Aside from DMP (dump) and MDMP (mini-dump) files there are *.wer files that contain valuable information about why a certain app crashed
C:\ProgramData\Microsoft\Windows\WER\
1. Step Open the Windows explorer
2. Step Copy and paste this into the address bar C:\ProgramData\Microsoft\Windows\WER\
3. Step There will be two folders ReportArchive and ReportQueue
4. Step Open ReportArchive
5. Step If you recently crashed a few programs you will find a bunch of folders like AppCrash_DynUpSvc.exe
or AppHang_Everything.exe
Alright now we know where WER files are stored – let’s take a quick look at it
Here is the beginning of a AppHang WER dump of the program Everything.exe
Version=1
EventType=AppHangB1
EventTime=130157773680293929
ReportType=3
Consent=1
UploadTime=130157773697098912
ReportIdentifier=76907ef1-d5c1-11e2-bea1-485b3936d32b
IntegratorReportIdentifier=76907ef2-d5c1-11e2-bea1-485b3936d32b
WOW64=1
NsAppName=Everything.exe
Response.BucketId=14d330a5151758884db32ed616190d90
Response.BucketTable=5
Response.LegacyBucketId=-614153629
Response.type=4
Scroll down a little and you will find all LoadedModules (DLL’s) which is pretty handy if you ask me to check for certain conflicts. Also the exact ReportDescription and EventName will be listed
Handy for debugging purposes. Cheers, hope it helps
Change the Storage Path
1. Step Open the registry editor
2. Step Uncollapse HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\DumpFolder
3. Step Double-click StoreLocation
4. Step Enter a new valid Windows path
5. Step Done!
