{"id":10354,"date":"2026-04-16T23:19:05","date_gmt":"2026-04-16T23:19:05","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=10354"},"modified":"2026-04-16T23:19:05","modified_gmt":"2026-04-16T23:19:05","slug":"werreportcreate-api","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2026\/04\/16\/werreportcreate-api\/","title":{"rendered":"WerReportCreate API"},"content":{"rendered":"\n<p>The API I want to talk about today is called <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/api\/werapi\/nf-werapi-werreportcreate\">WerReportCreate<\/a>. It takes a few arguments, but the most interesting is the first one, which is the Event Name. <\/p>\n\n\n\n<p>Looking at Windows OS binaries, we can see this API being utilized by a number of native executables and libraries, and each invocation uses unique string for the event name:<\/p>\n\n\n\n<ul>\n<li>FaultTolerantHeap &#8211; AcLayers.dll<\/li>\n\n\n\n<li>AppxDeploymentFailureBlue &#8211; AppXDeploymentServer.dll<\/li>\n\n\n\n<li>CertPinning &#8211; cryptui.dll<\/li>\n\n\n\n<li>D3DDRED2 &#8211; D3D12Core.dll<\/li>\n\n\n\n<li>DMRCDeviceMetadataPackageFailure &#8211; DeviceMetadataRetrievalClient.dll<\/li>\n\n\n\n<li>DispBrokerTimeoutEvent &#8211; DispBroker.dll<\/li>\n\n\n\n<li>WWAJSE &#8211; EdgeContent.dll<\/li>\n\n\n\n<li>WindowsBlackScreenDiagnosticsV1 &#8211; explorer.exe<\/li>\n\n\n\n<li>ShellBrowserCancel &#8211; ExplorerFrame.dll<\/li>\n\n\n\n<li>ShellViewReentered &#8211; ExplorerFrame.dll<\/li>\n\n\n\n<li>FaultTolerantHeap &#8211; fthsvc.dll<\/li>\n\n\n\n<li>GDIObjectLeak &#8211; gdi32full.dll<\/li>\n\n\n\n<li>CompatEntityAnalysis_1 &#8211; invagent.dll<\/li>\n\n\n\n<li>ScriptedDiagFailure &#8211; msdt.exe<\/li>\n\n\n\n<li>WindowsNonFatalSuspectedDeadlock &#8211; netprofmsvc.dll<\/li>\n\n\n\n<li>CommsNonFatalSuspectedDeadlock &#8211; PhoneProviders.dll<\/li>\n\n\n\n<li>CommsNonFatalSuspectedDeadlock &#8211; PhoneService.dll<\/li>\n\n\n\n<li>HamLkd &#8211; PsmServiceExtHost.dll<\/li>\n\n\n\n<li>RADAR_PRE_LEAK_32 &#8211; radarrs.dll<\/li>\n\n\n\n<li>RADAR_LEAK_64 &#8211; rdrleakdiag.exe<\/li>\n\n\n\n<li>MemDiagV1 &#8211; RelPost.exe<\/li>\n\n\n\n<li>StartupRepairOnline &#8211; RelPost.exe<\/li>\n\n\n\n<li>WindowsBackupFailure &#8211; sdclt.exe<\/li>\n\n\n\n<li>WindowsBackupFailure &#8211; sdengin2.dll<\/li>\n\n\n\n<li>ServiceHang &#8211; services.exe<\/li>\n\n\n\n<li>SystemRestore &#8211; srcore.dll<\/li>\n\n\n\n<li>ShellThumbnailExtractionTimeout &#8211; thumbcache.dll<\/li>\n\n\n\n<li>ShellThumbnailExtractionTimeout &#8211; ThumbnailExtractionHost.exe<\/li>\n\n\n\n<li>UpdateAgentDiag &#8211; UpdateAgent.dll<\/li>\n\n\n\n<li>Windows Server Backup Error &#8211; wbengine.exe<\/li>\n\n\n\n<li>AppHangB1 &#8211; WerFault.exe<\/li>\n\n\n\n<li>BlueScreen &#8211; WerFault.exe<\/li>\n\n\n\n<li>LiveKernelEvent &#8211; WerFault.exe<\/li>\n\n\n\n<li>Temp &#8211; werui.dll<\/li>\n\n\n\n<li>WUDFUnhandledException &#8211; WUDFPlatform.dll<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The API I want to talk about today is called WerReportCreate. It takes a few arguments, but the most interesting is the first one, which is the Event Name. Looking at Windows OS binaries, we can see this API being &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2026\/04\/16\/werreportcreate-api\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[53],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10354"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=10354"}],"version-history":[{"count":1,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10354\/revisions"}],"predecessor-version":[{"id":10355,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10354\/revisions\/10355"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=10354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=10354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=10354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}