Advertisement
This is comment for paste
Explorer dump with WER
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- For anyone seeing this in the future, if that URI ever becomes 404, it's undermentioned:
- > ```reg
- > Windows Registry Editor Version 5.00
- >
- > [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\Explorer.exe]
- > "DumpFolder"=hex(2):43,00,3a,00,5c,00,4c,00,6f,00,63,00,61,00,6c,00,44,00,75,\
- > 00,6d,00,70,00,73,00,00,00
- > "DumpType"=dword:00000002
- >
- > ```
- https://chatgpt.com/share/674c8abc-66fc-8006-81d2-f0e84fb8a0a5 explains it:
- > 1. `[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\Explorer.exe]`
- >
- > * This path specifies a configuration for generating crash dumps specifically for the `Explorer.exe` process.
- >
- > 2. `"DumpFolder"=hex(2):...`
- >
- > * This value specifies the folder where the crash dump files will be stored.
- > * The `hex(2)` format indicates a `REG_EXPAND_SZ` type, which allows variables like environment variables to be expanded.
- > * The hexadecimal data converts to the string `C:\LocalDumps`, meaning the crash dumps will be stored in this folder.
- >
- > 3. `"DumpType"=dword:00000002`
- >
- > * This value determines the type of dump file generated. The options for `DumpType` are:
- >
- > * `0x1` (1): Mini Dump – A small dump with basic information for debugging.
- > * `0x2` (2): Full Dump – A complete memory dump of the process.
- >
- > * Here, `0x2` is specified, so full dump files will be generated when `Explorer.exe` crashes.
- OP, did you create this, or get it from somewhere?
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement