After that, the custom DLL can install a hook on the service host process to monitor process creation and process termination operations. For our use case, the custom DLL uses the Windows debugger API to capture exceptions/crashes for our target service process, MQSVC.EXE. The code snippet for the main debugger thread is shown in Figure 3.