set the following conditional break point
0 d 81648962     0001 (0001) nt!ExAllocatePoolWithQuotaTag “j poi(esp+c)
=20706349 ‘.reload /user;!thread -1 7;gc’;’gc'”

Here we go.
kd> g
Loading User Symbols
…………………………………………………………………………………………
THREAD 9b04c878  Cid 0b28.1200  Teb: 7ff8a000 Win32Thread: 00000000 RUNNING on processor 0
Not impersonating
DeviceMap                 832087c0
Owning Process            0       Image:         <Unknown>
Attached Process          89f34d90       Image:         rscorsvc.exe
Wait Start TickCount      36912          Ticks: 0
Context Switch Count      195            
UserTime                  00:00:00.109
KernelTime                00:00:00.921
*** ERROR: Module load completed but symbols could not be loaded for rish.dll
Win32 Start Address rish (0x3052e920)
Stack Init 974fb000 Current 974fac10 Base 974fb000 Limit 974f8000 Call 0
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
ChildEBP RetAddr  Args to Child             
974faca0 81813618 00000000 0000001c 20706349 nt!ExAllocatePoolWithQuotaTag
974face4 81822016 00000002 00000001 00000000 nt!IopAllocateMiniCompletionPacket+0x6f
974facf8 81813692 8930dd68 00000004 00000000 nt!IoSetIoCompletionEx+0x19
974fad1c 818136e7 8930dd68 00000004 00000000 nt!IoSetIoCompletion+0x1e
974fad48 8165ca7a 00000650 00000004 00000000 nt!NtSetIoCompletion+0x4c
974fad48 77219a94 00000650 00000004 00000000 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 974fad64)
0632ff00 77218fa4 76c78bff 00000650 00000004 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
0632ff04 76c78bff 00000650 00000004 00000000 ntdll!ZwSetIoCompletion+0xc (FPO: [5,0,0])
0632ff24 30527ede 00000650 00000000 00000004 kernel32!PostQueuedCompletionStatus+0x1d (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
0632ff80 3052e99f 00000000 76c74911 046d8b30 rish+0x27ede
0632ff94 771fe4b6 046d8b30 711b7e1b 00000000 rish+0x2e99f
0632ffd4 771fe489 3052e920 046d8b30 ffffffff ntdll!__RtlUserThreadStart+0x23 (FPO: [Non-Fpo])
0632ffec 00000000 3052e920 046d8b30 00000000 ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])
Loading User Symbols
…………………………………………………………………………………………
THREAD 9b04c878  Cid 0b28.1200  Teb: 7ff8a000 Win32Thread: 00000000 RUNNING on processor 0
Not impersonating
DeviceMap                 832087c0
Owning Process            0       Image:         <Unknown>
Attached Process          89f34d90       Image:         rscorsvc.exe
Wait Start TickCount      36913          Ticks: 0
Context Switch Count      197            
UserTime                  00:00:00.109
KernelTime                00:00:00.937
*** ERROR: Module load completed but symbols could not be loaded for rish.dll
Win32 Start Address rish (0x3052e920)
Stack Init 974fb000 Current 974fabcc Base 974fb000 Limit 974f8000 Call 0
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
ChildEBP RetAddr  Args to Child             
974faca0 81813618 00000000 0000001c 20706349 nt!ExAllocatePoolWithQuotaTag
974face4 81822016 00000002 00000001 00000000 nt!IopAllocateMiniCompletionPacket+0x6f
974facf8 81813692 8930dd68 00000004 00000000 nt!IoSetIoCompletionEx+0x19
974fad1c 818136e7 8930dd68 00000004 00000000 nt!IoSetIoCompletion+0x1e
974fad48 8165ca7a 00000650 00000004 00000000 nt!NtSetIoCompletion+0x4c
974fad48 77219a94 00000650 00000004 00000000 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 974fad64)
0632ff00 77218fa4 76c78bff 00000650 00000004 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
0632ff04 76c78bff 00000650 00000004 00000000 ntdll!ZwSetIoCompletion+0xc (FPO: [5,0,0])
0632ff24 30527ede 00000650 00000000 00000004 kernel32!PostQueuedCompletionStatus+0x1d (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
0632ff80 3052e99f 00000000 76c74911 046d8b30 rish+0x27ede
0632ff94 771fe4b6 046d8b30 711b7e1b 00000000 rish+0x2e99f
0632ffd4 771fe489 3052e920 046d8b30 ffffffff ntdll!__RtlUserThreadStart+0x23 (FPO: [Non-Fpo])
0632ffec 00000000 3052e920 046d8b30 00000000 ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])
Loading User Symbols
…………………………………………………………………………………………
THREAD 9b04c878  Cid 0b28.1200  Teb: 7ff8a000 Win32Thread: 00000000 RUNNING on processor 0
Not impersonating
DeviceMap                 832087c0
Owning Process            0       Image:         <Unknown>
Attached Process          89f34d90       Image:         rscorsvc.exe
Wait Start TickCount      36914          Ticks: 0
Context Switch Count      199            
UserTime                  00:00:00.109
KernelTime                00:00:00.953
*** ERROR: Module load completed but symbols could not be loaded for rish.dll
Win32 Start Address rish (0x3052e920)
Stack Init 974fb000 Current 974fabcc Base 974fb000 Limit 974f8000 Call 0
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
ChildEBP RetAddr  Args to Child             
974faca0 81813618 00000000 0000001c 20706349 nt!ExAllocatePoolWithQuotaTag
974face4 81822016 00000002 00000001 00000000 nt!IopAllocateMiniCompletionPacket+0x6f
974facf8 81813692 8930dd68 00000004 00000000 nt!IoSetIoCompletionEx+0x19
974fad1c 818136e7 8930dd68 00000004 00000000 nt!IoSetIoCompletion+0x1e
974fad48 8165ca7a 00000650 00000004 00000000 nt!NtSetIoCompletion+0x4c
974fad48 77219a94 00000650 00000004 00000000 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 974fad64)
0632ff00 77218fa4 76c78bff 00000650 00000004 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
0632ff04 76c78bff 00000650 00000004 00000000 ntdll!ZwSetIoCompletion+0xc (FPO: [5,0,0])
0632ff24 30527ede 00000650 00000000 00000004 kernel32!PostQueuedCompletionStatus+0x1d (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
0632ff80 3052e99f 00000000 76c74911 046d8b30 rish+0x27ede
0632ff94 771fe4b6 046d8b30 711b7e1b 00000000 rish+0x2e99f
0632ffd4 771fe489 3052e920 046d8b30 ffffffff ntdll!__RtlUserThreadStart+0x23 (FPO: [Non-Fpo])
0632ffec 00000000 3052e920 046d8b30 00000000 ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])
Loading User Symbols
…………………………………………………………………………………………
THREAD 9b04c878  Cid 0b28.1200  Teb: 7ff8a000 Win32Thread: 00000000 RUNNING on processor 0
Not impersonating
DeviceMap                 832087c0
Owning Process            0       Image:         <Unknown>
Attached Process          89f34d90       Image:         rscorsvc.exe
Wait Start TickCount      36915          Ticks: 0
Context Switch Count      200            
UserTime                  00:00:00.109
KernelTime                00:00:00.968
*** ERROR: Module load completed but symbols could not be loaded for rish.dll
Win32 Start Address rish (0x3052e920)
Stack Init 974fb000 Current 974fa6b4 Base 974fb000 Limit 974f8000 Call 0
Priority 8 BasePriority 8 PriorityDecrement 0 IoPriority 2 PagePriority 5
ChildEBP RetAddr  Args to Child             
974faca0 81813618 00000000 0000001c 20706349 nt!ExAllocatePoolWithQuotaTag
974face4 81822016 00000002 00000001 00000000 nt!IopAllocateMiniCompletionPacket+0x6f
974facf8 81813692 8930dd68 00000004 00000000 nt!IoSetIoCompletionEx+0x19
974fad1c 818136e7 8930dd68 00000004 00000000 nt!IoSetIoCompletion+0x1e
974fad48 8165ca7a 00000650 00000004 00000000 nt!NtSetIoCompletion+0x4c
974fad48 77219a94 00000650 00000004 00000000 nt!KiFastCallEntry+0x12a (FPO: [0,3] TrapFrame @ 974fad64)
0632ff00 77218fa4 76c78bff 00000650 00000004 ntdll!KiFastSystemCallRet (FPO: [0,0,0])
0632ff04 76c78bff 00000650 00000004 00000000 ntdll!ZwSetIoCompletion+0xc (FPO: [5,0,0])
0632ff24 30527ede 00000650 00000000 00000004 kernel32!PostQueuedCompletionStatus+0x1d (FPO: [Non-Fpo])
WARNING: Stack unwind information not available. Following frames may be wrong.
0632ff80 3052e99f 00000000 76c74911 046d8b30 rish+0x27ede
0632ff94 771fe4b6 046d8b30 711b7e1b 00000000 rish+0x2e99f
0632ffd4 771fe489 3052e920 046d8b30 ffffffff ntdll!__RtlUserThreadStart+0x23 (FPO: [Non-Fpo])
0632ffec 00000000 3052e920 046d8b30 00000000 ntdll!_RtlUserThreadStart+0x1b (FPO: [Non-Fpo])

Global Escalation Manager Tokyo
-fb