOnFile+0x11013
> 1c 0cf7fba4 04f3c5c0 ole32!CoSuspendClassObjects+0xa89
> 1d 086a8650 77166460 0x4f3c5c0
> 1e 771662f0 771740c5 ole32!SetErrorInfo+0xd8c
> 1f 7717def5 56530c45 ole32!CoFreeAllLibraries+0x310
> 20 8bec8b55 00000000 0x56530c45
>
>
> Thread ID: 27
> System Thread ID: 834
> Kernel Time: 0:0:5.31
> User Time: 0:1:16.203
> Thread Type: ASP
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> # ChildEBP RetAddr
> 00 0de5dbd8 77f43741 SharedUserData!SystemCallStub+0x4
> 01 0de5dbdc 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 0de5dc4c 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 0de5dc5c 69b80e10 kernel32!WaitForSingleObject+0xf
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 0de5dc78 69b91cea msxml4!DllUnregisterServer+0x1596
> 05 0de5dcfc 69b9647c msxml4!DllUnregisterServer+0x12470
> 06 0de5dd40 00eb1ac4 msxml4!DllUnregisterServer+0x16c02
> 07 0de5dfa0 00eae5bc MSSOAP30!DllRegisterServer+0x2106b
> 08 0de5e2a4 00eaf982 MSSOAP30!DllRegisterServer+0x1db63
> 09 0de5e51c 00eb028c MSSOAP30!DllRegisterServer+0x1ef29
> 0a 0de5e62c 00eb06a5 MSSOAP30!DllRegisterServer+0x1f833
> 0b 0de5e720 00eaad49 MSSOAP30!DllRegisterServer+0x1fc4c
> 0c 0de5e760 00e9fcad MSSOAP30!DllRegisterServer+0x1a2f0
> 0d 0de5e784 00ea02ba MSSOAP30!DllRegisterServer+0xf254
> 0e 0de5e7c8 00e9cb42 MSSOAP30!DllRegisterServer+0xf861
> 0f 0de5e8f8 00e9b041 MSSOAP30!DllRegisterServer+0xc0e9
> 10 0de5e958 167844be MSSOAP30!DllRegisterServer+0xa5e8
> 11 0de5ebe4 770f6109 BAISOAPTransport!DllCanUnloadNow+0x948
> 12 0de5ec34 7359a2fb OLEAUT32!DispCallFunc+0x15d
> 13 0de5f590 7359a0f4 MSVBVM60!BASIC_CLASS_Invoke+0x259
> 14 0de5f5ec 7714d7ac MSVBVM60!BASIC_CLASS_Invoke+0x52
> 15 0de5f620 7714c5d4 OLEAUT32!IDispatch_Invoke_Stub+0x50
> 16 0de5f658 77ce847b OLEAUT32!IDispatch_RemoteInvoke_Thunk+0x30
> 17 0de5fa2c 77ce5862 RPCRT4!NdrProxyErrorHandler+0xa9b
> 18 0de5fa84 77114196 RPCRT4!CStdStubBuffer_Invoke+0x82
> 19 0de5faa4 77269ae0 OLEAUT32!CStubWrapper::Invoke+0x9d
> 1a 0de5fae8 77269a8a ole32!StgGetIFillLockBytesOnFile+0x11069
> 1b 0de5fb30 771cbc14 ole32!StgGetIFillLockBytesOnFile+0x11013
> 1c 0de5fba4 08726820 ole32!CoSuspendClassObjects+0xa89
> 1d 0868b82c 77166460 0x8726820
> 1e 771662f0 771740c5 ole32!SetErrorInfo+0xd8c
> 1f 7717def5 56530c45 ole32!CoFreeAllLibraries+0x310
> 20 8bec8b55 00000000 0x56530c45
>
>
> Thread ID: 28
> System Thread ID: 388
> Kernel Time: 0:0:6.796
> User Time: 0:1:48.625
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0ff9cb5c 77f43741 SharedUserData!SystemCallStub+0x4
> 01 0ff9cb60 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 0ff9cbd0 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 0ff9cbe0 69b80e10 kernel32!WaitForSingleObject+0xf
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 0ff9cbfc 69b1fd1a msxml4!DllUnregisterServer+0x1596
> 05 0ff9cc38 69b1fc52 msxml4+0xfd1a
> 06 0ff9cca0 69b20265 msxml4+0xfc52
> 07 0ff9ccd8 00eb0943 msxml4+0x10265
> 08 0ff9ccf8 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 09 0ff9cd18 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 0a 0ff9cd38 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 0b 0ff9cd58 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 0c 0ff9cd78 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 0d 0ff9cd98 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 0e 0ff9cdb8 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 0f 0ff9cdd8 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 10 0ff9cdf8 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 11 0ff9ce18 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 12 0ff9ce38 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 13 0ff9ce58 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 14 0ff9ce78 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 15 0ff9ce98 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 16 0ff9ceb8 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 17 0ff9ced8 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 18 0ff9cef8 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 19 0ff9cf18 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 1a 0ff9cf38 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 1b 0ff9cf58 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 1c 0ff9cf78 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 1d 0ff9cf98 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 1e 0ff9cfb8 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 1f 0ff9cfd8 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 20 0ff9cff8 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 21 0ff9d018 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 22 0ff9d038 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 23 0ff9d058 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 24 0ff9d078 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 25 0ff9d098 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 26 0ff9d0b8 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 27 0ff9d0d8 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 28 0ff9d0f8 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 29 0ff9d118 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 2a 0ff9d138 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 2b 0ff9d158 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 2c 0ff9d178 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 2d 0ff9d198 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 2e 0ff9d1b8 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 2f 0ff9d1d8 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 30 0ff9d1f8 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
> 31 0ff9d218 00eb0943 MSSOAP30!DllRegisterServer+0x1feea
>
>
> Thread ID: 29
> System Thread ID: 8f4
> Kernel Time: 0:0:5.453
> User Time: 0:1:23.953
> Thread Type: ASP
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> # ChildEBP RetAddr
> 00 1167dc0c 77f43741 SharedUserData!SystemCallStub+0x4
> 01 1167dc10 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 1167dc80 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 1167dc90 69b80e10 kernel32!WaitForSingleObject+0xf
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 1167dcac 69b91223 msxml4!DllUnregisterServer+0x1596
> 05 1167dd04 69b9635f msxml4!DllUnregisterServer+0x119a9
> 06 1167dd40 00eb1ac4 msxml4!DllUnregisterServer+0x16ae5
> 07 1167dfa0 00eae5bc MSSOAP30!DllRegisterServer+0x2106b
> 08 1167e2a4 00eaf953 MSSOAP30!DllRegisterServer+0x1db63
> 09 1167e51c 00eb028c MSSOAP30!DllRegisterServer+0x1eefa
> 0a 1167e62c 00eb06a5 MSSOAP30!DllRegisterServer+0x1f833
> 0b 1167e720 00eaad49 MSSOAP30!DllRegisterServer+0x1fc4c
> 0c 1167e760 00e9fcad MSSOAP30!DllRegisterServer+0x1a2f0
> 0d 1167e784 00ea02ba MSSOAP30!DllRegisterServer+0xf254
> 0e 1167e7c8 00e9cb42 MSSOAP30!DllRegisterServer+0xf861
> 0f 1167e8f8 00e9b041 MSSOAP30!DllRegisterServer+0xc0e9
> 10 1167e958 167844be MSSOAP30!DllRegisterServer+0xa5e8
> 11 1167ebe4 770f6109 BAISOAPTransport!DllCanUnloadNow+0x948
> 12 1167ec34 7359a2fb OLEAUT32!DispCallFunc+0x15d
> 13 1167f590 7359a0f4 MSVBVM60!BASIC_CLASS_Invoke+0x259
> 14 1167f5ec 7714d7ac MSVBVM60!BASIC_CLASS_Invoke+0x52
> 15 1167f620 7714c5d4 OLEAUT32!IDispatch_Invoke_Stub+0x50
> 16 1167f658 77ce847b OLEAUT32!IDispatch_RemoteInvoke_Thunk+0x30
> 17 1167fa2c 77ce5862 RPCRT4!NdrProxyErrorHandler+0xa9b
> 18 1167fa84 77114196 RPCRT4!CStdStubBuffer_Invoke+0x82
> 19 1167faa4 77269ae0 OLEAUT32!CStubWrapper::Invoke+0x9d
> 1a 1167fae8 77269a8a ole32!StgGetIFillLockBytesOnFile+0x11069
> 1b 1167fb30 771cbc14 ole32!StgGetIFillLockBytesOnFile+0x11013
> 1c 1167fba4 0e1ff0b0 ole32!CoSuspendClassObjects+0xa89
> 1d 000ad0d8 77166460 0xe1ff0b0
> 1e 771662f0 771740c5 ole32!SetErrorInfo+0xd8c
> 1f 7717def5 56530c45 ole32!CoFreeAllLibraries+0x310
> 20 8bec8b55 00000000 0x56530c45
>
>
> Thread ID: 30
> System Thread ID: 1314
> Kernel Time: 0:0:0.296
> User Time: 0:0:0.843
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> OLE32.dll Symbols not found. Unable to proceed with DCOM check.
> Continuing other analysis.
> # ChildEBP RetAddr
> 00 0415fe20 77f4313f SharedUserData!SystemCallStub+0x4
> 01 0415fe24 77c57b25 ntdll!NtReplyWaitReceivePortEx+0xc
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 02 0415ff8c 77c69659 RPCRT4!NdrServerInitializeNew+0x1d5
> 03 0415ffb0 77c69687 RPCRT4!I_RpcBindingIsClientLocal+0x799
> 04 0415ffec 00000000 RPCRT4!I_RpcBindingIsClientLocal+0x7c7
>
>
> Thread ID: 31
> System Thread ID: 14dc
> Kernel Time: 0:0:0.218
> User Time: 0:0:0.296
> Thread Type: Other
> # ChildEBP RetAddr
> 00 0419ed3c 77f43741 SharedUserData!SystemCallStub+0x4
> 01 0419ed40 77e41817 ntdll!ZwWaitForSingleObject+0xc
> 02 0419edb0 77e4168f kernel32!WaitForSingleObjectEx+0xac
> 03 0419edc0 771ca001 kernel32!WaitForSingleObject+0xf
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 04 0419eddc 7726aeb2 ole32!CoWaitForMultipleHandles+0x62a
> 05 0419eeb4 000001a0 ole32!StgGetIFillLockBytesOnFile+0x1243b
>
>
> Thread ID: 32
> System Thread ID: 15c4
> Kernel Time: 0:0:0.93
> User Time: 0:0:0.109
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> OLE32.dll Symbols not found. Unable to proceed with DCOM check.
> Continuing other analysis.
> # ChildEBP RetAddr
> 00 0421fe20 77f4313f SharedUserData!SystemCallStub+0x4
> 01 0421fe24 77c57b25 ntdll!NtReplyWaitReceivePortEx+0xc
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 02 0421ff8c 77c69659 RPCRT4!NdrServerInitializeNew+0x1d5
> 03 0421ffb0 77c69687 RPCRT4!I_RpcBindingIsClientLocal+0x799
> 04 0421ffec 00000000 RPCRT4!I_RpcBindingIsClientLocal+0x7c7
>
>
> Thread ID: 33
> System Thread ID: 27c
> Kernel Time: 0:0:0.46
> User Time: 0:0:0.31
> Thread Type: Possible ASP page. Possible DCOM activity
> Executing Page: Either ASP.dll is not being called on this thread or
> symbol file not available. Unable to locate ASP page.
> Continuing with other analysis.
> OLE32.dll Symbols not found. Unable to proceed with DCOM check.
> Continuing other analysis.
> # ChildEBP RetAddr
> 00 041dfe20 77f4313f SharedUserData!SystemCallStub+0x4
> 01 041dfe24 77c57b25 ntdll!NtReplyWaitReceivePortEx+0xc
> WARNING: Stack unwind information not available. Following frames
may
> be wrong.
> 02 041dff8c 77c69659 RPCRT4!NdrServerInitializeNew+0x1d5
> 03 041dffb0 77c69687 RPCRT4!I_RpcBindingIsClientLocal+0x799
> 04 041dffec 00000000 RPCRT4!I_RpcBindingIsClientLocal+0x7c7
> Closing open log file D:\buffer\iisstate\output\IISState-3800.log
>
>
>

Relevant Pages