Analyzed 29 dump

Top 1: total counts = 5

06cdf974 56f0aeed rightsmanager!RM_AutorunScan+0x176
06cdfa70 773e336a ffi_bindings!ffi_call_win32+0x11
06cdfa7c 77ab9902 kernel32!BaseThreadInitThunk+0xe
06cdfabc 77ab98d5 ntdll!__RtlUserThreadStart+0x70
06cdfad4 00000000 ntdll!_RtlUserThreadStart+0x1b

Top 2: total counts = 4

ChildEBP RetAddr  
0822eed8 0fcce731 rightsmanager!std::_Tree,std::allocator >,long,std::less,std::allocator > >,std::allocator,std::allocator > const ,long> >,0> >::lower_bound+0x16
0822ef18 0fcd738a rightsmanager!CProcessInfo::GetUsageMemory+0x31
0822f168 0fcd12a2 rightsmanager!CAutorunsCtrl::GetMemory+0x3a
0823f7b0 0fcce943 rightsmanager!CAutorunsCtrl::EnumRegAutorun+0x942
0823f828 0fd07f86 rightsmanager!CAutorunsCtrl::EnumAutoruns+0x53
0823f9fc 765f343d rightsmanager!RM_AutorunScan+0x176
0823fa08 76f59812 kernel32!BaseThreadInitThunk+0xe
0823fa48 76f597e5 ntdll!__RtlUserThreadStart+0x70
0823fa60 00000000 ntdll!_RtlUserThreadStart+0x1b

Top 3: total counts = 4

0628f994 728caeed rightsmanager!RM_AutorunScan+0x176
0628fa90 766afcc9 ffi_bindings!ffi_call_win32+0x11
0628faa0 77cb7c6e kernel32!BaseThreadInitThunk+0x19
0628fafc 77cb7c3e ntdll!__RtlUserThreadStart+0x2f
0628fb0c 00000000 ntdll!_RtlUserThreadStart+0x1b

Top 4: total counts = 3

05cdf85c 054faeed rightsmanager!RM_AutorunScan+0x176
05cdf958 762e5d49 ffi_bindings!ffi_call_win32+0x11
05cdf968 77ddd09b kernel32!BaseThreadInitThunk+0x19
05cdf9c0 77ddd021 ntdll!__RtlUserThreadStart+0x2b
05cdf9d0 00000000 ntdll!_RtlUserThreadStart+0x1b

Top 5: total counts = 2

ChildEBP RetAddr  
05d0f258 7c08e731 rightsmanager!std::_Tree,std::allocator >,long,std::less,std::allocator > >,std::allocator,std::allocator > const ,long> >,0> >::lower_bound+0x16
05d0f298 7c09738a rightsmanager!CProcessInfo::GetUsageMemory+0x31
05d0f4e8 7c0912a2 rightsmanager!CAutorunsCtrl::GetMemory+0x3a
05d1fb30 7c08e943 rightsmanager!CAutorunsCtrl::EnumRegAutorun+0x942
05d1fba8 7c0c7f86 rightsmanager!CAutorunsCtrl::EnumAutoruns+0x53
05d1fd7c 7543fcc9 rightsmanager!RM_AutorunScan+0x176
05d1fd8c 779082ae kernel32!BaseThreadInitThunk+0x19
05d1fde8 7790827e ntdll!__RtlUserThreadStart+0x2f
05d1fdf8 00000000 ntdll!_RtlUserThreadStart+0x1b

Top 6: total counts = 2

ChildEBP RetAddr  
0697ecf0 5a99e731 rightsmanager!std::_Tree,std::allocator >,long,std::less,std::allocator > >,std::allocator,std::allocator > const ,long> >,0> >::lower_bound+0x16
0697ed30 5a9a738a rightsmanager!CProcessInfo::GetUsageMemory+0x31
0697ef80 5a9a12a2 rightsmanager!CAutorunsCtrl::GetMemory+0x3a
0698f5c8 5a99e943 rightsmanager!CAutorunsCtrl::EnumRegAutorun+0x942
0698f640 5a9d7f86 rightsmanager!CAutorunsCtrl::EnumAutoruns+0x53
0698f814 75365d49 rightsmanager!RM_AutorunScan+0x176
0698f824 778ed1ab kernel32!BaseThreadInitThunk+0x19
0698f87c 778ed131 ntdll!__RtlUserThreadStart+0x2b
0698f88c 00000000 ntdll!_RtlUserThreadStart+0x1b

Top 7: total counts = 2

ChildEBP RetAddr  
066ef130 6790e731 rightsmanager!std::_Tree,std::allocator >,long,std::less,std::allocator > >,std::allocator,std::allocator > const ,long> >,0> >::lower_bound+0x13
066ef170 6791738a rightsmanager!CProcessInfo::GetUsageMemory+0x31
066ef3c0 679112a2 rightsmanager!CAutorunsCtrl::GetMemory+0x3a
066ffa08 6790e943 rightsmanager!CAutorunsCtrl::EnumRegAutorun+0x942
066ffa80 67947f86 rightsmanager!CAutorunsCtrl::EnumAutoruns+0x53
066ffc54 755d5d49 rightsmanager!RM_AutorunScan+0x176
066ffc64 76fbd2fb kernel32!BaseThreadInitThunk+0x19
066ffcbc 76fbd281 ntdll!__RtlUserThreadStart+0x2b
066ffccc 00000000 ntdll!_RtlUserThreadStart+0x1b

Top 8: total counts = 1

ChildEBP RetAddr  
WARNING: Stack unwind information not available. Following frames may be wrong.
002ec948 6d86dc08 node+0x2a2f20b
002ecc47 6d203034 node+0xb2dc08
002ecc4b 4d203a73 node+0x4c3034
002ecc4f 2d6b7261 0x4d203a73
002ecc53 65657773 0x2d6b7261
002ecc57 30312070 0x65657773
002ecc5b 2820342e 0x30312070
002ecc5f 332e3231 0x2820342e
002ecc63 3e2d2029 0x332e3231
002ecc67 2e303120 0x3e2d2029
002ecc6b 31282034 0x2e303120
002ecc6f 29332e32 0x31282034
002ecc73 2c424d20 0x29332e32
002ecc77 342e3820 0x2c424d20
002ecc7b 30202f20 0x342e3820
002ecc7f 6d20302e 0x30202f20
002ecc83 28202073 node+0x4c302e
002ecc87 72657661 0x28202073
002ecc8b 20656761 0x72657661
002ecc8f 3d20756d 0x20656761
002ecc93 392e3020 0x3d20756d
002ecc97 202c3939 0x392e3020
002ecc9b 72727563 0x202c3939
002eccb3 6f6d656d ncrypt!SPPkcs8IsKeyExportable+0x6cf
002eccc7 69204347 node+0x299656d
002ecccb 6c6f206e 0x69204347
002ecccf 70732064 0x6c6f206e
002eccd3 20656361 node+0x39f2064
002eccd7 75716572 0x20656361
002ecd33 2020736d wininet!InternalFtpFindFirstFileA+0x205
002ecd53 20756d20 0x2020736d
002ecd57 2e30203d 0x20756d20
002ecd5b 29393939 0x2e30203d
002ecd5f 776f6c20 0x29393939
002ecd63 6d656d20 rpcrt4!Microsoft_Windows_Networking_ProviderId  (rpcrt4+0xe6c20)
002ecd67 2079726f node+0x916d20
002ecd6b 69746f6e 0x2079726f
002ecd6f 61636966 0x69746f6e
002ecd73 6e6f6974 0x61636966
002ecd77 20434720 node+0x19b6974
002ecd7b 6f206e69 0x20434720
002ecd7f 7320646c node+0x24c6e69
002ecd83 65636170 0x7320646c
002ecd87 71657220 0x65636170
002ecd8b 74736575 0x71657220
002ecd8f 5b0a6465 0x74736575
002ecd93 34323732 0x5b0a6465
002ecd97 3032303a 0x34323732
002ecd9b 44324233 0x3032303a
002ecd9f 37205d38 0x44324233
002ecda3 33373030 0x37205d38
002ecda7 20343936 0x33373030
002ecdab 203a736d 0x20343936
002ecdaf 6b72614d 0x203a736d
002ecdb3 6577732d 0x6b72614d
002ecdb7 31207065 0x6577732d
002ecdbb 20342e30 0x31207065
002ecdbf 2e323128 0x20342e30
002ecdc3 2d202933 0x2e323128
002ecdc7 3031203e 0x2d202933
002ecdcb 2820342e 0x3031203e
002ecdcf 332e3231 0x2820342e
002ecdd3 424d2029 0x332e3231
002ecdd7 3131202c 0x424d2029
002ecddb 2f20342e 0x3131202c
002ecddf 302e3020 0x2f20342e
002ecde3 20736d20 0x302e3020
002ecde7 76612820 0x20736d20
002ecdeb 67617265 shell32!wkscli_NULL_THUNK_DATA_DLN+0x2f92
002ecdef 756d2065 0x67617265
002ece33 63617073 wininet!CAppCacheManifest::InternalParseManifest+0x85
002ece3f 0a646574 0x63617073
002ece43 00000000 0xa646574

Top 9: total counts = 1

ChildEBP RetAddr  
WARNING: Stack unwind information not available. Following frames may be wrong.
010fcb48 60eadc08 node+0x2a2f20b
010fce47 4d203a73 node+0xb2dc08
010fce4b 2d6b7261 0x4d203a73
010fce4f 65657773 0x2d6b7261
010fce53 30312070 0x65657773
010fce57 2820332e 0x30312070
010fce5b 302e3231 0x2820332e
010fce5f 3e2d2029 0x302e3231
010fce63 2e303120 0x3e2d2029
010fce67 31282033 0x2e303120
010fce6b 29302e32 0x31282033
010fce6f 2c424d20 0x29302e32
010fce73 32303120 0x2c424d20
010fce77 20362e30 0x32303120
010fce7b 2e30202f 0x20362e30
010fce7f 736d2030 0x2e30202f
010fce83 61282020 0x736d2030
010fce87 61726576 node+0xf02020
010fce8b 6d206567 node+0x13a6576
010fce8f 203d2075 iertutil!`string'+0x57
010fce93 37392e30 0x203d2075
010fce97 63202c35 0x37392e30
010fce9b 65727275 node+0x2e82c35
010fce9f 6d20746e 0x65727275
010fcea3 203d2075 iertutil!`string'+0x26
010fcea7 30302e30 0x203d2075
010fceab 6c202931 0x30302e30
010fceaf 6d20776f 0x6c202931
010fceb3 726f6d65 iertutil!`string'+0x4f
6d20776f 7461706d d3d11!_tlgWriteTemplate::Write<_tlgWrapperByVal<4>,_tlgWrapperByVal<1>,_tlgWrapperByVal<4>,_tlgWrapperByVal<4>,_tlgWrapperByRef<8>,_tlgWrapperByVal<4> >+0x68
6d207793 25656c69 wininet!urlmon_NULL_THUNK_DATA_DLA  (wininet+0x21706d)
6d207797 7463415c 0x25656c69
6d20779b 58657669 0x7463415c
6d20779f 6d6f4320 0x58657669
6d2077a3 69746170 0x6d6f4320
6d2077a7 696c6962 0x69746170
6d2077ab 7b5c7974 0x696c6962
6d2077af 37313146 0x7b5c7974
6d2077b3 42313338 0x37313146
6d2077b7 3530432d 0x42313338
6d2077bb 31312d32 0x3530432d
6d2077bf 422d3164 0x31312d32
6d2077c3 2d304331 0x422d3164
6d2077c7 30433030 0x2d304331
6d2077cb 32434634 0x30433030
6d2077cf 46453346 0x32434634
6d2077d3 6f43217d 0x46453346
6d2077d7 7461706d 0x6f43217d
6d2077db 6c696269 wininet!urlmon_NULL_THUNK_DATA_DLA  (wininet+0x21706d)
6d2077df 20797469 0x6c696269
6d2077e3 67616c46 0x20797469
6d2077e7 00000000 0x67616c46

Top 10: total counts = 1

002fcec3 72727563 0x202c3639
002fcec7 20746e65 rsaenh!CPGetProvParam+0x5c6
002fcecb 3d20756d 0x20746e65
002fcecf 302e3020 0x3d20756d
002fced3 20293230 0x302e3020
002fced7 20776f6c 0x20293230
002fcedb 6f6d656d 0x20776f6c
002fcedf 6e207972 node+0x445656d
002fcee3 6669746f node+0x2f87972
002fcee7 74616369 0x6669746f
002fceeb 206e6f69 0x74616369
002fceef 69204347 0x206e6f69
002fcef3 6c6f206e 0x69204347
002fcef7 70732064 node+0x147206e
002fcefb 20656361 0x70732064
002fceff 75716572 0x20656361
002fcf03 65747365 shell32!__dyn_tls_init_callback  (shell32+0x736572)
002fcf07 325b0a64 0x65747365
002fcf0b 3a303035 0x325b0a64
002fcf0f 43303230 0x3a303035
002fd00f 76612820 0x43303230
002fd013 67617265 wininet!InternetReadFileExA+0xb38e0
002fd017 756d2065 0x67617265
002fd01b 30203d20 shell32!__dyn_tls_init_callback  (shell32+0x6f2065)
002fd01f 3439392e 0x30203d20
002fd023 7563202c 0x3439392e
002fd027 6e657272 shell32!__dyn_tls_init_callback  (shell32+0x65202c)
002fd02b 756d2074 node+0x33d7272
002fd02f 30203d20 shell32!__dyn_tls_init_callback  (shell32+0x6f2074)
002fd033 3030302e 0x30203d20
002fd037 6f6c2029 0x3030302e
002fd03b 656d2077 node+0x4442029
002fd03f 79726f6d 0x656d2077
002fd043 746f6e20 0x79726f6d
002fd047 63696669 0x746f6e20
002fd04b 6f697461 0x63696669
002fd04f 4347206e node+0x4417461
002fd053 206e6920 0x4347206e
002fd057 20646c6f 0x206e6920
002fd05b 63617073 0x20646c6f
002fd05f 65722065 0x63617073
002fd063 73657571 0x65722065
002fd067 0a646574 mscms!__dyn_tls_init_callback  (mscms+0x77571)
002fd06b 00000000 0xa646574

Top 11: total counts = 1

ChildEBP RetAddr  
05b5eeb8 591fe731 rightsmanager!std::_Tree,std::allocator >,long,std::less,std::allocator > >,std::allocator,std::allocator > const ,long> >,0> >::lower_bound+0xa2
05b5eef8 5920738a rightsmanager!CProcessInfo::GetUsageMemory+0x31
05b5f148 592012a2 rightsmanager!CAutorunsCtrl::GetMemory+0x3a
05b6f790 591fe943 rightsmanager!CAutorunsCtrl::EnumRegAutorun+0x942
05b6f808 59237f86 rightsmanager!CAutorunsCtrl::EnumAutoruns+0x53
05b6f9dc 75e3343d rightsmanager!RM_AutorunScan+0x176
05b6f9e8 77929812 kernel32!BaseThreadInitThunk+0xe
05b6fa28 779297e5 ntdll!__RtlUserThreadStart+0x70
05b6fa40 00000000 ntdll!_RtlUserThreadStart+0x1b

Top 12: total counts = 1

ChildEBP RetAddr  
WARNING: Stack unwind information not available. Following frames may be wrong.
0022f464 6edd8d6c node+0x12ae60a
0022f4d4 6ca93961 node+0x2a18d6c
0022f548 6d6889e6 node+0x6d3961
0022f614 6d68875e node+0x12c89e6
0022f670 6d660ec3 node+0x12c875e
0022f6ac 6d660acb node+0x12a0ec3
0022f6ec 6d6723d2 node+0x12a0acb
0022f734 6d6722e2 node+0x12b23d2
0022f778 6ca8bd42 node+0x12b22e2
0022f7a0 6ca8d47d node+0x6cbd42
0022f7e0 6c9ced6c node+0x6cd47d
0022f83c 6c9cf379 node+0x60ed6c
0022f860 6c9cea8a node+0x60f379
0022f864 6d64a300 node+0x60ea8a
0022f868 00220000 node+0x128a300
0022f86c 00000000 0x220000

Top 13: total counts = 1

ChildEBP RetAddr  
00ffe4c4 75e59249 ntdll!RtlEnterCriticalSection+0x15
00ffe538 76e5278e KERNELBASE!GetProcessMitigationPolicy+0xc9
00ffe584 76e534a8 user32!DispatchHookA+0x12e
00ffe5b8 76e0b366 user32!fnHkINLPCWPSTRUCTA+0x68
00ffe600 77530bad user32!__fnINOUTNCCALCSIZE+0x56
00ffe684 76e4dc34 ntdll!KiUserCallbackDispatcher+0x4d
00ffe964 76e0ad6a user32!VerNtUserCreateWindowEx+0x244
00ffea48 76e0aa98 user32!CreateWindowInternal+0x2ce
00ffea88 762e0747 user32!CreateWindowExW+0x38
00ffeac8 76276cb5 combase!InitMainThreadWnd+0x42
00ffeaf0 762785be combase!ThreadFirstInitialize+0x11b
00ffeb60 76276e45 combase!_CoInitializeEx+0x13d
00ffeb74 7455c670 combase!CoInitializeEx+0x35
00ffeb80 7452f18c shell32!SHCoInitialize+0xa
00ffeb9c 7451ee30 shell32!CShellExecute::ExecuteNormal+0x97
00ffebb0 7451edb6 shell32!ShellExecuteNormal+0x44
00ffebc4 6633dd69 shell32!ShellExecuteExW+0x26
00ffece8 00000000 nativeutils!CDbgHelper::_MiniDumpHanlder+0x3e9

Top 14: total counts = 1

ChildEBP RetAddr  
055af3c8 7b9de731 rightsmanager!std::_Tree,std::allocator >,long,std::less,std::allocator > >,std::allocator,std::allocator > const ,long> >,0> >::lower_bound+0x13
055af408 7b9e738a rightsmanager!CProcessInfo::GetUsageMemory+0x31
055af658 7b9e12a2 rightsmanager!CAutorunsCtrl::GetMemory+0x3a
055bfca0 7b9de943 rightsmanager!CAutorunsCtrl::EnumRegAutorun+0x942
055bfd18 7ba17f86 rightsmanager!CAutorunsCtrl::EnumAutoruns+0x53
055bfeec 7697fcc9 rightsmanager!RM_AutorunScan+0x176
055bfefc 77e182ae kernel32!BaseThreadInitThunk+0x19
055bff58 77e1827e ntdll!__RtlUserThreadStart+0x2f
055bff68 00000000 ntdll!_RtlUserThreadStart+0x1b