I think the thread created is this: SHCORE.DLL!Ordinal254+0x9a0 <- start address stack: wow64cpu.dll!TurboDispatchJumpAddressEnd+0x598 wow64cpu.dll!TurboDispatchJumpAddressEnd+0x3e4 wow64.dll!Wow64LdrpInitialize+0x23a wow64.dll!Wow64LdrpInitialize+0x172 ntdll.dll!LdrInitializeThunk+0x12b ntdll.dll!LdrInitializeThunk+0xe ntdll.dll!ZwWaitForSingleObject+0xc KERNELBASE.dll!WaitForSingleObject+0x12 ashShell.dll!Release+0xa2c2 ashShell.dll!Release+0x936b ashShell.dll!Release+0x5ada2 ashShell.dll!Release+0x448e5 ashShell.dll!Release+0x394b3 ashShell.dll!Release+0x393f5 ntdll.dll!RtlInitializeCriticalSection+0x10e ntdll.dll!RtlInitializeCriticalSection+0x88 ntdll.dll!EtwEventWrite+0x67e ntdll.dll!EtwEventWrite+0x4fb ntdll.dll!RtlInterlockedPushEntrySList+0x192 ntdll.dll!LdrUnloadDll+0x40 KERNELBASE.dll!FreeLibrary+0x19 combase.dll!InternalFillLocalOXIDInfo+0xf1d combase.dll!InternalFillLocalOXIDInfo+0x1046 combase.dll!InternalFillLocalOXIDInfo+0xffc combase.dll!CoFreeUnusedLibrariesEx+0x941 combase.dll!CoFreeUnusedLibrariesEx+0x82f combase.dll!CoFreeUnusedLibrariesEx+0x1280 combase.dll!CoUninitialize+0xb2 SHCORE.DLL!Ordinal140+0x150 ntdll.dll!RtlInitializeExceptionChain+0x8f ntdll.dll!RtlInitializeExceptionChain+0x5a also this: ashShell.dll!Release+0x9d40 <-- start address stack: wow64cpu.dll!TurboDispatchJumpAddressEnd+0x598 wow64cpu.dll!TurboDispatchJumpAddressEnd+0x3e4 wow64.dll!Wow64LdrpInitialize+0x23a wow64.dll!Wow64LdrpInitialize+0x172 ntdll.dll!LdrInitializeThunk+0x12b ntdll.dll!LdrInitializeThunk+0xe ntdll.dll!ZwWaitForSingleObject+0xc ntdll.dll!RtlInterlockedPushEntrySList+0x32b ntdll.dll!RtlInterlockedPushEntrySList+0x355 ntdll.dll!RtlDestroyMemoryBlockLookaside+0x2aca ntdll.dll!RtlExitUserThread+0x4c ntdll.dll!RtlInitializeExceptionChain+0x8f ntdll.dll!RtlInitializeExceptionChain+0x5a