fixme:(../../dll/win32/winsta/query.c:194) WinStationGetProcessSid is UNIMPLEMENTED! (../../ntoskrnl/se/accesschk.c:253) HACK: RemainingAccess = 0x00000112 DesiredAccess = 0x0010019b Entered debugger on first-chance exception (Exception Code: 0xc0000005) (Page Fault) Memory at 0x00000008 could not be read: Page not present. kdb:> bt Eip: Frames: <7c92c806> Couldn't access memory at 0x0012B7DC! kdb:> cont (../../win32ss/user/ntuser/defwnd.c:1002) err: WM_SETREDRAW fixme:(../../dll/win32/winsta/query.c:194) WinStationGetProcessSid is UNIMPLEMENTED! Entered debugger on first-chance exception (Exception Code: 0xc0000005) (Page Fault) Memory at 0x00101000 could not be read: Page not present. kdb:> bt Eip: Frames: Couldn't access memory at 0x000AC044! kdb:> cont More..... kdb:> cont (../../ntoskrnl/mm/ARM3/mdlsup.c:738) MDL PROBE FAILED! Entered debugger on first-chance exception (Exception Code: 0xc0000005) (Page Fault) Memory at 0x00101000 could not be read: Page not present. kdb:> bt Eip: Frames: Couldn't access memory at 0x000AC044! kdb:> More.... (../../ntoskrnl/se/accesschk.c:253) HACK: RemainingAccess = 0x00000112 DesiredAccess = 0x0010019b (../../win32ss/user/ntuser/defwnd.c:1002) err: WM_SETREDRAW fixme:(../../dll/win32/winsta/query.c:194) WinStationGetProcessSid is UNIMPLEMENTED! Entered debugger on first-chance exception (Exception Code: 0xc0000005) (Page Fault) Memory at 0x00011000 could not be read: Page not present. kdb:> bt Eip: Frames: --- Press q to abort, any other key to continue --- <00000000> kdb:> More... Entered debugger on first-chance exception (Exception Code: 0xc0000005) (Page Fault) Memory at 0x00011000 could not be read: Page not present. kdb:> cont (../../ntoskrnl/mm/ARM3/mdlsup.c:738) MDL PROBE FAILED! (../../ntoskrnl/se/accesschk.c:253) HACK: RemainingAccess = 0x00000112 DesiredAccess = 0x0010019b .... (../../ntoskrnl/se/accesschk.c:253) HACK: RemainingAccess = 0x00000112 DesiredAccess = 0x0010019b (../../dll/ntdll/etw/trace.c:131) (004DD3E0, N, 004DCF30) stub (../../win32ss/user/ntuser/message.c:219) err: WM_COPYDATA data 1 (../../win32ss/user/ntuser/message.c:1783) err: WM_COPYDATA Start ppi B1FBEA70 pti B1FBE728 lParam E150CC30 (../../win32ss/user/ntuser/msgqueue.c:1084) err: Running across the border ptirec B2093E10 WARNING: calling stub OpenTraceW() (../../dll/win32/kernel32/client/except.c:382) Missing function in : advapi32.dll (../../dll/win32/kernel32/client/except.c:383) with the functionname : OpenTraceW (../../win32ss/user/ntuser/focus.c:73) err: Application is keeping itself Active to prevent the change! (../../win32ss/user/ntuser/msgqueue.c:1277) err: Non Blocked Receiving Thread woken up dead! Msg 2040 That is it!!! While the process exited, lParam E150CC30 was not freed. If it was it should still be in use.