@lttrung97Blog
Thanh Trung Le

Interpreting Process Monitor Result

Thanh Trung Le
Thanh Trung Le · 37 min read

Article Overview and Navigation

This document provides a detailed exploration of Windows operations monitoring using Procmon, result interpretation, and a catalog of common result values. Navigate through the sections below to explore specific aspects:

I. Windows Operations Monitoring via Procmon, Result Interpretation, and External Influences

A. Elucidating Core Windows Architectural Components and Operations Monitored by Procmon

Process Monitor (Procmon) is an indispensable utility for real-time observation of system activity on Microsoft Windows operating systems. It captures detailed information about File System, Registry, Network, and Process/Thread activities.1 This capability is crucial for diagnosing application malfunctions, understanding system behavior, and conducting security incident analysis.3 Procmon achieves its comprehensive monitoring through a combination of kernel-mode drivers and Event Tracing for Windows (ETW).
For File System, Registry, and Process/Thread events, Procmon installs a kernel-mode filter driver, typically named PROCMONxy.SYS (where 'xy' denotes a version-specific identifier).1 This driver strategically inserts itself into relevant driver stacks. In the case of file system monitoring, it functions as a file system minifilter driver, attaching to the file system stack managed by fltmgr.sys.5 Minifilters can intercept I/O Request Packets (IRPs) both before (pre-operation) and after (post-operation) they are processed by the base file system driver (e.g., NTFS.SYS) or other filters lower in the stack.6 The "altitude" of Procmon's minifilter is a configured value that determines its position relative to other file system minifilters, influencing its visibility into I/O operations.7 For Registry activity, Procmon's driver utilizes CmRegisterCallbackEx to register routines that are invoked by the Configuration Manager for pre- and post-registry operations, allowing observation of the final status of these operations.5, 8 Process and thread lifecycle events (creation, termination) are captured using PsSetCreateProcessNotifyRoutineEx and PsSetCreateThreadNotifyRoutine, respectively, while image loading (DLLs, EXEs) is monitored via PsSetLoadImageNotifyRoutineEx.5
Network activity (TCP and UDP) is traced using Event Tracing for Windows (ETW).5 Historically, Procmon utilized the NT Kernel Logger ETW session; however, contemporary versions employ a dedicated ETW session named "PROCMON TRACE".10 ETW provides a robust and standardized kernel-level infrastructure for publishing and consuming event data.10 This dichotomy in data sources—kernel filter driver versus ETW—means that the characteristics of captured data, such as timing precision and susceptibility to certain evasion techniques, can differ. While kernel drivers offer fine-grained, low-level interception5, ETW has documented bypass methods and can introduce minor event reporting latencies.5, 10 Consequently, if sophisticated network evasion is suspected, network traces from Procmon might benefit from correlation with other logging mechanisms.
The flow of operations within Windows, particularly for file I/O, is orchestrated by I/O Request Packets (IRPs). An IRP is a fundamental kernel data structure that represents an I/O request as it transits through the system.11 When an application or another kernel component initiates an I/O operation (e.g., reading a file), the I/O Manager typically creates an IRP. This IRP is then dispatched to the topmost driver in the device stack associated with the target device (e.g., a file system volume). Each driver in the stack, including any filter drivers like Procmon's or third-party filters, has the opportunity to process the IRP. A driver can complete the IRP (setting its final status), modify it, or pass it down to the next driver in the stack. The Result column in Procmon predominantly reflects the final NTSTATUS code with which an IRP (or an analogous kernel operation) was completed by one of the components in this processing chain.13 Procmon's file system filter intercepts these IRPs, logging their parameters (e.g., desired access, share mode, offset, length) and the ultimate outcome.
For network operations, user-mode calls initiated through Winsock (e.g., WS2_32.DLL) are typically handled by the Ancillary Function Driver (AFD.SYS). AFD.SYS then communicates with underlying transport drivers, such as TCPIP.SYS, primarily using the Transport Driver Interface (TDI). TDI requests are often encapsulated as internal device control IRPs (IRP_MJ_INTERNAL_DEVICE_CONTROL).14 Additionally, the Windows Filtering Platform (WFP) allows callout drivers to inspect and modify network traffic at various layers of the network stack.15 Procmon's ETW-based network capture subscribes to events generated by these network components. The Result code in Procmon is thus fundamentally tied to the completion status of an IRP or an equivalent kernel-level operation. Understanding that such requests are processed sequentially by a stack of drivers, any of which can finalize the operation with a specific status, is pivotal for diagnosing the origin of a particular Result value.
Procmon captures a wealth of data for each event, including the Time of Day, Process Name, Process ID (PID), Operation type (e.g., CreateFile, RegQueryValue, TCP Send), Path (to the file, registry key, or network endpoint), the Result of the operation, and a Detail column providing operation-specific information.17 The Result column, populated with NTSTATUS codes, is the primary indicator of an operation's success or failure from the kernel's perspective.

B. Roles of System Components in Generating Procmon Result Values

The Result values observed in Procmon traces are generated by a variety of components operating at different layers of the Windows architecture. Understanding the roles of these components is essential for accurate interpretation. (For deeper architectural context on these components and general Windows error handling, see Windows Error Generation Architecture).
1. Kernel-mode Core Components Relevant to Traced Operations
The Windows kernel and its core drivers are the primary sources of NTSTATUS codes that Procmon captures. A single user-mode operation, such as opening a file, can traverse multiple kernel managers and drivers, each capable of terminating the operation and generating an NTSTATUS code. The Result observed in Procmon typically originates from the first component in this chain that authoritatively completes or fails the request.
2. User-mode System Libraries (as callers triggering monitored operations)
User-mode applications use APIs provided by system DLLs, which translate requests into native system calls.
Understanding the translation from NTSTATUS (seen in Procmon) to Win32 error codes (reported by applications) is vital. For example, Procmon shows STATUS_ACCESS_DENIED (0xC0000022), application reports ERROR_ACCESS_DENIED (5). Not all NTSTATUS codes have unique Win32 equivalents.48
3. Third-Party Filter Drivers (Critical External Influence on Procmon Results)
Third-party filter drivers are kernel-mode components that intercept and potentially modify system operations. They are a pervasive and critical factor influencing the Result codes seen in Procmon, often being the true origin of unexpected outcomes.

C. NTSTATUS Codes and Their Relationship with Win32 Error Codes

The Result column in Procmon primarily displays NTSTATUS codes, the native status reporting mechanism within the Windows kernel and drivers.

D. Addressing Procmon Result Interpretation Complexity

Interpreting Procmon's Result column is complex due to Windows' layered architecture, component interactions, and especially the pervasive influence of third-party filter drivers. Accurate diagnosis requires holistic analysis of multiple Procmon data points.
Windows processes requests through layers: user-mode libraries (KERNEL32.DLL, NTDLL.DLL), executive subsystems (I/O Mgr, Object Mgr, SRM in NTOSKRNL.EXE), core drivers (NTFS.SYS, TCPIP.SYS), and critically, third-party filter drivers (FS, network, registry, process). Each layer can influence the final Result.
Third-party filter drivers (see I.B.3) are a primary source of complexity:
  • Override/Mask Base System Results: Filter returns STATUS_ACCESS_DENIED even if underlying permissions allow access.
  • Introduce Additional Operations: AV scans, DLP logging add events not directly from the application.
  • Introduce Latency: Filter processing increases Duration, potentially causing timeouts/secondary failures.
Therefore, analyze Result code with other columns:
Unexpected Result values often stem from:
  1. Third-Party Filter Driver Intervention (Most Common): AV blocking, EDR enforcing policy, encryption modifying I/O, backup holding locks, firewall dropping packets.
  2. Reparse Point Processing: STATUS_REPARSE is normal for symbolic links, junctions, mount points, placeholders (OneDrive, HSM). I/O Manager or filter (wcifs.sys, storqosflt.sys) redirects the operation. Analyze subsequent events.21
  3. Symbolic Links and Junctions: Inherently trigger STATUS_REPARSE.
  4. Subtle Configuration Issues: Incorrect security policies (enforced by filters), registry settings affecting drivers, network misconfigurations.
  5. Application Logic Errors: Invalid parameters passed, logically flawed operations (write to read-only handle), poor error handling leading to cascading failures.
While core Windows component bugs occur, they are less frequent causes than the above, especially filter actions. Effective Procmon analysis requires an investigative mindset, hypothesizing causes and using data (especially stack traces) to confirm/refute, always considering filters as intermediaries.

II. Catalog of Common and Diagnostically Significant Procmon Result Values

A. & B. Catalog Organization

This section provides a catalog of common and diagnostically important Result values (primarily NTSTATUS codes) frequently encountered in Procmon traces across File System, Registry, Network, and Process/Thread operations. Entries are alphabetical, detailing NTSTATUS code, potential origins (emphasizing filter drivers), typical operations, technical causes, and diagnostic clues. For broader coverage of Windows error codes beyond Procmon specifics, refer to The Catalog of Public Windows Error Codes and Messages.

C. Detailed Result Value Entries

1. Result Value Name: ACCESS DENIED

2. Result Value Name: ADDRESS ALREADY EXISTS

  • NTSTATUS Code: 0xC000020A70
  • Primary Originating Layer/System (Potential): Network Stack Component (e.g., TCPIP.SYS, AFD.SYS), Third-Party Network Filter Driver (WFP/NDIS).
  • Typical Operations: TCP Bind (e.g., via IRP_MJ_INTERNAL_DEVICE_CONTROL with TDI_BIND or IOCTL_AFD_BIND), UDP Bind.
  • Detailed Causation ("Why"):
    • Port in Use: Most common. Attempt to bind socket to local IP/port already in use by another active socket.
    • Lingering Sockets: Socket in TIME_WAIT state prevents immediate reuse.
    • Filter Driver Intervention: Network filter might manage own state and deem address "in use" or reserved.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Path column: Shows local IP/port being bound (e.g., 0.0.0.0:80).
    • Detail column: May show specifics for AFD_BIND.
    • External Tools: netstat -ano -p TCP (or -p UDP) lists active endpoints, states, owning PID. Compare with Procmon path to find conflict.
    • Stack Trace: Shows if TCPIP.SYS or AFD.SYS returns error. Third-party network filter presence indicates possible involvement.
    • Event Sequence: Check for recent socket closure on that address/port.

3. Result Value Name: BUFFER OVERFLOW

4. Result Value Name: BUFFER TOO SMALL

  • NTSTATUS Code: 0xC000002370 (Error status, NT_SUCCESS macro is FALSE)
  • Primary Originating Layer/System (Potential): I/O Manager, various Kernel Drivers (FS, Registry, Network), Third-Party Filter Driver.
  • Typical Operations: Similar to BUFFER OVERFLOW: QueryDirectoryFile, RegQueryValueKey, RegQueryKey, DeviceIoControlFile, NtQueryInformationFile, NtQueryVolumeInformationFile.
  • Detailed Causation ("Why"):
    • Insufficient Buffer for Any Data: Caller buffer too small for minimal/any data. Unlike BUFFER_OVERFLOW, usually no data returned.19
    • Required Size Indication: System/filter often sets IoStatus.Information to required buffer size for caller retry.
    • Fixed-Size Output Mismatch: Provided buffer smaller than expected fixed-size output structure.
    • Filter Driver Behavior: Filter intercepting query can return this if buffer insufficient for its (potentially modified) data.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Detail column: May show buffer Length provided. Might state required size.
    • Event Sequence: Look for subsequent retry with larger buffer size (visible in Detail). Retry often succeeds.
    • Stack Trace: Identifies component determining buffer too small.
    • Common error; applications should handle by reissuing with adequate buffer.

5. Result Value Name: CONNECTION REFUSED

  • NTSTATUS Code: 0xC000023670
  • Primary Originating Layer/System (Potential): Network Stack Component (TCPIP.SYS), Third-Party Network Filter Driver (WFP/NDIS).
  • Typical Operations: TCP Connect (often Procmon TCP:Connect, initiated by AFD_CONNECT).
  • Detailed Causation ("Why"):
    • No Listening Service: Remote host reached, but no application listening on destination port. Remote TCP stack actively rejected (sent TCP RST).
    • Firewall on Remote Host: Remote firewall blocking port and configured to send RST.
    • Firewall on Local Host (Less Common): Local firewall (potentially Third-Party WFP Filter) could actively refuse outgoing SYN, though silent drop (leading to TIMEOUT) is more common.
    • Application Layer Rejection: Server app accepts TCP then immediately closes (e.g., unmet criteria), possibly mapped to this error by client stack.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Path column: Shows destination IP address and port.
    • Detail column: May show source/destination ports for TCP Connect.
    • External Tools: Verify remote service listening (netstat -ano on remote). Check client/server firewalls. Test connect from different client/tool (telnet, Test-NetConnection).
    • Stack Trace: Typically shows TCPIP.SYS/AFD.SYS. If third-party network filter high in stack, investigate its role.
    • Event Sequence: Look for repeated attempts if application retries.

6. Result Value Name: DELETE PENDING

  • NTSTATUS Code: 0xC000005670
  • Primary Originating Layer/System (Potential): File System Driver (e.g., NTFS.SYS), Third-Party File System Filter Driver.
  • Typical Operations: Any file operation (except CloseFile, some queries) on a file object marked for deletion (e.g., ReadFile, WriteFile, SetBasicInformationFile, another CreateFile).
  • Detailed Causation ("Why"):
    • File Marked for Deletion: Previous op marked file for delete (SetDispositionInformationFile with DeleteFile=TRUE, or FILE_FLAG_DELETE_ON_CLOSE used on open).
    • File System Behavior: FS disallows most subsequent ops on existing handles (or new opens) once marked DELETE_PENDING. Actual disk deletion on last handle close.
    • Filter Driver Intervention: Filter might implement own deferred delete logic or intercept deletes, mark file pending, and return this status.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Event Sequence: Look for preceding SetDispositionInformationFile (Detail shows Delete: True) or CreateFile (Options include Delete On Close) on same path/handle.
    • Path column: Identifies file.
    • Stack Trace: Indicates FS driver or filter returning status.
    • Indicates file is being deleted; apps should close handles.

7. Result Value Name: DEVICE BUSY

  • NTSTATUS Code: 0x8000001170 (Warning/Informational)
  • Primary Originating Layer/System (Potential): Device Driver (storage, serial, etc.), I/O Manager, Third-Party Filter Driver.
  • Typical Operations: CreateFile (esp. devices), DeviceIoControlFile, WriteFile, ReadFile.
  • Detailed Causation ("Why"):
    • Exclusive Access Conflict: Attempt to open device already in exclusive use, or request requires exclusive access not currently grantable.
    • Device Overloaded/Queues Full: Device/driver has too many pending requests.
    • Resource Contention: Required hardware resource (interrupt, DMA) unavailable.
    • Filter Driver Holding Resource: Filter in device stack might hold device busy or manage access leading to this.
    • Media Change/Initialization: Removable media changing state.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Path column: Identifies device/file.
    • Detail column for CreateFile: Desired Access/ShareMode show if exclusive access requested.
    • Event Sequence: Look for other processes accessing same device. Check system event logs. Retries common.
    • Duration: Consistently slow ops on device might precede this status.
    • Stack Trace: Pinpoints driver in stack returning status. Investigate filters if present.

8. Result Value Name: DIRECTORY NOT EMPTY

  • NTSTATUS Code: 0xC000010170
  • Primary Originating Layer/System (Potential): File System Driver (e.g., NTFS.SYS, FASTFAT.SYS), Third-Party File System Filter Driver.
  • Typical Operations: SetDispositionInformationFile (deleting directory), DeleteFile (targeting directory with older APIs).
  • Detailed Causation ("Why"):
    • Contains Files/Subdirectories: Attempt to delete directory that still contains items. Most FS require directory empty for deletion.
    • Hidden or System Files: Directory appears empty in Explorer but hidden/system files prevent deletion.
    • Open Handles: Open handles to files/subdirectories within the target directory prevent their removal, thus blocking parent deletion.
    • Filter Driver Interference: Filter could prevent enumeration/deletion of items, hold items open, or directly return this status based on own logic.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Path column: Identifies directory.
    • Event Sequence: Look for preceding QueryDirectoryFile on target dir to see enumerated contents. Look for failed delete attempts on items within target dir (Result indicates why they failed, e.g., SHARING_VIOLATION, ACCESS_DENIED).
    • External Tools: dir /a <path> or Get-ChildItem -Path <path> -Force lists all contents. Check for open handles (Resource Monitor, Process Explorer).
    • Stack Trace: Shows FS driver. Filter might be visible if involved.

9. Result Value Name: DISK CORRUPT ERROR

  • NTSTATUS Code: 0xC000003270
  • Primary Originating Layer/System (Potential): File System Driver (e.g., NTFS.SYS, FASTFAT.SYS), Storage Driver.
  • Typical Operations: Any FS operation involving disk metadata/data read/write (CreateFile, ReadFile, WriteFile, QueryDirectoryFile, SetInformationFile).
  • Detailed Causation ("Why"):
    • File System Structure Corruption: Severe error. On-disk FS structures (MFT, FAT, directories, bitmaps) damaged/inconsistent.
    • Bad Sectors: Physical bad sectors on media lead to unreadable/unwritable metadata/data, interpreted as corruption.
    • Sudden Power Loss/Unsafe Shutdown: Leaves FS structures inconsistent.
    • Hardware Malfunction: Failing HDD/SSD/controller.
    • Driver Bugs (Less Common): Storage or FS driver bugs could cause corruption.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Path column: May indicate file/dir accessed when corruption detected, but could be general FS structure.
    • Event Sequence: Often multiple ops fail with this or related errors (STATUS_FILE_CORRUPT_ERROR, STATUS_CRC_ERROR).
    • System Event Log: Check System log for disk errors (sources "Disk", "NTFS", "PartMgr").
    • External Tools: Run CHKDSK /f /r <volume>:. Check SMART data (CrystalDiskInfo).
    • Stack Trace: Typically points to FS driver (NTFS.SYS!NtfsFsdRead) or lower storage driver.

10. Result Value Name: END OF FILE

  • NTSTATUS Code: 0xC000001170
  • Primary Originating Layer/System (Potential): File System Driver (e.g., NTFS.SYS), I/O Manager.
  • Typical Operations: ReadFile, NtReadFile.
  • Detailed Causation ("Why"):
    • Read Past File Boundary: Read attempt at or beyond current end of file's valid data. Normal/expected for sequential reads.
    • Zero-Length File: Attempting read from 0-byte file.
    • Sparse File Region: Read from unallocated sparse region might return EOF or zeros depending on FS/flags.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Detail column for ReadFile: Shows Offset and Length requested. Compare Offset with file size. IoStatus.Information (bytes read) will be 0 if read started at/beyond EOF, or less than Length if read crossed EOF.
    • Event Sequence: Often last successful/semi-successful read before close.
    • File Size: Correlate with size from preceding CreateFile or QueryStandardInformationFile/QueryBasicInformationFile.
    • Generally not an error, but indicator for app to stop reading.

11. Result Value Name: FILE LOCKED WITH ONLY READERS

  • NTSTATUS Code: 0x0000012A70 (Informational/Success)
  • Primary Originating Layer/System (Potential): File System Driver, Third-Party File System Filter Driver.
  • Typical Operations: LockFile (NtLockFile), DeviceIoControlFile (FSCTL_LOCK_VOLUME).
  • Detailed Causation ("Why"):
    • Successful Lock with Existing Readers: Lock request succeeded, but file/range already locked by others permitting only reading. Current lock granted, status informs caller.
    • Filter Driver Custom Locking: Filter implementing own locking might return this based on its state.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Detail column for LockFile: Shows Offset, Length, flags (shared/exclusive lock).
    • Event Sequence: Look for other LockFile ops on same file by other processes/handles.
    • Informational status, usually not a problem unless exclusive lock required.

12. Result Value Name: FILE LOCKED WITH WRITERS

  • NTSTATUS Code: 0x0000012B70 (Informational/Success)
  • Primary Originating Layer/System (Potential): File System Driver, Third-Party File System Filter Driver.
  • Typical Operations: LockFile (NtLockFile), DeviceIoControlFile (FSCTL_LOCK_VOLUME).
  • Detailed Causation ("Why"):
    • Successful Lock with Existing Writers: Lock request succeeded, but file/range already locked by others permitting write access. Current lock granted, status informs caller.
    • Filter Driver Custom Locking: Filter managing own locks could return this.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Detail column for LockFile: Shows Offset, Length, lock flags.
    • Event Sequence: Examine other LockFile ops on same file.
    • Informational status.

13. Result Value Name: FILE LOCK CONFLICT

  • NTSTATUS Code: 0xC000005470
  • Primary Originating Layer/System (Potential): File System Driver (e.g., NTFS.SYS), Third-Party File System Filter Driver.
  • Typical Operations: LockFile (NtLockFile), sometimes ReadFile/WriteFile if implicit locks conflict with existing byte-range locks.
  • Detailed Causation ("Why"):
    • Conflicting Byte-Range Lock: Attempt to lock byte range conflicts with existing lock on overlapping range held by another process/handle (e.g., exclusive requested over existing shared, any lock requested over existing exclusive).
    • Filter Driver Interference: Filter might manage locks or hold conflicting lock itself.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Detail column for LockFile: Shows Offset, Length, requested lock type (shared/exclusive).
    • Event Sequence: Search for other LockFile ops on same path. Identify process/handle holding conflicting lock (Procmon Find Handle/DLL, filter path, examine open handles/locks).
    • Stack Trace: Likely points to FS driver. Filter might appear if involved.

14. Result Value Name: HOST UNREACHABLE

  • NTSTATUS Code: 0xC000023D70
  • Primary Originating Layer/System (Potential): Network Stack Component (TCPIP.SYS), Third-Party Network Filter Driver (WFP/NDIS).
  • Typical Operations: TCP Connect, UDP Send, TCP Send (if route changes or remote becomes unreachable).
  • Detailed Causation ("Why"):
    • No Route to Host: Local system lacks network route to destination IP (bad local config, routing table issue, destination genuinely unreachable).
    • ARP Failure (Local Network): Failed to resolve MAC address for destination IP or gateway via ARP.
    • Firewall Blocking (Local or Intermediate): Firewall (local, possibly Third-Party WFP Filter; or intermediate router) dropping packets, preventing response, leading stack to determine unreachability (often after timeouts).
    • Physical Layer Issues: Cable disconnected, faulty NIC, switch port down.
    • VPN/Tunneling Issues: Problems with tunnel interface or routing if traffic should use VPN/tunnel.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Path column: Shows destination IP address and port.
    • External Tools: ping <host_ip> (basic connectivity). tracert <host_ip> / pathping (route tracing). ipconfig /all (local config). route print (local routing table). Check firewall logs.
    • Stack Trace: Usually points to TCPIP.SYS. Network filter visible if involved in blocking/misrouting.
    • Event Sequence: Look for preceding DNS resolution attempts (UDP Send/Receive port 53) to verify IP address correctness.

15. Result Value Name: INSUFFICIENT RESOURCES

  • NTSTATUS Code: 0xC000009A70
  • Primary Originating Layer/System (Potential): Memory Manager (NTOSKRNL.EXE), I/O Manager, various Drivers (FS, Net, Reg), Third-Party Filter Driver.
  • Typical Operations: Virtually any op requiring kernel memory (nonpaged/paged pool), handles, or other finite resources: CreateFile, RegCreateKey, Process Create, TCP Connect, ReadFile/WriteFile (internal buffers), DeviceIoControlFile.
  • Detailed Causation ("Why"):
    • Kernel Memory Exhaustion (Most Common): System out of nonpaged or paged pool memory needed for kernel data structures (IRPs, FCBs, sockets). Often due to driver leaks (including third-party filters) or high load.
    • Handle Limit Exceeded: Process exceeds handle quota or system limit.
    • Quota Exhaustion: Process exceeds paged pool or other resource quotas.
    • Other System Limits: Exhaustion of PTEs, I/O map registers, etc.
    • Filter Driver Resource Consumption: Poorly written filter leaks kernel memory or consumes excessive resources, contributing to or causing error.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Event Sequence: Error may appear for various ops across processes if system globally low. Look for pattern.
    • Duration: Ops may slow significantly before this error appears.
    • External Tools: Task Manager/Resource Monitor (check nonpaged/paged pool). Performance Monitor (track Memory\Pool Nonpaged Bytes, Pool Paged Bytes, Available MBytes; Process\Handle Count). PoolMon (WDK tool identifies pool tags/drivers consuming memory, diagnoses leaks). Kernel Debugger (!vm, !poolused for advanced analysis).
    • Stack Trace: Shows component failing allocation. Filter driver visible if it failed allocation.

16. Result Value Name: INVALID HANDLE

  • NTSTATUS Code: 0xC000000870
  • Primary Originating Layer/System (Potential): Object Manager (NTOSKRNL.EXE), I/O Manager, various Drivers.
  • Typical Operations: Any op taking handle input: ReadFile, WriteFile, CloseFile, RegQueryValue, DeviceIoControlFile, NtWaitForSingleObject.
  • Detailed Causation ("Why"):
    • Handle is Not Valid: Value doesn't correspond to open object in process handle table.
    • Handle Closed Prematurely: Handle was valid but since closed (CloseHandle/NtClose); app attempts reuse (common programming error).
    • Incorrect Handle Value: App passed uninitialized variable, corrupted value, or non-handle value (e.g., pointer).
    • Handle Used in Wrong Process Context (kernel callers): Kernel code uses user-mode handle in wrong process context.
    • Object Type Mismatch (Less Common): API expects file handle, receives event handle (more likely STATUS_OBJECT_TYPE_MISMATCH).
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Detail column: May show handle value used.
    • Event Sequence: Trace handle value backward from failure. Look for original CreateFile/RegOpenKey returning it. Look for CloseFile/NtClose for that handle before the failure.
    • Application Code Review: Often points to app handle management bugs.
    • Stack Trace: Shows API call receiving invalid handle.

17. Result Value Name: INVALID PARAMETER

  • NTSTATUS Code: 0xC000000D70
  • Primary Originating Layer/System (Potential): I/O Manager, Object Manager, any Kernel Driver (FS, Reg, Net, Device), Third-Party Filter Driver.
  • Typical Operations: Almost any system call/IRP: CreateFile, ReadFile, WriteFile, DeviceIoControlFile, RegSetValueEx, NtCreateUserProcess.
  • Detailed Causation ("Why"):
    • Incorrect Flags or Options: Invalid flag combination (e.g., mutually exclusive flags in CreateFile options).
    • Invalid Buffer Address/Alignment/Size: Buffer pointer NULL, invalid user address, misaligned for direct I/O. Size zero or inconsistent.
    • Illegal Value for a Parameter: Out-of-range or undefined value for parameter expecting specific range/enum.
    • Inconsistent Parameters: Parameters individually valid but inconsistent together (e.g., ReadFile offset+length exceeds max file size).
    • Malformed Structures: Structure passed as parameter malformed/invalid data.
    • Filter Driver Validation: Filter performs own validation, returns this if criteria unmet, even if underlying driver might accept (or fail differently).
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Detail column (Crucial): Shows parameters passed. CreateFile: Desired Access, ShareMode, Options, Disposition. DeviceIoControlFile: IOCTL code, buffer lengths. Registry ops: data types/lengths.
    • Stack Trace: Helps identify component (OS API, driver, filter) performing validation and returning error.
    • API Documentation: Refer to MS docs for specific operation (NtCreateFile WDK, CreateFileW SDK) for valid parameter values/combinations.
    • Application Code Review: Often indicates bug in how caller forms request.

18. Result Value Name: KEY DELETED

  • NTSTATUS Code: 0xC000017C70
  • Primary Originating Layer/System (Potential): Registry Manager (NTOSKRNL.EXE), Third-Party Registry Filter Driver.
  • Typical Operations: Any registry op on key marked for deletion (except close handle): RegQueryValue, RegSetValue, RegOpenKey (on subkey).
  • Detailed Causation ("Why"):
    • Operation on Deleted Key: Attempted op (other than close) on registry key handle after key marked for deletion (RegDeleteKey/NtDeleteKey). Key logically gone; most ops fail until last handle closed.
    • Filter Driver Intervention: Filter might manage key deletion customly or return this if policy dictates key effectively deleted.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Path column: Identifies registry key.
    • Event Sequence: Look for preceding RegDeleteKey/NtDeleteKey targeting same key or parent.
    • Stack Trace: Typically shows Configuration Manager (Cmp* functions in NTOSKRNL.EXE) or registry filter driver returning error.
    • Status indicates key no longer valid for most operations.

19. Result Value Name: LOCAL DISCONNECT

  • NTSTATUS Code: 0xC000013B70
  • Primary Originating Layer/System (Potential): Network Stack Component (TCPIP.SYS, AFD.SYS), Third-Party Network Filter Driver.
  • Typical Operations: TCP Send, TCP Receive, TCP Disconnect (when local side initiates).
  • Detailed Causation ("Why"):
    • Local Application Closed Socket: Local app explicitly closed socket (closesocket()/CloseHandle()). Normal termination.
    • Local Stack Initiated Termination: Local TCP/IP stack terminated connection due to internal reason (local protocol error, policy enforced by local component/filter).
    • Filter Driver Action: Third-Party Network Filter (WFP/NDIS) could programmatically terminate connection based on rules, causing this status for affected app.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Path column: Shows source/destination IP/port of disconnected connection.
    • Event Sequence: Look for preceding ops by local process indicating connection shutdown (TCP Disconnect op, app logic completion).
    • Stack Trace: Can show AFD.SYS (app close) or TCPIP.SYS. Filter driver visible if forcing disconnect.
    • Application Logs: May indicate why app closed connection.

20. Result Value Name: NAME NOT FOUND (Often Procmon display for STATUS_OBJECT_NAME_NOT_FOUND)

21. Result Value Name: NOT A DIRECTORY

  • NTSTATUS Code: 0xC000010370 (Note: Also STATUS_PENDING; Procmon disambiguates)
  • Primary Originating Layer/System (Potential): File System Driver (e.g., NTFS.SYS, FASTFAT.SYS), Object Manager (certain namespace ops).
  • Typical Operations: CreateFile (with FILE_DIRECTORY_FILE option on a file, or opening file as directory for enumeration), QueryDirectoryFile (on a file).
  • Detailed Causation ("Why"):
    • Operation Requires Directory, Target is File: Operation valid only for directories (enumerate, create file within with certain flags) attempted on a file.
    • Path Incorrectly Identifies File as Directory Segment: E.g., C:\Path\To\File.txt\NewFile.txt fails because File.txt isn't a directory.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Path column: Shows target path. Verify if component identified as directory is one.
    • Detail column for CreateFile: Check Options field for flags like FILE_DIRECTORY_FILE / FILE_NON_DIRECTORY_FILE.
    • External Tools: Use Explorer or dir to check object type at path.
    • Stack Trace: Usually points to FS driver.

22. Result Value Name: NOT SUPPORTED

  • NTSTATUS Code: 0xC00000BB70
  • Primary Originating Layer/System (Potential): Any Kernel Driver (FS, Net, Device), I/O Manager, Third-Party Filter Driver.
  • Typical Operations: DeviceIoControlFile (unsupported IOCTLs), FsControlFile (unsupported FSCTLs), SetInformationFile/QueryInformationFile (unsupported FileInformationClass), CreateFile (unsupported flags/options for device type).
  • Detailed Causation ("Why"):
    • Unsupported Functionality: Requested operation or specific feature/option not implemented/supported by target device/driver/FS.
    • IOCTL/FSCTL: Control code in DeviceIoControlFile/FsControlFile not recognized/handled by target driver.
    • FileInformationClass: FILE_INFORMATION_CLASS enum value used in query/set file info not supported by FS for that object type.
    • Unsupported Flags/Options: CreateFile flags meaningless/unsupported for target device type (e.g., file flags on raw device).
    • Operation Not Allowed on Target: Operation valid generally but not for specific object/device type (e.g., set EOF on directory).
    • Filter Driver Rejection: Third-party filter intercepts, returns this if it doesn't implement/allow that operation/variation, even if underlying native component supports it.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Detail column (Very important): DeviceIoControlFile/FsControlFile shows IOCTL/FSCTL code (lookup in WDK/docs). SetInformationFile/QueryInformationFile shows FileInformationClass. CreateFile shows Options, Desired Access.
    • Stack Trace: Identifies driver/system component returning status. Filter high in stack is likely source.
    • API/Driver Documentation: Consult docs for target device/driver/FS to verify if operation/IOCTL/FileInformationClass supported.

23. Result Value Name: OBJECT NAME COLLISION

  • NTSTATUS Code: 0xC000003570
  • Primary Originating Layer/System (Potential): Object Manager (NTOSKRNL.EXE), File System Driver, Registry Manager, Third-Party Filter Driver.
  • Typical Operations: CreateFile (with CREATE_NEW disposition), RegCreateKeyEx (with REG_CREATED_NEW_KEY intended), NtCreateNamedPipeFile, NtCreateMailslotFile.
  • Detailed Causation ("Why"):
    • Object Already Exists (and overwrite not allowed): Attempt to create object (file, dir, key, named pipe, mailslot) with specific name, but object with same name already exists, and creation disposition disallowed overwrite/open existing (e.g., CreateFile with CREATE_NEW fails if file exists).
    • Case Insensitivity: NTFS lookups case-insensitive by default but preserve case. Creating myfile.txt collides if MyFile.TXT exists.
    • Filter Driver Logic: Filter might enforce own naming policies or manage virtualized namespace, returning this if create violates rules.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Path column: Shows name of object attempted creation.
    • Detail column for CreateFile: Check Disposition. If CREATE_NEW (1), error expected if file exists. CREATE_ALWAYS (2) should overwrite; OPEN_ALWAYS (4) should open if exists or create if not.
    • External Tools: Verify if object with same name (case-insensitively for files/dirs) exists at path (Explorer, dir, regedit).
    • Event Sequence: Look for prior ops creating conflicting object.

24. Result Value Name: OBJECT PATH NOT FOUND

  • NTSTATUS Code: 0xC000003A70
  • Primary Originating Layer/System (Potential): Object Manager (NTOSKRNL.EXE), File System Driver, Registry Manager.
  • Typical Operations: CreateFile, OpenFile, RegOpenKey.
  • Detailed Causation ("Why"):
    • Intermediate Directory/Key Missing: Component (directory/key) in path leading to final object name does not exist. E.g., for C:\Dir1\Dir2\File.txt, occurs if Dir1 exists but Dir2 does not. Distinct from STATUS_OBJECT_NAME_NOT_FOUND (path prefix exists, final name doesn't).
    • Root of Path Invalid: Path root invalid (e.g., access file on non-existent drive X:\File.txt).
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Path column: Carefully examine full path.
    • External Tools: Manually navigate path component by component (Explorer, cd, regedit) to find missing part.
    • Stack Trace: Points to Object Manager (namespace paths), FS driver (file paths), or Registry Manager (reg paths).

25. Result Value Name: PENDING

  • NTSTATUS Code: 0x0000010370 (Informational/Success by NT_SUCCESS macro)
  • Primary Originating Layer/System (Potential): I/O Manager, various Kernel Drivers (FS, Net, Device), Third-Party Filter Driver.
  • Typical Operations: Common with async I/O: ReadFile, WriteFile, DeviceIoControlFile, TCP Connect, TCP Send, TCP Receive, NtWaitForSingleObject (with non-zero timeout).
  • Detailed Causation ("Why"):
    • Asynchronous Operation Initiated: Requested I/O op successfully initiated but not yet completed.19 Calling thread can continue while op proceeds in background. I/O Mgr/driver queued op, will signal completion later (event, APC, completion port).
    • Normal for Asynchronous I/O: Standard/expected return for async I/O (handle opened with FILE_FLAG_OVERLAPPED, sockets). Not an error.
    • Filter Driver Behavior: Filter intercepting async IRP, needing own lengthy async processing, might return STATUS_PENDING and complete IRP later.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Event Sequence (Crucial): Look for corresponding completion event later in trace for same operation (match file handle, socket context, IRP pointer if advanced output/symbols enabled). Completion event has actual final Result (e.g., SUCCESS, END_OF_FILE, error code) and bytes transferred (Detail for Read/Write). Completion often from "System" process (PID 4) or DPC/ISR context.
    • Duration of PENDING op: Usually very short (just queuing). True duration is time between PENDING and completion event.
    • Detail column: May show flags indicating async I/O.
    • If completion event never seen, might indicate hung op or capture stopped too soon.

26. Result Value Name: PORT UNREACHABLE

  • NTSTATUS Code: 0xC000023F70
  • Primary Originating Layer/System (Potential): Network Stack Component (TCPIP.SYS for UDP), Third-Party Network Filter Driver.
  • Typical Operations: UDP Send.
  • Detailed Causation ("Why"):
    • No UDP Listener on Remote Port: UDP datagram sent to remote port with no listening app. Remote host stack may respond with ICMP "Port Unreachable". Local TCPIP.SYS receives ICMP, translates to this status for sender.
    • Remote Firewall Blocking UDP Port: Remote firewall blocks UDP port, configured to send ICMP Port Unreachable.
    • Filter Driver Action: Local/intermediate network filter could potentially generate/simulate condition.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Path column: Shows destination IP/port for UDP Send.
    • Event Sequence: Look for corresponding incoming ICMP message in network trace (Wireshark). Procmon doesn't usually show ICMP directly unless part of TCP/UDP op result.
    • External Tools: Verify expected UDP service listening on remote host/port. UDP connectionless; relies on ICMP feedback.
    • Stack Trace: Usually TCPIP.SYS if standard ICMP-indicated unreachability.

27. Result Value Name: PRIVILEGE NOT HELD

  • NTSTATUS Code: 0xC000006170
  • Primary Originating Layer/System (Potential): Security Reference Monitor (SRM in NTOSKRNL.EXE), various kernel components checking specific privileges.
  • Typical Operations: Ops requiring specific admin/system privileges: NtOpenFile with FILE_FLAG_BACKUP_SEMANTICS (SeBackupPrivilege/SeRestorePrivilege), NtShutdownSystem (SeShutdownPrivilege), NtLoadDriver (SeLoadDriverPrivilege), accessing SACLs (SeSecurityPrivilege).
  • Detailed Causation ("Why"):
    • Missing Required Privilege: Caller process access token lacks specific privilege required by operation. Windows uses privileges for sensitive system-wide ops beyond object ACLs.28
    • Privilege Exists but Not Enabled: Process has privilege in token but not enabled (some need explicit enable via AdjustTokenPrivileges).
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Detail column: May sometimes provide hints, but specific privilege often implicit.
    • Stack Trace: Can show SePrivilegeCheck or other Se* functions in NTOSKRNL.EXE.
    • Process Token Information: Use Process Explorer (Properties -> Security tab) to view process privileges and status (enabled/disabled).
    • API Documentation: Docs for failing NtXxx/Win32 API often list required privileges.
    • Clear security failure; caller not authorized for specific system-level action.

28. Result Value Name: REGISTRY CORRUPT

  • NTSTATUS Code: 0xC000014C70
  • Primary Originating Layer/System (Potential): Registry Manager (NTOSKRNL.EXE).
  • Typical Operations: Any registry op (RegOpenKey, RegQueryValue, RegCreateKey), esp. during boot hive loading, or accessing specific hive.
  • Detailed Causation ("Why"):
    • Hive File Corruption: On-disk registry hive file (SYSTEM, SOFTWARE, SAM, NTUSER.DAT) physically corrupted (disk errors, unsafe shutdown, malware).
    • In-Memory Corruption: In-memory image of hive corrupted.
    • Failed Recovery: Configuration Manager attempted hive recovery using log file (.LOG1, .LOG2) but failed.
    • Very serious error, often leads to instability/unbootable system if critical hive affected.25
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Path column: May indicate specific reg path accessed when corruption detected. If during boot logging, might relate to core hive loading.
    • System Event Log: Check System log for errors from "Microsoft-Windows-Registry-TrE" or similar, potentially detailing corrupted hive/recovery attempts.
    • External Tools: WinRE might allow CHKDSK/System Restore. Offline registry editors/analysis tools for non-booting systems.
    • Stack Trace: Points to Configuration Manager functions (Cmp* routines in NTOSKRNL.EXE).

29. Result Value Name: REMOTE DISCONNECT

  • NTSTATUS Code: 0xC000013C70
  • Primary Originating Layer/System (Potential): Network Stack Component (TCPIP.SYS, AFD.SYS), Third-Party Network Filter Driver.
  • Typical Operations: TCP Send, TCP Receive (when remote side initiates disconnect).
  • Detailed Causation ("Why"):
    • Remote Application Closed Socket: Remote app explicitly closed its socket. Normal remote termination.
    • Remote Stack Initiated Termination: Remote TCP/IP stack initiated termination (sent FIN/RST). Due to remote app crash, remote system shutdown, remote network timeout, remote protocol error.
    • Network Interruption Closer to Remote: Network device closer to remote (firewall, NAT) terminated session.
    • Filter Driver Action (Remote or Intercepting): Filter on remote side causing drop, or intermediate network device filter resetting connection, manifests as remote disconnect locally.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Path column: Shows source/destination IP/port of disconnected connection.
    • Event Sequence: Look for last successful data exchange before status.
    • Stack Trace: Can show AFD.SYS/TCPIP.SYS processing disconnect notification.
    • Network Trace (Wireshark): Concurrent capture shows TCP FIN/RST received from remote triggering status.
    • Remote System Logs: Logs on remote server/app might indicate why it closed connection.

30. Result Value Name: REPARSE

31. Result Value Name: SHARING VIOLATION

  • NTSTATUS Code: 0xC000004370
  • Primary Originating Layer/System (Potential): File System Driver (e.g., NTFS.SYS), Third-Party File System Filter Driver.
  • Typical Operations: CreateFile, OpenFile.
  • Detailed Causation ("Why"):
    • Incompatible Share Modes (CRITICAL): Attempt to open file with ShareMode (e.g., FILE_SHARE_READ, FILE_SHARE_WRITE) incompatible with how file already opened by another handle (same/different process). Example: Proc A opens exclusive (ShareMode=0); Proc B attempts any open -> fails. Example: Proc A opens with ShareMode=FILE_SHARE_READ, DesiredAccess=GENERIC_WRITE; Proc B attempts DesiredAccess=GENERIC_READ -> fails. Rule: New open's access must be permitted by all existing openers' share modes, AND new open's share mode must permit all existing openers' access modes.
    • Filter Driver Holding File Open (CRITICAL): Third-party FS filter (AV, backup, indexer) might have file open, potentially with restrictive share mode, while processing. Very common cause of unexpected violations. Filter's open may be brief but conflict.6
    • Desired Access vs. Existing Open: Attempting write access when another handle open without FILE_SHARE_WRITE. Attempting delete access when another handle open without FILE_SHARE_DELETE.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Detail column for failing CreateFile: Shows requested Desired Access and ShareMode.
    • Event Sequence & Filtering: Filter Procmon for file Path. Look for all prior successful CreateFile ops on this path by any process; examine their ShareMode. Identify processes/handles currently holding file open (Procmon Find Handle/DLL, Process Explorer, Resource Monitor).
    • Stack Trace: Usually FS driver (NTFS.SYS, FASTFAT.SYS) returns error. Critically, if filter holding file open conflictingly, its own open ops might be visible prior. Filter might also directly return STATUS_SHARING_VIOLATION based on policy or if high in stack when violation returned.
    • Temporarily disabling security/backup software can help isolate cause.

32. Result Value Name: SUCCESS

33. Result Value Name: TIMEOUT

  • NTSTATUS Code: 0x0000010270
  • Primary Originating Layer/System (Potential): Network Stack Component (TCPIP.SYS, AFD.SYS), I/O Manager (ops with timeouts), various Device Drivers, Third-Party Filter Driver (esp. net/FS filters imposing time limits or causing delays).
  • Typical Operations: TCP Connect, TCP Send, TCP Receive, NtWaitForSingleObject (and related waits), DeviceIoControlFile (if IOCTL/driver implements timeout), ReadFile/WriteFile (some devices/flags).
  • Detailed Causation ("Why"):
    • Network Operation Timeout: TCP Connect: No response (SYN-ACK) from remote within retransmission timeout (remote down, connectivity issue, firewall silently dropping packets). TCP Send/Receive: No ACK for sent data, or no expected data received within protocol/app timeout.
    • Wait Operation Timeout: Wait function (NtWaitForSingleObject) expired because timeout interval elapsed before object(s) signaled.
    • Device I/O Timeout: Device driver failed to complete I/O within prescribed limit (non-responsive device, hardware errors, driver bug).
    • Filter Driver Induced Latency (CRITICAL): Third-party filter (FS, net, etc.) performing lengthy processing (deep inspection, encryption, slow remote lookups) adds significant latency. If latency exceeds timeout (app, I/O Mgr, higher driver), op may complete with STATUS_TIMEOUT.6
    • Application-Defined Timeout: App implements own timeout, aborts op. May manifest differently unless app cancels underlying I/O resulting in this status.
  • Procmon Diagnostic Clues ("How to Corroborate"):
    • Path column: Shows destination IP/port (network), target file/device.
    • Duration column: Duration of timed-out op approx equals timeout value. Examine durations of preceding related ops; long durations in underlying calls (filters?) can cause higher-level timeout.
    • Event Sequence: TCP Connect: Look for TCP:Retransmit events (Procmon/Wireshark) before TIMEOUT. Look for other network/device problems (HOST_UNREACHABLE, DEVICE_NOT_READY).
    • Stack Trace: Indicates component reporting timeout. TCPIP.SYS -> network-level timeout. Higher up -> app/framework timeout. Filter presence in stack of timed-out or preceding ops significant if involved in long processing.
    • External Tools: Network diagnostics (ping, tracert, Wireshark). Device diagnostics/system event logs.

III. Summary Table of Key Procmon Result Values

Summary of Key Procmon Result Values
Result Name
NTSTATUS Code
Primary Originating Layer(s)
Typical Operation Categories
Concise Meaning / Predominant Cause Category
SUCCESS
0x00000000
I/O Mgr, Obj Mgr, FS Driver, Net Stack, Reg Mgr, Filter Driver
File, Registry, Network, Process
Operation completed successfully.
ACCESS DENIED
0xC0000022
Sec Ref Mon, FS Driver, Reg Mgr, Third-Party Filter Driver
File, Registry, Process, Network
Insufficient rights or privilege; Frequently due to filter driver policy.
ADDRESS ALREADY EXISTS
0xC000020A
Net Stack (TCPIP.SYS, AFD.SYS), Third-Party Net Filter
Network (Bind)
Requested local network address/port is already in use.
BUFFER OVERFLOW
0x80000005
I/O Mgr, Kernel Drivers, Third-Party Filter Driver
File, Registry, Network (Query)
(Warning) Data returned, but buffer too small for all of it; partial data may be present. Common for variable-length queries.
BUFFER TOO SMALL
0xC0000023
I/O Mgr, Kernel Drivers, Third-Party Filter Driver
File, Registry, Network (Query)
(Error) Buffer too small to return any/minimal data; required size often indicated.
CONNECTION REFUSED
0xC0000236
Net Stack (TCPIP.SYS), Third-Party Net Filter
Network (TCP Connect)
Remote host actively refused connection (no listener or firewall RST).
DELETE PENDING
0xC0000056
FS Driver, Third-Party FS Filter
File
Operation on a file already marked for deletion; actual delete on last handle close.
DEVICE BUSY
0x80000011
Device Driver, I/O Mgr, Third-Party Filter Driver
File (Device I/O), Device
(Warning) Device is temporarily unable to process the request; often due to exclusive use or overload.
DIRECTORY NOT EMPTY
0xC0000101
FS Driver, Third-Party FS Filter
File (Directory Delete)
Attempt to delete a directory that still contains files or subdirectories.
DISK CORRUPT ERROR
0xC0000032
FS Driver, Storage Driver
File
File system structure on disk is corrupt and unusable.
END OF FILE
0xC0000011
FS Driver, I/O Mgr
File (Read)
Read operation reached or attempted to read beyond the end of the file. Normal for sequential reads.
FILE LOCKED WITH ONLY READERS
0x0000012A
FS Driver, Third-Party FS Filter
File (Lock)
(Informational) Lock successful, but file already locked by others for read access.
FILE LOCKED WITH WRITERS
0x0000012B
FS Driver, Third-Party FS Filter
File (Lock)
(Informational) Lock successful, but file already locked by others allowing write access.
FILE LOCK CONFLICT
0xC0000054
FS Driver, Third-Party FS Filter
File (Lock, Read/Write)
Requested byte-range lock conflicts with an existing lock.
HOST UNREACHABLE
0xC000023D
Net Stack (TCPIP.SYS), Third-Party Net Filter
Network (Connect, Send)
No network route to the destination host or ARP failure; Can be due to firewall silently dropping packets.
INSUFFICIENT RESOURCES
0xC000009A
Mem Mgr, I/O Mgr, Drivers, Third-Party Filter Driver
File, Registry, Network, Process
System lacks resources (e.g., kernel memory pool, handles); Can be due to filter driver leaks/consumption.
INVALID HANDLE
0xC0000008
Obj Mgr, I/O Mgr, Drivers
File, Registry, Process, Generic
Handle provided is not valid, closed, or of wrong type.
INVALID PARAMETER
0xC000000D
I/O Mgr, Obj Mgr, Any Driver, Third-Party Filter Driver
File, Registry, Network, Process
Invalid flags, buffer, value, or inconsistent parameters passed to API; Filters may have stricter validation.
KEY DELETED
0xC000017C
Reg Mgr, Third-Party Reg Filter
Registry
Operation on a registry key already marked for deletion.
LOCAL DISCONNECT
0xC000013B
Net Stack (TCPIP.SYS, AFD.SYS), Third-Party Net Filter
Network (TCP Send/Receive)
Local application/stack initiated connection termination; Can be filter driver action.
NAME NOT FOUND
0xC0000034
Obj Mgr, FS Driver, Reg Mgr, Net Stack (DNS), Third-Party Filter Driver
File, Registry, Network
Object/file/key/host not found; Can be filter driver hiding/blocking or failed DNS.
NOT A DIRECTORY
0xC0000103
FS Driver, Obj Mgr
File
Operation requires a directory, but target is a file. (Note: 0xC0000103 also used for STATUS_PENDING).
NOT SUPPORTED
0xC00000BB
Any Driver, I/O Mgr, Third-Party Filter Driver
File, Registry, Network, Device
Requested operation or parameter is not supported by target; Filters may not support all underlying operations.
OBJECT NAME COLLISION
0xC0000035
Obj Mgr, FS Driver, Reg Mgr, Third-Party Filter Driver
File, Registry (Create)
Attempt to create an object that already exists, and overwrite not allowed.
OBJECT PATH NOT FOUND
0xC000003A
Obj Mgr, FS Driver, Reg Mgr
File, Registry
An intermediate directory/key in the specified path does not exist.
PENDING
0x00000103
I/O Mgr, Drivers, Third-Party Filter Driver
File, Network (Async I/O)
(Informational) Asynchronous operation initiated, completion will occur later.
PORT UNREACHABLE
0xC000023F
Net Stack (TCPIP.SYS), Third-Party Net Filter
Network (UDP Send)
No service listening on remote UDP port (ICMP Port Unreachable received).
PRIVILEGE NOT HELD
0xC0000061
Sec Ref Mon
File, Registry, Process, System
Caller lacks a required privilege for the operation (e.g., SeBackupPrivilege).
REGISTRY CORRUPT
0xC000014C
Reg Mgr
Registry
Registry hive file is corrupt on disk or in memory. Serious system error.
REMOTE DISCONNECT
0xC000013C
Net Stack (TCPIP.SYS, AFD.SYS), Third-Party Net Filter
Network (TCP Send/Receive)
Remote peer initiated connection termination (normal close or error).
REPARSE
0x00000104
Obj Mgr, FS Driver, Third-Party Filter Driver
File (Path Parsing)
(Informational) Reparse point encountered (symlink, junction, filter tag); operation needs re-evaluation/redirection.
SHARING VIOLATION
0xC0000043
FS Driver, Third-Party Filter Driver
File (Open)
File open request conflicts with existing open handle's sharing modes; Often caused by filter driver holding file open.
TIMEOUT
0x00000102
Net Stack, I/O Mgr, Device Drivers, Third-Party Filter Driver
Network (Connect/Send/Receive), Wait Ops, Device I/O
Operation did not complete within timeout period; Can be network issue, device non-response, or latency induced by filter driver processing.
Note: This table summarizes key results. Third-party filter drivers are a frequent factor, especially for ACCESS DENIED, SHARING VIOLATION, INSUFFICIENT RESOURCES, REPARSE, and TIMEOUT results. Refer to the detailed catalog entries for specifics.

Works Cited

  1. Process Monitor (ProcMon) Tutorial - David Maiolo, accessed May 13, 2025, https://www.davidmaiolo.com/2018/03/12/process-monitor-procmon-tutorial/
  2. 2295: Collecting Process Monitor log - Acronis Support Portal, accessed May 13, 2025, https://care.acronis.com/s/article/Collecting-Process-Monitor-Log?language=en_US
  3. Use Process Monitor to create real-time event logs - ThreatDown Support, accessed May 13, 2025, https://support.threatdown.com/hc/en-us/articles/4413798945811-Use-Process-Monitor-to-create-real-time-event-logs
  4. Process Monitor (ProcMon) installation and usage guide - Thomson Reuters, accessed May 13, 2025, https://www.thomsonreuters.com/content/helpandsupp/en-us/help/gofileroom/get-started/set-up/process-monitor-procmon-installation.html
  5. Process Monitor X - Extended ProcMon-like tool based on Event ..., accessed May 13, 2025, https://www.edugeek.net/forums/topic/172704-process-monitor-x-extended-procmon-like-tool-based-on-event-tracing-for-windows/
  6. Minifilter Diagnostics | Microsoft Learn, accessed May 13, 2025, https://learn.microsoft.com/en-us/windows-hardware/test/assessments/minifilter-diagnostics
  7. How To Use Procmon Track Low Level Driver - 路遥之家, accessed May 13, 2025, https://crushonme.github.io/wiki/How-To-Use-Procmon-Track-Low-Level-Driver/
  8. Registry Filter Drivers (Part 1) - Jeremy Hurren, accessed May 13, 2025, https://lordjeb.com/2014/01/14/registry-filter-drivers-part-1/
  9. Process Monitor - Documentation & Help, accessed May 13, 2025, https://documentation.help/Process-Monitor/documentation.pdf
  10. Design issues of modern EDRs: bypassing ETW-based solutions - BINARLY, accessed May 13, 2025, https://www.binarly.io/blog/design-issues-of-modern-edrs-bypassing-etw-based-solutions
  11. What is IRP in Computing? (I/O Request Packet) - 60sec.site, accessed May 13, 2025, https://60sec.site/terms/what-is-irp-in-computing-io-request-packet
  12. What is the difference between an IOCTL and an IRP - Stack Overflow, accessed May 13, 2025, https://stackoverflow.com/questions/18901467/what-is-the-difference-between-an-ioctl-and-an-irp
  13. Completing I/O Requests - TU Chemnitz, accessed May 13, 2025, https://www-user.tu-chemnitz.de/~heha/oney_wdm/ch05d.htm
  14. Article - TDI Overview - CodeMachine, accessed May 13, 2025, https://codemachine.com/articles/tdi_overview.html
  15. What The Filter (WTF) is Going on With Windows Filtering Platform (WFP)? - Zero Networks, accessed May 13, 2025, https://zeronetworks.com/blog/wtf-is-going-on-with-wfp
  16. Network Sniffing on Microsoft Windows - In Detail, accessed May 13, 2025, http://gary-nebbett.blogspot.com/2018/06/gary-gary-2-2132-2018-06-06t153500z.html
  17. Procmon Basics - Concurrency, accessed May 13, 2025, https://concurrency.com/blog/procmon-basics/
  18. ntoskrnl.exe - Wikipedia, accessed May 13, 2025, https://en.wikipedia.org/wiki/Ntoskrnl.exe
  19. Use NTSTATUS Values - Windows drivers | Microsoft Learn, accessed May 13, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/using-ntstatus-values
  20. "STATUS_SHARING_VIOLATION" error message when you try to open a highly fragmented file on a computer that is running Windows 7 or Windows Server 2008 R2 - Microsoft Support, accessed May 13, 2025, https://support.microsoft.com/en-us/topic/-status-sharing-violation-error-message-when-you-try-to-open-a-highly-fragmented-file-on-a-computer-that-is-running-windows-7-or-windows-server-2008-r2-be899c3b-8c5a-c883-ce0d-055d258a9178
  21. ntstatus.h - CodeMachine, accessed May 13, 2025, https://codemachine.com/downloads/win10.1803/ntstatus.h
  22. "STATUS_OBJECT_NAME_NOT_FOUND" error message when you open a newly-created file in a shared folder in Windows 7 or in Windows Server 2008 R2 - Microsoft Support, accessed May 13, 2025, https://support.microsoft.com/en-us/topic/-status-object-name-not-found-error-message-when-you-open-a-newly-created-file-in-a-shared-folder-in-windows-7-or-in-windows-server-2008-r2-111de51c-ea2e-8c68-3ce9-9185a93bb8b8
  23. go-ntdll/ntstatus_generated.go at master - GitHub, accessed May 13, 2025, https://github.com/hillu/go-ntdll/blob/master/ntstatus_generated.go
  24. Unable to delete registry key that is causing problems with Windows Installer on Win 7, accessed May 13, 2025, https://answers.microsoft.com/en-us/windows/forum/all/unable-to-delete-registry-key-that-is-causing/a81adda2-8e17-4cb1-94ee-56ab095ab2a6
  25. Windows 10 error code 0xc000014c - Microsoft Community, accessed May 13, 2025, https://answers.microsoft.com/en-us/windows/forum/all/windows-10-error-code-0xc000014c/689520d8-c234-43a8-9c0e-4fcc79cc81ec
  26. NTSTATUS codes - CSDN博客, accessed May 13, 2025, https://blog.csdn.net/weixin_30485799/article/details/94858796
  27. ntstatus package - github.com/oiweiwei/go-msrpc/msrpc/erref/ntstatus - Go Packages, accessed May 13, 2025, https://pkg.go.dev/github.com/oiweiwei/go-msrpc/msrpc/erref/ntstatus
  28. Forward the read request from raw pdo - #4 by Tim_Roberts - OSR Developer Community, accessed May 13, 2025, https://community.osr.com/t/forward-the-read-request-from-raw-pdo/54088/4
  29. How to Fix Failed NTFS.sys in Windows 10 - EaseUS Software, accessed May 13, 2025, https://www.easeus.com/resource/fix-ntfs.sys-missing-or-corrupt.html
  30. How do I fix blue screen Stop Code NTFS FILE SYSTEM : r/Windows10 - Reddit, accessed May 13, 2025, https://www.reddit.com/r/Windows10/comments/kegdrs/how_do_i_fix_blue_screen_stop_code_ntfs_file/
  31. BSOD What Failed NTFS.SYS - Microsoft Community, accessed May 13, 2025, https://answers.microsoft.com/en-us/windows/forum/all/bsod-what-failed-ntfssys/63d790bc-15b4-40ea-a424-8a44897be576
  32. [Fixed] FAT FILE SYSTEM [fastfat.sys] BSoD Error on Windows - Stellar Data Recovery, accessed May 13, 2025, https://www.stellarinfo.com/blog/windows-10-fat-file-system-fastfat-bsod-fix/
  33. Bug Check Code Reference - Windows drivers - Learn Microsoft, accessed May 13, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/bug-check-code-reference2
  34. using-ntstatus-values.md - GitHub, accessed May 13, 2025, https://github.com/MicrosoftDocs/windows-driver-docs/blob/staging/windows-driver-docs-pr/kernel/using-ntstatus-values.md
  35. Windows-driver-samples/filesys/cdfs/fsctrl.c at main - GitHub, accessed May 13, 2025, https://github.com/Microsoft/Windows-driver-samples/blob/master/filesys/cdfs/fsctrl.c
  36. Windows-driver-samples/filesys/cdfs/cachesup.c at main - GitHub, accessed May 13, 2025, https://github.com/microsoft/Windows-driver-samples/blob/master/filesys/cdfs/cachesup.c
  37. "Error 720: Can't connect to a VPN Connection" when you try to establish a VPN connection - Windows Server | Microsoft Learn, accessed May 13, 2025, https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/troubleshoot-error-720-when-establishing-a-vpn-connection
  38. Samba4 join NT_STATUS_CONNECTION_REFUSED error - Server Fault, accessed May 13, 2025, https://serverfault.com/questions/900576/samba4-join-nt-status-connection-refused-error
  39. making TDI (tcp) Calls from a scsi miniport at boot time - OSR Developer Community, accessed May 13, 2025, https://community.osr.com/t/making-tdi-tcp-calls-from-a-scsi-miniport-at-boot-time/33119
  40. NTSTATUS - MS-ERREF - Learn Microsoft, accessed May 13, 2025, https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/87fba13e-bf06-450e-83b1-9241dc81e781
  41. STATUS_REMOTE_DISCONNECT - Free Pascal, accessed May 13, 2025, https://www.freepascal.org/daily/packages/winunits-jedi/jwantstatus/status_remote_disconnect.html
  42. STATUS_LOCAL_DISCONNECT - Free Pascal, accessed May 13, 2025, https://www.freepascal.org/daily/packages/winunits-jedi/jwantstatus/status_local_disconnect.html
  43. STATUS_ADDRESS_ALREADY, accessed May 13, 2025, https://www.freepascal.org/daily/packages/winunits-jedi/jwantstatus/status_address_already_exists.html
  44. NPF functions - WinPcap, accessed May 13, 2025, https://www.winpcap.org/docs/docs_41b5/html/group__NPF__code.html
  45. drivers/storage/class/classpnp/class.c File Reference - ReactOS, accessed May 13, 2025, https://doxygen.reactos.org/d9/dd9/drivers_2storage_2class_2classpnp_2class_8c.html
  46. Microsoft Windows library files - Wikipedia, accessed May 13, 2025, https://en.wikipedia.org/wiki/Microsoft_Windows_library_files
  47. Windows API System Calls : r/SentinelOneXDR - Reddit, accessed May 13, 2025, https://www.reddit.com/r/SentinelOneXDR/comments/1g7cw4p/windows_api_system_calls/
  48. How to convert specific NTSTATUS value to the Hresult? - Stack Overflow, accessed May 13, 2025, https://stackoverflow.com/questions/25566234/how-to-convert-specific-ntstatus-value-to-the-hresult
  49. RtlNtStatusToDosError function (winternl.h) - Win32 apps - Learn Microsoft, accessed May 13, 2025, https://learn.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-rtlntstatustodoserror
  50. shell32.dll and desktop.ini - Microsoft Community, accessed May 13, 2025, https://answers.microsoft.com/en-us/windows/forum/all/shell32dll-and-desktopini/c2f10a77-7568-4bcb-af71-7ee17e3a6d77
  51. I have open up shell32.dll in a directory and extracted all of the icons from it... - Microsoft Community, accessed May 13, 2025, https://answers.microsoft.com/en-us/windows/forum/all/i-have-open-up-shell32dll-in-a-directory-and/b8f142c5-a63d-437b-af9a-84224113b34f
  52. SHFileOperationA function (shellapi.h) - Win32 apps - Learn Microsoft, accessed May 13, 2025, https://learn.microsoft.com/en-us/windows/win32/api/shellapi/nf-shellapi-shfileoperationa
  53. About hooking SHFileOperation - madshi.net, accessed May 13, 2025, http://forum.madshi.net/viewtopic.php?t=28927
  54. Controlling and Monitoring a Network with User Mode and Driver Mode Techniques: Overview, Pros and Cons, WFP Implementation | Apriorit, accessed May 13, 2025, https://www.apriorit.com/dev-blog/688-driver-controlling-and-monitoring-networks-with-user-mode-and-driver-mode-techniques
  55. Windows Filtering Platform - Win32 apps - Learn Microsoft, accessed May 13, 2025, https://learn.microsoft.com/en-us/windows/win32/fwp/windows-filtering-platform-start-page
  56. Receiving Data in a Filter Driver - Windows - Learn Microsoft, accessed May 13, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/network/receiving-data-in-a-filter-driver
  57. Handling Notifications - Windows drivers | Microsoft Learn, accessed May 13, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/handling-notifications
  58. Advanced Procmon Part 2 – Filtering inclusions - Guy Leech's Blog - WordPress.com, accessed May 13, 2025, https://guyrleech.wordpress.com/2015/06/22/advanced-procmon-part-2-filtering-inclusions/
  59. PsSetCreateProcessNotifyRoutin, accessed May 13, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntddk/nf-ntddk-pssetcreateprocessnotifyroutineex
  60. Mini-filter and sharing violation in post-cleanup callback - OSR Developer Community, accessed May 13, 2025, https://community.osr.com/t/mini-filter-and-sharing-violation-in-post-cleanup-callback/24822
  61. Datacom Server TCPIP error 10061 WSAECONNREFUSED Connection Refused, accessed May 13, 2025, https://knowledge.broadcom.com/external/article/203992/datacom-server-tcpip-error-10061-wsaecon.html
  62. Windows 10 minifilter driver STATUS_ACCESS_DENIED not working on blocking DELETE operation. - Microsoft Community, accessed May 13, 2025, https://answers.microsoft.com/en-us/windows/forum/all/windows-10-minifilter-driver-statusaccessdenied/8f784d44-5e47-4579-8438-7a04fc6cd3f6
  63. ProcMon - catching incoming file accesses from the network - Super User, accessed May 13, 2025, https://superuser.com/questions/909906/procmon-catching-incoming-file-accesses-from-the-network
  64. SimRep File System Minifilter Driver - Code Samples | Microsoft Learn, accessed May 13, 2025, https://learn.microsoft.com/en-us/samples/microsoft/windows-driver-samples/simrep-file-system-minifilter-driver/
  65. IRP Tracking for File System Mini filter drivers - NTFSD - OSR Developer Community, accessed May 13, 2025, https://community.osr.com/t/irp-tracking-for-file-system-mini-filter-drivers/42873
  66. The case of the stack trace that wouldn't (trace) - Marc Durdin's Blog, accessed May 13, 2025, https://marc.durdin.net/2013/09/the-case-of-the-stack-trace-that-wouldnt/
  67. Tools for Minifilter Development and Testing - Windows drivers - Learn Microsoft, accessed May 13, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/ifs/development-and-testing-tools
  68. Performance and consistency issues when modules or driver are loaded - SQL Server, accessed May 13, 2025, https://learn.microsoft.com/en-us/troubleshoot/sql/database-engine/performance/performance-consistency-issues-filter-drivers-modules
  69. Defining New NTSTATUS Values - Windows drivers - Learn Microsoft, accessed May 13, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/defining-new-ntstatus-values
  70. [MS-ERREF]: NTSTATUS Values | Microsoft Learn, accessed May 13, 2025, https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55
  71. System Error Codes (0-499) (WinError.h) - Win32 apps | Microsoft Learn, accessed May 13, 2025, https://learn.microsoft.com/en-us/windows/win32/debug/system-error-codes--0-499-
  72. [MS-ERREF]: Win32 Error Codes - Learn Microsoft, accessed May 13, 2025, https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/18d8fbe8-a967-4f1c-ae50-99ca8e491d2d
  73. NTSTATUS - Fictional Memory, accessed May 13, 2025, http://kirkshoop.github.io/2011/09/20/ntstatus.html
  74. redirection with STATUS_REPARSE and FltReissueSynchronousIo - NTFSD, accessed May 13, 2025, https://community.osr.com/t/redirection-with-status-reparse-and-fltreissuesynchronousio/46413
  75. Solving Access Denied Errors Using Process Monitor | Mark S. Rasmussen, accessed May 13, 2025, https://improve.dk/solving-access-denied-errors-using-process-monitor/
  76. Process Monitor: Entries with BUFFER OVERFLOW - Super User, accessed May 13, 2025, https://superuser.com/questions/491597/process-monitor-entries-with-buffer-overflow
  77. Diagnostic Logs | Turbo Documentation, accessed May 13, 2025, https://docs.turbo.net/client/turbo-vm/troubleshooting/analyzing-logs.html
  78. what does STATUS_PENDING mean? - Stack Overflow, accessed May 13, 2025, https://stackoverflow.com/questions/27793411/what-does-status-pending-mean
  79. Forward the read request from raw pdo - NTDEV - OSR Developer Community, accessed May 13, 2025, https://community.osr.com/t/forward-the-read-request-from-raw-pdo/54088
  80. STATUS_REGISTRY_CORRUPT in winapi::shared::ntstatus - Rust - Docs.rs, accessed May 13, 2025, https://docs.rs/winapi/latest/aarch64-pc-windows-msvc/winapi/shared/ntstatus/constant.STATUS_REGISTRY_CORRUPT.html
  81. About File System Filter Drivers - Windows drivers - Learn Microsoft, accessed May 13, 2025, https://learn.microsoft.com/en-us/windows-hardware/drivers/ifs/about-file-system-filter-drivers

More from Thanh Trung Le

All posts

Related posts