MagicAndre1981

Explorer dump with WER

Jan 28th, 2015
5,415
1
Never
1
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Please download this reg file from my OneDrive:
  2.  
  3. https://www.dropbox.com/s/iy8ffvzfltuuktb/WER_Explorer.reg?dl=0
  4.  
  5. and make a double click on the .reg file to import it.
  6.  
  7. When the Explorer crashes, Windows Error Reporting Service (http://msdn.microsoft.com/en-us/library/bb787181%28VS.85%29.aspx) creates a dmp file under C:\Localdumps. Please upload the dump file (compressed as 7z to reduce the size) to Onedrive/dropbox and post the link here.
  8.  
  9. After you generated the dump, run this reg file to stop dump creation:
  10.  
  11. https://www.dropbox.com/s/69dxy4bahgvutug/WER_Explorer_full_uninstall.reg?dl=0
Comments
  • # text 1.50 KB | 0 0
    1. For anyone seeing this in the future, if that URI ever becomes 404, it's undermentioned:
    2.  
    3. > ```reg
    4. > Windows Registry Editor Version 5.00
    5. >
    6. > [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\Explorer.exe]
    7. > "DumpFolder"=hex(2):43,00,3a,00,5c,00,4c,00,6f,00,63,00,61,00,6c,00,44,00,75,\
    8. > 00,6d,00,70,00,73,00,00,00
    9. > "DumpType"=dword:00000002
    10. >
    11. > ```
    12.  
    13. https://chatgpt.com/share/674c8abc-66fc-8006-81d2-f0e84fb8a0a5 explains it:
    14.  
    15. > 1. `[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\Explorer.exe]`
    16. >
    17. > * This path specifies a configuration for generating crash dumps specifically for the `Explorer.exe` process.
    18. >
    19. > 2. `"DumpFolder"=hex(2):...`
    20. >
    21. > * This value specifies the folder where the crash dump files will be stored.
    22. > * The `hex(2)` format indicates a `REG_EXPAND_SZ` type, which allows variables like environment variables to be expanded.
    23. > * The hexadecimal data converts to the string `C:\LocalDumps`, meaning the crash dumps will be stored in this folder.
    24. >
    25. > 3. `"DumpType"=dword:00000002`
    26. >
    27. > * This value determines the type of dump file generated. The options for `DumpType` are:
    28. >
    29. > * `0x1` (1): Mini Dump – A small dump with basic information for debugging.
    30. > * `0x2` (2): Full Dump – A complete memory dump of the process.
    31. >
    32. > * Here, `0x2` is specified, so full dump files will be generated when `Explorer.exe` crashes.
    33.  
    34. OP, did you create this, or get it from somewhere?
Add Comment
Please, Sign In to add comment