Let met think. If you don't think it is complex, hook is a good solution for this. You can hook the ExitProcess API in win32 by inline, IAT or something you can do. Because a process exits in windows through invoke the ExitProcess by itself, so after CRT lib destructs all the objects, it will invoke ExitProcess, at that time, the control flow will give you a chance to execute your code. If you don't know how to complete it, I can give a piece of code that i wrote before. Nice to make friends with you ! My email, Henzox.7@gmail.com