Does anyone know how to check which window or process sent the "WM_QUERYENDSESSION" message?

I'm trying to determine which process is shutting certain PCs down.

I tried "ex.HWnd", but that...