Crash in falconshelper, Analyzed 9 dumps, total processed 126, rate equals 7.14%

Top 1: Version = 2.7224.1000.625, Total count = 9

dump count = 1

ChildEBP RetAddr  
050ff358 6b398474 KERNELBASE!RaiseException+0x62
050ff440 74ab070d FalconsHelper!SyncHttpPost2+0x114
050ff460 00000000 wininet!DeleteUrlCacheEntryW+0x8d

dump count = 1

ChildEBP RetAddr  
070bf850 77b12348 ntdll!LdrpCleanupThreadTlsData+0x49
070bf86c 77b12229 ntdll!LdrpFreeTls+0x87
070bf900 77b123e3 ntdll!LdrShutdownThread+0x168
070bf910 76e719e8 ntdll!RtlExitUserThread+0x2a
070bf924 7752d5b2 KERNELBASE!FreeLibraryAndExitThread+0x5f
070bf934 045c7041 kernel32!FreeLibraryAndExitThreadStub+0x10
070bf948 045c712f FalconsHelper!common_end_thread+0x4d
070bf954 045c6f9c FalconsHelper!_endthreadex+0xd
070bf98c 7751343d FalconsHelper!thread_start<unsigned int (__stdcall*)(void *)>+0x5d
070bf998 77af9812 kernel32!BaseThreadInitThunk+0xe
070bf9d8 77af97e5 ntdll!__RtlUserThreadStart+0x70
070bf9f0 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
075aee7c 7795e163 ntdll!RtlpLowFragHeapFree+0x31
075aee94 756b14bd ntdll!RtlFreeHeap+0x105
075aeea8 0f0d575f kernel32!HeapFree+0x14
075aeebc 0f0c3ba3 FalconsHelper!_free_base+0x1c
075aeecc 0f074822 FalconsHelper!free+0x18
075aeed8 0f076a46 FalconsHelper!operator delete+0xb
075af0e0 0f0620cd FalconsHelper!EncryptHelper::EncryptStr+0x276
075af340 0f0652e1 FalconsHelper!FalconsMain::IsAllowedByControlCenter+0x14cd
075af628 0f0681c7 FalconsHelper!FalconsMain::OnRecvBrowserEvent+0x1301
075af648 758d630a FalconsHelper!FalconsMain::WndPro+0xf7
075af674 758d6d4a user32!InternalCallWinProc+0x23
075af6ec 758d77d7 user32!UserCallWinProcCheckWow+0x109
075af74c 758d789a user32!DispatchMessageWorker+0x3b5
075af75c 0f06747c user32!DispatchMessageW+0xf
075af968 0f0680bf FalconsHelper!FalconsMain::Run+0x31c
075af970 0f0c5ab7 FalconsHelper!FalconsMain::ThreadProc+0xf
075af9a8 756b347d FalconsHelper!thread_start<unsigned int (__stdcall*)(void *)>+0x58
075af9b4 77969762 kernel32!BaseThreadInitThunk+0xe
075af9f4 77969735 ntdll!__RtlUserThreadStart+0x70
075afa0c 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
0582efd4 0582f0fc KERNELBASE!RaiseException+0x62
WARNING: Frame IP not in any known module. Following frames may be wrong.
0582f0d8 77cf7b14 0x582f0fc
0582f1b4 77cb3c56 ntdll!RtlpFreeHeapInternal+0x7aa
0582f280 7a731556 ntdll!RtlFreeHeap+0x46
0582f294 00000000 FalconsHelper!ATL::CWin32Heap::Free+0x16

dump count = 1

ChildEBP RetAddr  
0522f1f8 573f8474 KERNELBASE!RaiseException+0x62
0522f2d0 770b035d FalconsHelper!SyncHttpPost2+0x114
0522f32c 312e3432 ntdll!RtlpFreeHeapInternal+0x796
WARNING: Frame IP not in any known module. Following frames may be wrong.
0522f3a0 573d1556 0x312e3432
0522f3b4 037e45d8 FalconsHelper!ATL::CWin32Heap::Free+0x16
0522f404 7706f2c6 0x37e45d8
0522f434 57455084 ntdll!RtlFreeHeap+0x46
0522f4a8 573f57e1 FalconsHelper!free+0x18
0522f790 573f86c7 FalconsHelper!FalconsMain::OnRecvBrowserEvent+0x1301
0522f7b0 75182d63 FalconsHelper!FalconsMain::WndPro+0xf7
0522f7dc 75173b26 user32!_InternalCallWinProc+0x2b
0522f8d4 751723e5 user32!UserCallWinProcCheckWow+0x4c6
0522f950 75171f30 user32!DispatchMessageWorker+0x4a5
0522f95c 573f797c user32!DispatchMessageW+0x10
0522fb68 573f85bf FalconsHelper!FalconsMain::Run+0x31c
0522fb70 57456f97 FalconsHelper!FalconsMain::ThreadProc+0xf
0522fba8 75ab7ba9 FalconsHelper!thread_start<unsigned int (__stdcall*)(void *)>+0x58
0522fbb8 7708bb3b kernel32!BaseThreadInitThunk+0x19
0522fc10 7708babf ntdll!__RtlUserThreadStart+0x2b
0522fc20 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
003debac 00000000 FalconsHelper!obfuscated_WININET+0x40

dump count = 1

ChildEBP RetAddr  
0163f018 75d10141 ntdll!RtlQueryInformationActiveActivationContext+0x15
0163f2c4 75d0fb27 user32!VerNtUserCreateWindowEx+0x156
0163f3ac 75d0f9f8 user32!CreateWindowInternal+0x12b
0163f3ec 747e381f user32!CreateWindowExW+0x38
0163f43c 747ef8bf urlmon!CTransaction::GetNotificationWnd+0x11f
0163f554 747eb4c3 urlmon!CBinding::StartBinding+0x180f
0163f5b4 747eb073 urlmon!CUrlMon::StartBinding+0x1c3
0163f5e0 747e0d6f urlmon!CUrlMon::BindToStorage+0x83
0163f62c 74882c0e urlmon!CBaseBSCB::KickOffDownload+0x8f
0163f864 578adcc5 urlmon!URLDownloadToCacheFileW+0x8e
0163fcc0 578aba49 FalconsHelper!CStatisticImpl::InternalDownloadFile+0xa5
0163fd1c 578f6f97 FalconsHelper!CStatisticImpl::DownloadThreadProc+0x139
0163fd54 766dfef9 FalconsHelper!thread_start<unsigned int (__stdcall*)(void *)>+0x58
0163fd64 77987bbe kernel32!BaseThreadInitThunk+0x19
0163fdc0 77987b8e ntdll!__RtlUserThreadStart+0x2f
0163fdd0 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
06d6f63c 772dec13 ntdll!LdrpUpdateLoadCount2+0x4d
06d6f7b4 7731d3ff ntdll!LdrpLoadDll+0x544
06d6f7f0 754e2e6a ntdll!LdrLoadDll+0xc7
06d6f838 76c6483c KERNELBASE!LoadLibraryExW+0x233
06d6f84c 0f438dd1 kernel32!LoadLibraryW+0x11
06d6fa70 0f43a89d FalconsHelper!LuaScriptHelper::InitLua+0xc1
06d6faf8 0f43a7bb FalconsHelper!CWorkThread::_ThreadProc+0xcd
06d6fb00 76c6343d FalconsHelper!CWorkThread::_StaticThreadProc+0xb
06d6fb0c 772d9812 kernel32!BaseThreadInitThunk+0xe
06d6fb4c 772d97e5 ntdll!__RtlUserThreadStart+0x70
06d6fb64 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
0602f428 78f98474 KERNELBASE!RaiseException+0x62
0602f4ac 752a2386 FalconsHelper!SyncHttpPost2+0x114
0602f5d0 78f71556 KERNELBASE!CloseHandle+0x26
0602f5e4 06767c60 FalconsHelper!ATL::CWin32Heap::Free+0x16
WARNING: Frame IP not in any known module. Following frames may be wrong.
0602f634 77263d36 0x6767c60
0602f664 78ff5084 ntdll!RtlFreeHeap+0x46
0602f6d8 78f957e1 FalconsHelper!free+0x18
0602f9c0 78f986c7 FalconsHelper!FalconsMain::OnRecvBrowserEvent+0x1301
0602f9e0 755e171b FalconsHelper!FalconsMain::WndPro+0xf7
0602fa0c 755d7e8a user32!_InternalCallWinProc+0x2b
0602faf4 755d67c1 user32!UserCallWinProcCheckWow+0x33a
0602fb70 755d62e0 user32!DispatchMessageWorker+0x4d1
0602fb7c 78f9797c user32!DispatchMessageW+0x10
0602fd88 78f985bf FalconsHelper!FalconsMain::Run+0x31c
0602fd90 78ff6f97 FalconsHelper!FalconsMain::ThreadProc+0xf
0602fdc8 75b8fcc9 FalconsHelper!thread_start<unsigned int (__stdcall*)(void *)>+0x58
0602fdd8 7728809e kernel32!BaseThreadInitThunk+0x19
0602fe34 7728806e ntdll!__RtlUserThreadStart+0x2f
0602fe44 00000000 ntdll!_RtlUserThreadStart+0x1b