Not perfect, but if you have a separate process that monitors whether your main process is alive, then when it dies, you can get the active process from windows and guess that it was responsible. This generally works if it is killed by Task Manager, etc. Also, have your main process send a message to the monitoring process just before it is going to exit normally so you don't log those cases.