Crash in cfgrelay, Analyzed 2 dumps, total processed 223, rate equals 0.90%

Top 1: Version = 2.7224.1000.620, Total count = 2

dump count = 1

ChildEBP RetAddr  
041fdfd4 75d82458 rpcrt4!NdrpConformantStringMarshall+0xf1
041fdfec 75d82601 rpcrt4!NdrConformantStringMarshall+0x3e
041fe010 75d9eb61 rpcrt4!NdrpPointerMarshall+0x157
041fe028 75d9f0f6 rpcrt4!NdrPointerMarshall+0x30
041fe054 75df6747 rpcrt4!NdrpClientMarshal+0xf6
041fe46c 773ddf6d rpcrt4!NdrClientCall2+0x19a
041fe484 773ddeeb wininet!UrlCacheAddUrl+0x24
041fe504 773db090 wininet!CCacheServerContainer::AddUrl+0x85
041fe578 773daf51 wininet!CCacheClientContainer::AddUrl+0x109
041fe5dc 773daeab wininet!CommitUrlCacheEntryHelper+0x6d
041fe658 773dc2ba wininet!UrlCacheCommitFile+0x119
041fe6d4 773dc0f8 wininet!INTERNET_CONNECT_HANDLE_OBJECT::EndCacheWrite+0x164
041fe764 773dbf09 wininet!HTTP_REQUEST_HANDLE_OBJECT::LocalEndCacheWrite+0x1d6
041fe79c 773d8972 wininet!HTTP_REQUEST_HANDLE_OBJECT::HttpReadData_Fsm+0x448
041fe7b4 773d8930 wininet!CFsm_HttpReadData::RunSM+0x2a
041fe808 773cfa68 wininet!CFsm::Run+0x3b9
041fe830 7747640f wininet!DoFsm+0x60
041fe848 7745ba26 wininet!HttpReadData+0xc0
041fe870 773d76e0 wininet!QueryAvailable_Fsm+0x80
041fe884 773cf4f1 wininet!CFsm_QueryAvailable::RunSM+0x28
041fe8d8 773cfa68 wininet!CFsm::Run+0x161
041fe900 774547e3 wininet!DoFsm+0x60
041fe988 7719a9f5 wininet!InternetQueryDataAvailable+0x2d9
041febb8 77199d53 urlmon!CINet::INetDataAvailable+0x87
041febd0 771e1bb9 urlmon!CINet::INetRead+0x4c
041febe8 77198e54 urlmon!CINet::INetQueryInfo+0x90
041fec00 77198dd7 urlmon!CINet::OnINetInternal+0xd3
041fec14 77199237 urlmon!CINet::Continue+0x17
041fec2c 771991f9 urlmon!COInetProt::Continue+0x27
041fec64 7718f1a9 urlmon!CTransaction::OnINetCallback+0x202
041fec80 75f4c267 urlmon!TransactionWndProc+0x29
041fecac 75f4c367 user32!InternalCallWinProc+0x23
041fed24 75f4c999 user32!UserCallWinProcCheckWow+0x14b
041fed84 75f42bd1 user32!DispatchMessageWorker+0x357
041fed94 7719d5b2 user32!DispatchMessageA+0xf
041fedd0 7719d6c4 urlmon!CTransaction::CompleteOperation+0x9d
041ff288 771e19a7 urlmon!CTransaction::StartEx+0x1c8a
041ff30c 7719061c urlmon!CBinding::StartBinding+0x921
041ff358 77190457 urlmon!CUrlMon::StartBinding+0x1a6
041ff388 7719d773 urlmon!CUrlMon::BindToStorage+0x8e
041ff3d0 7719de94 urlmon!CBaseBSCB::KickOffDownload+0x93
041ff600 721e0855 urlmon!URLDownloadToCacheFileW+0x84
041ffa5c 721de5e9 CfgRelay!CStatisticImpl::InternalDownloadFile+0xa5
041ffab8 72218cc3 CfgRelay!CStatisticImpl::DownloadThreadProc+0x139
041ffaf4 7634ef5c CfgRelay!thread_start<unsigned int (__stdcall*)(void *)>+0x57
041ffb00 77853756 kernel32!BaseThreadInitThunk+0xe
041ffb40 77853729 ntdll!__RtlUserThreadStart+0x70
041ffb58 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
0375f940 02a9d1cb CfgRelay!destroy_ptd+0x9
0375f94c 774593e1 CfgRelay!destroy_fls+0x13
0375f968 7747214f ntdll!RtlProcessFlsData+0x57
0375fa00 774723e3 ntdll!LdrShutdownThread+0x35
0375fa10 7747f5aa ntdll!RtlExitUserThread+0x2a
0375fb5c 7569343d ntdll!TppWorkerThread+0x846
0375fb68 77459812 kernel32!BaseThreadInitThunk+0xe
0375fba8 774597e5 ntdll!__RtlUserThreadStart+0x70
0375fbc0 00000000 ntdll!_RtlUserThreadStart+0x1b