Analyzed 9 dump

Top 1: total counts = 1

ChildEBP RetAddr  
0fedf674 74db625c ntdll!RtlSizeHeap+0xce
0fedf688 74f9f665 ole32!CRetailMalloc_GetSize+0x21
0fedf6a8 74fb4b21 shell32!CTCoAllocPolicy::_CoTaskMemSize+0x32
0fedf6b8 74fa1685 shell32!CTCoAllocPolicy::Alloc+0x24
0fedf6d0 74fa1713 shell32!CoAllocBytes+0x14
0fedf6f0 74fa178c shell32!ILClone+0x30
0fedf6fc 74fa254c shell32!SHILClone+0x13
0fedf710 74fa257e shell32!CFSFolder::Initialize+0x20
0fedf744 74fa26eb shell32!CFSFolder::InitializeEx+0x28
0fedf768 74f89aa7 shell32!CFSFolder_CreateFolder+0x50
0fedfbb8 74f899e6 shell32!CDesktopFolder::_Init+0x96
0fedfbdc 74fa19ae shell32!CDesktopFolder_CreateInstance+0x64
0fedfbf0 74f87fd4 shell32!SHGetDesktopFolder+0x14
0fedfc24 74f221e2 shell32!SHParseDisplayName+0x50
0fedfc54 74f222cb shell32!CShellExecute::_InitPidl+0x3f
0fedfc60 74f22222 shell32!CShellExecute::_ResolveObject+0xd
0fedfc74 74f22387 shell32!CShellExecute::_DoExecute+0x19
0fedfc88 769643c0 shell32!CShellExecute::s_ExecuteThreadProc+0x30
0fedfd10 7624336a shlwapi!WrapperThreadProc+0x1b5
0fedfd1c 773e9902 kernel32!BaseThreadInitThunk+0xe
0fedfd5c 773e98d5 ntdll!__RtlUserThreadStart+0x70
0fedfd74 00000000 ntdll!_RtlUserThreadStart+0x1b

Top 2: total counts = 1

ChildEBP RetAddr  
0498f9e8 7a593d2a BroBasic!CAcceptorMgrImpl::`RTTI Complete Object Locator'
0498fc14 7a57e073 BroBasic!::operator()+0x5ba
0498fc68 7a666a13 BroBasic!LdsThread::ThreadProc+0x123
0498fca4 76c5fcc9 BroBasic!thread_start+0x57
0498fcb4 77237c5e kernel32!BaseThreadInitThunk+0x19
0498fd10 77237c2e ntdll!__RtlUserThreadStart+0x2f
0498fd20 00000000 ntdll!_RtlUserThreadStart+0x1b

Top 3: total counts = 1

ChildEBP RetAddr  
055fe90c 75d7d369 ole32!CComApartment::InitRemoting+0xf6
055fe918 75e8d6ee ole32!CComApartment::StartServer+0x13
055fe928 75da85cd ole32!InitChannelIfNecessary+0x1e
055fe978 75e8c99a ole32!CCtxComChnl::GetBuffer+0xe
055fe990 76fe475f ole32!NdrExtpProxyGetBuffer+0x4b
055fe9a0 77056727 rpcrt4!NdrpProxyGetBuffer+0x16
055fedc4 75e8c8e2 rpcrt4!NdrClientCall2+0x17a
055fede4 75d898ad ole32!ObjectStublessClient+0xa2
055fedf4 75d8b641 ole32!ObjectStubless+0xf
055fee1c 75d8b5ed ole32!RemoteReleaseRifRefHelper+0xa5
055fee58 75e2a7c6 ole32!RemoteReleaseRifRef+0xb0
055fee98 75e2a7fd ole32!RemoteReleaseStdObjRef+0x47
055feea8 75de1b4d ole32!RemoteReleaseObjRef+0x18
055feeec 75de5af8 ole32!CStdMarshal::ReleaseMarshalObjRef+0x153
055fef50 75d82253 ole32!CStdMarshal::UnmarshalObjRef+0x16c
055fef68 75d8221e ole32!UnmarshalSwitch+0x25
055fef9c 75d7f1b3 ole32!UnmarshalObjRef+0x90
055ff024 723e264b ole32!CoUnmarshalInterface+0xf1
055ff044 723e284b oleacc!UnmarshalInterface+0x75
055ff07c 723e2708 oleacc!SharedBuffer_Free+0x18a
055ff098 723e2c98 oleacc!ObjectFromLresult+0x3f
055ff0b8 723e23d9 oleacc!NativeIAccessibleFromWindow+0x82
055ff0d4 723e2303 oleacc!ORIGINAL_AccessibleObjectFromWindow+0x18
055ff0f8 723e7174 oleacc!AccessibleObjectFromWindow+0x1a
055ff11c 723e5854 oleacc!CWindow::get_accName+0x4b
055ff144 723e5282 oleacc!AccWrap_Base::get_accName+0x22
055ff17c 03c5c728 oleacc!AccWrap_Annotate::get_accName+0x59
055ff2a8 03c5b822 BroBasic!BrowserChromeBaseImpl::initUrlInfo+0xb8
055ff3fc 03c64f4c BroBasic!BrowserChromeBaseImpl::GetEventInfo+0x202
055ff888 03cf69e7 BroBasic!BrowserMgrImpl::BrowserEventProc+0x73c
055ff8b0 75ec30ec BroBasic!WinEventProc+0x57
055ff8e0 774b6b3e user32!__ClientCallWinEventProc+0x2a
055ff914 75eccde0 ntdll!KiUserCallbackDispatcher+0x2e
055ff918 75ecce13 user32!NtUserGetMessage+0xc
055ff934 03cf2b99 user32!GetMessageW+0x33
055ffa88 03c4e073 BroBasic!CBrowserBasicTrayClient::AsyncStart+0x489
055ffadc 03d36a13 BroBasic!LdsThread::ThreadProc+0x123
055ffb18 759fef6c BroBasic!thread_start+0x57
055ffb24 774d3618 kernel32!BaseThreadInitThunk+0xe
055ffb64 774d35eb ntdll!__RtlUserThreadStart+0x70
055ffb7c 00000000 ntdll!_RtlUserThreadStart+0x1b

Top 4: total counts = 1

ChildEBP RetAddr  
060fef60 76f202aa ntdll!RtlpWaitOnCriticalSection+0x93
060fef98 76f200f9 ntdll!RtlpEnterCriticalSectionContended+0x1aa
060ff00c 759711d7 ntdll!RtlEnterCriticalSection+0x49
060ff034 ffffffff kernel32!CreateThreadStub+0x27
WARNING: Frame IP not in any known module. Following frames may be wrong.
060ff070 76f3c21c 0xffffffff
060ff0e4 00000000 ntdll!RtlQueryPerformanceCounter+0x7c

Top 5: total counts = 1

ChildEBP RetAddr  
00fae724 75cb034c KERNELBASE!RaiseException+0x62
00fae7c8 75cb003e KERNELBASE!CreateFileInternal+0x2fc
00fae7fc 75c9c116 KERNELBASE!CreateFileW+0x5e
00fae860 00faeb70 KERNELBASE!GetTempFileNameW+0x1a6
WARNING: Frame IP not in any known module. Following frames may be wrong.
00fae8e0 76f10c4f 0xfaeb70
00fae91c 03dd5518 ntdll!RtlpInsertFreeBlock+0x11f
00fae968 00650073 0x3dd5518
00fae96c 00730072 0x650073
00fae970 0077005c 0x730072
00fae974 00670078 0x77005c
00fae978 0041005c 0x670078
00fae97c 00700070 srvhost!obfuscated_FindNextFileW+0x5c
00fae980 00610044 0x700070
00fae984 00610074 0x610044
00fae988 004c005c 0x610074
00fae98c 0063006f 0x4c005c
00fae990 006c0061 0x63006f
00fae994 0054005c 0x6c0061
00fae998 006d0065 0x54005c
00fae99c 005c0070 0x6d0065
00fae9a0 00000000 0x5c0070

Top 6: total counts = 1

ChildEBP RetAddr  
0e00f16c 774715d7 KERNELBASE!RaiseException+0x62
0e00f194 00000000 kernel32!CreateThreadStub+0x27

Top 7: total counts = 1

06bdf43c 79c22f31 ntdll!RtlpFreeHeapInternal+0x783
06bdf6e0 7639b9a1 NetBridge!strcmp+0x1071
06bdf6f0 760566bc KERNELBASE!FlsSetValue+0x11
06bdf774 77981edc combase!RegisterThreadCleanupCallback+0x2c
06bdf870 779839bc ntdll!ZwSetEvent+0xc
06bdf8c0 7798224c ntdll!ZwTestAlert+0xc
06bdf8c4 00000000 ntdll!ZwContinue+0xc

Top 8: total counts = 1

ChildEBP RetAddr  
WARNING: Frame IP not in any known module. Following frames may be wrong.
0715f864 7609ac2f 0x40ff0877
0715f86c 760a2f4d rpcrt4!LRPC_BIND_CCALL::~LRPC_BIND_CCALL+0x19
0715f880 760a2f02 rpcrt4!LRPC_CCALL::~LRPC_CCALL+0xb2
0715f88c 7609abd3 rpcrt4!LRPC_CCALL::`vector deleting destructor'+0xd
0715f8a0 7609aad7 rpcrt4!LRPC_BASE_BINDING_HANDLE::FreeCachedCalls+0x42
0715f8a8 7609a9ef rpcrt4!LRPC_BASE_BINDING_HANDLE::BindingFree+0x14
0715f8b8 762de5be rpcrt4!RpcBindingFree+0x55
0715f8c4 761dd5fd ole32!CChannelHandle::~CChannelHandle+0x11
0715f8d0 762de5dc ole32!CChannelHandle::`scalar deleting destructor'+0xd
0715f8dc 761da73e ole32!CChannelHandle::Release+0x20
0715f8e8 762de233 ole32!CCtxComChnl::`scalar deleting destructor'+0xd
0715f8fc 761daf67 ole32!CRpcChannelBuffer::Release+0x27
0715f974 761da546 ole32!CStdMarshal::DisconnectCliIPIDs+0x32c
0715f9a4 761da6ef ole32!CStdMarshal::Disconnect+0x1ba
0715f9c0 761da659 ole32!CStdIdentity::~CStdIdentity+0x8c
0715f9cc 761da9cb ole32!CStdIdentity::`scalar deleting destructor'+0xd
0715f9e0 762de380 ole32!CStdIdentity::CInternalUnk::Release+0x6e
0715f9ec 75a107d1 ole32!IUnknown_Release_Proxy+0x11
0715fa14 75a79a82 wininet!WriteProxySettingsViaBrokerCallback+0x84
0715fa3c 75a1072a wininet! ?? ::FNODOBFM::`string'+0x4679
0715fa64 75ac9a15 wininet!WriteProxySettingsViaBroker+0x37
0715fa80 75af805d wininet!WininetProxySupport::UpdateProxySettings+0x65
0715fb04 75af84d7 wininet!AutoProxyResolver::SaveDetectedProxySettings+0x119
0715fba8 75afcebe wininet!AutoProxyResolver::UpdateAutoproxyWithCompletedDetection+0x221
0715fbf8 75a79423 wininet!AutoProxyWpadAndResultThread+0xee
0715fc10 77458ddf wininet! ?? ::FNODOBFM::`string'+0x3ccd
0715fc84 774409b1 ntdll!RtlpTpWorkCallback+0x11d
0715fdd4 74da344d ntdll!TppWorkerThread+0x562
0715fde0 77429802 kernel32!BaseThreadInitThunk+0xe
0715fe20 774297d5 ntdll!__RtlUserThreadStart+0x70
0715fe38 00000000 ntdll!_RtlUserThreadStart+0x1b

Top 9: total counts = 1

ChildEBP RetAddr  
0614e40c 749a0fd8 KERNELBASE!FindCodePageHashNode+0x27
0614e438 749a147d KERNELBASE!GetCPHashNode+0x97
0614e444 749a1837 KERNELBASE!NlsGetACPFromLocale+0x47
0614e678 74b17580 KERNELBASE!CompareStringA+0x45
0614e6b4 74b17450 wininet!CompareStringNA+0x5b
0614e724 74b16e45 wininet!HTTP_REQUEST_HANDLE_OBJECT::LocalEndCacheWrite+0x27a
0614e75c 74aefca2 wininet!HTTP_REQUEST_HANDLE_OBJECT::HttpReadData_Fsm+0x448
0614e774 74aefc57 wininet!CFsm_HttpReadData::RunSM+0x2a
0614e7c8 74ae78bb wininet!CFsm::Run+0x3b9
0614e7f0 74b6517f wininet!DoFsm+0x60
0614e808 74b4b612 wininet!HttpReadData+0xc0
0614e830 74b17650 wininet!QueryAvailable_Fsm+0x80
0614e844 74ae7341 wininet!CFsm_QueryAvailable::RunSM+0x28
0614e898 74ae78bb wininet!CFsm::Run+0x161
0614e8c0 74b444f4 wininet!DoFsm+0x60
0614e948 7556b1d1 wininet!InternetQueryDataAvailable+0x2d9
0614eb78 7556a315 urlmon!CINet::INetDataAvailable+0x87
0614eb90 755b2038 urlmon!CINet::INetRead+0x4c
0614eba8 75569e94 urlmon!CINet::INetQueryInfo+0x90
0614ebc0 75569e17 urlmon!CINet::OnINetInternal+0xd3
0614ebd4 7556a197 urlmon!CINet::Continue+0x17
0614ebec 7556a15c urlmon!COInetProt::Continue+0x27
0614ec24 7555a779 urlmon!CTransaction::OnINetCallback+0x202
0614ec40 76b2630a urlmon!TransactionWndProc+0x29
0614ec6c 76b26d4a user32!InternalCallWinProc+0x23
0614ece4 76b277d7 user32!UserCallWinProcCheckWow+0x109
0614ed44 76b27bda user32!DispatchMessageWorker+0x3b5
0614ed54 7556f753 user32!DispatchMessageA+0xf
0614ed90 7556f864 urlmon!CTransaction::CompleteOperation+0x9d
0614f248 755b0eed urlmon!CTransaction::StartEx+0x1c8a
0614f2cc 7555e9ec urlmon!CBinding::StartBinding+0x921
0614f318 7555e877 urlmon!CUrlMon::StartBinding+0x1a6
0614f348 7556f913 urlmon!CUrlMon::BindToStorage+0x8e
0614f390 75570014 urlmon!CBaseBSCB::KickOffDownload+0x93
0614f5c0 77bdc261 urlmon!URLDownloadToCacheFileW+0x84
0614f9fc 77c6b078 utility!CStatistic::DownloadThreadProc+0x91
0614fa38 7477343d utility!thread_start+0x57
0614fa44 77279732 kernel32!BaseThreadInitThunk+0xe
0614fa84 77279705 ntdll!__RtlUserThreadStart+0x70
0614fa9c 00000000 ntdll!_RtlUserThreadStart+0x1b