WhyCrashed

How to find and read Windows Error Reporting (.wer) files

When a single program dies and Windows stays up, the evidence is not in C:\Windows\Minidump — it is in Windows Error Reporting. This guide shows you exactly where those files live, what to open, and how to turn a cryptic hex code into a fix plan without uploading anything.

The two folders that matter

Press Win+R and paste:

C:\ProgramData\Microsoft\Windows\WER\ReportArchive

Each subfolder is one incident. Sort by Date modified, open the newest folder that matches your program name, and look for Report.wer. Also check:

C:\ProgramData\Microsoft\Windows\WER\ReportQueue

for unsent reports (often fresher). App-crash dumps, when Windows wrote one, usually land in:

%LOCALAPPDATA%\CrashDumps

Drop either the .wer or the .dmp into the app-crash reader — parsing stays in your browser.

What to read first

Ignore the wall of signatures until you have three lines: AppName (which program), FaultModule (which DLL actually died), and ExceptionCode (why). If FaultModule is Discord overlays, NVIDIA share, a codec, or a printer UI DLL, fix that component before reinstalling the main app. If ExceptionCode is 0xC0000005 you are usually chasing a software bug; if it is 0xC0000006 (IN_PAGE_ERROR) start with the disk.

Turn the report into action

The reader builds a tickable fix plan and links the exception into our exception-code library. Copy the summary into a support ticket — vendors triage module + code faster than screenshots. If the whole PC blue-screened instead, you are in the wrong evidence pile: use the BSOD analyzer on files from C:\Windows\Minidump.

Privacy note

WER reports and minidumps can contain paths and fragments of documents that were open. Keep them local. Our tools never upload the file; the optional AI helper only receives the short text summary you can preview first.

Frequently asked

Is a .wer file a virus?

No. It is a text report Windows wrote after a program crashed. It does not run when you open it. Still, prefer a local reader — reports can include paths and module names from your PC.

Why is there a Report.wer but no .dmp?

WER always tries to write a report; a full minidump is optional and depends on the app and Windows settings. The .wer alone is often enough to name the faulting module.

ReportArchive vs ReportQueue — which one?

ReportQueue holds reports not yet sent to Microsoft. ReportArchive holds sent/kept history. Sort either by date and open the newest folder for your program.