Crash in cfgrelay, Analyzed 3 dumps, total processed 75, rate equals 4.00%

Top 1: Version = 2.7224.1000.620, Total count = 3

dump count = 1

0a91f374 75982b54 kernel32!CreateProcessAsUserW+0x2d
0a91fa88 759828ce wininet!InvokeLowFunction+0x345
0a91fad4 759970d9 wininet!ChangeGlobalSettings+0x193
0a91fc38 75963d26 wininet!FixProxySettings+0x6d
0a91fec0 7598fd15 wininet!InternetGetConnectedStateExW+0x19d
0a91fee0 719ce50a wininet!InternetGetConnectedState+0x48
0a91ff14 71a08cc3 CfgRelay!CStatisticImpl::DownloadThreadProc+0x5a
0a91ff50 75bc336a CfgRelay!thread_start<unsigned int (__stdcall*)(void *)>+0x57
0a91ff5c 778c98f2 kernel32!BaseThreadInitThunk+0xe
0a91ff9c 778c98c5 ntdll!__RtlUserThreadStart+0x70
0a91ffb4 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
09a8e2e4 75ca5b7c urlmon!_chkstk+0x27
09a8f34c 75ca5848 urlmon!CINetHttp::QueryStatusOnResponse+0x1b9
09a8f364 75ca5752 urlmon!CINet::QueryInfoOnResponse+0x51
09a8f374 75ca57d9 urlmon!CINet::INetQueryInfo+0x55
09a8f388 75ca52ad urlmon!CINet::OnINetInternal+0x9e
09a8f39c 75ca528d urlmon!CINet::MyContinue+0x17
09a8f3ac 75ca5271 urlmon!CINetProtImpl::Continue+0x13
09a8f3bc 75ca524e urlmon!CINetEmbdFilter::Continue+0x14
09a8f3d4 75ca1e6b urlmon!CINet::Continue+0x28
09a8f3e4 75ca1e42 urlmon!COInetProt::Continue+0x14
09a8f3f4 75ca1e4d urlmon!CTransaction::OnINetInternalCallback+0x2d
09a8f414 75c98dac urlmon!CTransaction::OnINetCallback+0x8b
09a8f42c 757f62fa urlmon!TransactionWndProc+0x28
09a8f458 757f6d3a user32!InternalCallWinProc+0x23
09a8f4d0 757f77c4 user32!UserCallWinProcCheckWow+0x109
09a8f530 757f7bca user32!DispatchMessageWorker+0x3bc
09a8f540 75ca424b user32!DispatchMessageA+0xf
09a8f580 75ca419b urlmon!CTransaction::CompleteOperation+0x86
09a8f5bc 75c9b6f0 urlmon!CTransaction::StartEx+0x578
09a8f644 75c9b265 urlmon!CBinding::StartBinding+0x602
09a8f688 75c9b346 urlmon!CUrlMon::StartBinding+0x169
09a8f6b0 75cbb567 urlmon!CUrlMon::BindToStorage+0x90
09a8f6f4 75cbb68c urlmon!CBaseBSCB::KickOffDownload+0x193
09a8f8a4 05540855 urlmon!URLDownloadToCacheFileW+0x108
09a8fd00 0553e5e9 CfgRelay!CStatisticImpl::InternalDownloadFile+0xa5
09a8fd5c 05578cc3 CfgRelay!CStatisticImpl::DownloadThreadProc+0x139
09a8fd98 7770344d CfgRelay!thread_start<unsigned int (__stdcall*)(void *)>+0x57
09a8fda4 77c19802 kernel32!BaseThreadInitThunk+0xe
09a8fde4 77c197d5 ntdll!__RtlUserThreadStart+0x70
09a8fdfc 00000000 ntdll!_RtlUserThreadStart+0x1b

dump count = 1

ChildEBP RetAddr  
04ccee28 77d6e0c3 ntdll!RtlpLowFragHeapFree+0x31
04ccee40 767514bd ntdll!RtlFreeHeap+0x105
04ccee54 76fd18b6 kernel32!HeapFree+0x14
04ccee68 76f3f0f5 wininet!WxHeapFree<unsigned __int64>+0x1e
04ccef0c 76f3fd2c wininet!GetUrlCacheEntryInfoExW+0x414
04ccf1b0 7752f933 wininet!InternetUnlockRequestFile+0x12a
04ccf1bc 7752f8f6 urlmon!CINet::UnlockFile+0x23
04ccf1d8 77525324 urlmon!CINet::UnlockRequest+0xf8
04ccf1ec 775252a3 urlmon!COInetProt::UnlockRequest+0x20
04ccf20c 775280c9 urlmon!CTransaction::UnlockRequest+0x53
04ccf220 7752814c urlmon!CTransData::~CTransData+0x51
04ccf23c 7752311b urlmon!CBinding::~CBinding+0x2f2
04ccf270 77523944 urlmon!CUrlMon::StartBinding+0x204
04ccf29c 7754e923 urlmon!CUrlMon::BindToStorage+0x7b
04ccf2e4 7754f094 urlmon!CBaseBSCB::KickOffDownload+0x93
04ccf514 0f270855 urlmon!URLDownloadToCacheFileW+0x84
04ccf970 0f26e5e9 CfgRelay!CStatisticImpl::InternalDownloadFile+0xa5
04ccf9cc 0f2a8cc3 CfgRelay!CStatisticImpl::DownloadThreadProc+0x139
04ccfa08 7675344d CfgRelay!thread_start<unsigned int (__stdcall*)(void *)>+0x57
04ccfa14 77d79802 kernel32!BaseThreadInitThunk+0xe
04ccfa54 77d797d5 ntdll!__RtlUserThreadStart+0x70
04ccfa6c 00000000 ntdll!_RtlUserThreadStart+0x1b