I am working on a program in a citrix environment that appears to be "crashing" on users. I managed to capture a couple of the "crashes" using process monitor, but this isn't like anything I have seen ...

Background file activity never stops on Windows — here is how to see it.