Download WhoCrashed – Crash Dump Analyzer

Yes, WhoCrashed is safe. It is developed by Resplendence Software Projects Sp., a company that has been building Windows diagnostic tools since the early 2000s. The installer from the official Resplendence website passes scans on VirusTotal with zero detections across all major antivirus engines.

WhoCrashed version 7.10 has a file size of roughly 11 MB for the Home Edition installer. The application only reads crash dump files (.dmp) stored in your C:WindowsMinidump directory. It does not modify system files, inject drivers, or make registry changes beyond its own installation entry. Users on Reddit’s r/buildapc and r/techsupport regularly recommend it without safety concerns. CyberPowerPC UK even references WhoCrashed in their official support documentation for diagnosing BSOD stop codes.

• Download only from resplendence.com/whocrashed or reputable mirrors like MajorGeeks
• Avoid any site offering a “cracked” or “pre-activated Professional” version
• The installer does not bundle adware, toolbars, or third-party offers
• Windows SmartScreen may prompt you on first run because the installer is not from the Microsoft Store – click “More info” then “Run anyway”

Pro tip: If your antivirus flags the installer, it is a false positive. WhoCrashed uses the Windows Debug Engine (dbgeng.dll), which some heuristic scanners misidentify. Whitelist the Resplendence install directory to prevent interference.

For download links to the verified installer, visit our download section.

WhoCrashed is completely free from malware and spyware when downloaded from the official source. Resplendence Software has maintained a clean track record for over 20 years with no reported incidents of bundled malware in any of their products.

The official installer (whocrashed_setup.exe, approximately 11 MB) contains no adware, no browser hijackers, and no data-collection components. WhoCrashed works entirely offline after installation. It reads local minidump files, runs analysis against the Windows Debug Engine, and generates reports. It does not phone home, send crash data to external servers, or require an internet connection to function. The only network call it makes is an optional update check, which you can disable.

• No telemetry or usage tracking in the Home Edition
• No bundled browser extensions or search bar modifications
• The software does not run background services or startup processes after you close it
• Uninstalling via Add/Remove Programs removes all files cleanly

Pro tip: Scan the installer with VirusTotal before running it if you want extra peace of mind. Upload the .exe file at virustotal.com and verify zero detections. This takes about 30 seconds and confirms the file has not been tampered with.

See our features overview for details on what WhoCrashed actually does under the hood.

The official download for WhoCrashed is hosted on the Resplendence Software website at resplendence.com/whocrashed. This is the only source maintained directly by the developer.

The current version is 7.10, released in August 2025. The Home Edition installer is approximately 11 MB and the Professional Edition is around 18 MB. The official download page offers both editions, with the Home Edition available as a free download and the Professional Edition requiring a license purchase of $34.95 USD. The domain whocrashed.com also links to the official Resplendence download page.

• Primary source: resplendence.com/whocrashed (direct from developer)
• Trusted mirrors: MajorGeeks, CNET Download, Uptodown
• Avoid: random file-sharing sites, torrent downloads, and any link offering “WhoCrashed Professional free”
• A common mistake is clicking ad-sponsored “Download” buttons on mirror sites instead of the actual download link

Pro tip: Bookmark the direct download URL from Resplendence so you always get the latest version without landing on a lookalike page. The official filename follows the pattern whocrashed_setup.exe for the Home Edition.

You can also grab WhoCrashed from our download section, which links directly to the official installer.

Yes, WhoCrashed 7.10 works on Windows 11 without any compatibility issues. It supports all current Windows 11 builds including 23H2 and 24H2.

WhoCrashed supports a wide range of Windows versions: Windows 11, 10, 8.1, 8, 7, Vista, and XP SP3. It also runs on Windows Server editions including Server 2022, 2019, 2016, 2012, 2008, and 2003. Both 32-bit and 64-bit architectures are supported. The application uses the Windows Debug Engine (dbgeng.dll) that ships with every Windows installation, so there are no extra dependencies to install.

• Windows 11 Home, Pro, Enterprise, and Education editions are all supported
• On Windows 11, crash dumps are stored in C:WindowsMinidump by default
• You need administrator privileges to access and analyze dump files
• If Windows 11’s memory integrity (Core Isolation) is enabled, WhoCrashed still functions normally

Pro tip: On Windows 11, if you are not seeing dump files after a crash, open Settings, go to System > About > Advanced system settings > Startup and Recovery > Settings, and make sure “Small memory dump (256 KB)” is selected. Windows 11 sometimes defaults to “Automatic memory dump,” which works too but produces larger files.

Check the full list of supported platforms on our system requirements page.

WhoCrashed has very modest system requirements. Any PC that can run Windows XP SP3 or later can run WhoCrashed without issues.

The application itself uses minimal resources. The installer is about 11 MB, and the installed footprint is under 30 MB on disk. During crash dump analysis, WhoCrashed typically uses less than 100 MB of RAM, even when processing large dump files. There are no specific CPU or GPU requirements. The analysis process takes between 5 and 30 seconds on most modern hardware, depending on the number and size of dump files available.

• OS: Windows XP SP3, Vista, 7, 8, 8.1, 10, or 11 (32-bit or 64-bit)
• RAM: 512 MB minimum (any system running Windows meets this)
• Disk space: 30 MB free for installation
• Administrator access is required to read crash dump files
• No internet connection needed for analysis

Pro tip: WhoCrashed runs fine on older machines and is a good choice for diagnosing crashes on budget or aging hardware where heavier tools like WinDbg might feel sluggish. You can even run it in Windows Safe Mode if the system is too unstable to boot normally.

View the full specs on our system requirements section.

Yes, WhoCrashed fully supports both 32-bit (x86) and 64-bit (x64) versions of Windows. The same installer works on either architecture.

This is worth noting because some crash analysis tools, including certain versions of WinDbg, have dropped 32-bit support in recent releases. WhoCrashed 7.10 maintains backward compatibility all the way to Windows XP SP3 on 32-bit hardware. If you are still running a 32-bit version of Windows 7 or Windows 10 (which Microsoft offered until version 2004), WhoCrashed will install and run correctly. The dump file format (.dmp) differs slightly between 32-bit and 64-bit systems, and WhoCrashed handles both formats automatically.

• 32-bit Windows XP, Vista, 7, 8, 8.1, and 10 are supported
• 64-bit Windows 7 through 11 are supported
• Windows Server 2003 through 2022 (both 32-bit and 64-bit where applicable)
• The installer detects your architecture and installs the correct version

Pro tip: If you have a 32-bit system that is crashing, WhoCrashed is one of the easiest tools to use since it does not require you to install debugging symbol packages separately. On 64-bit systems, the Professional Edition can optionally download symbols from Microsoft’s symbol server for deeper analysis.

For operating system details, see our system requirements page.

The WhoCrashed Home Edition is free to download and use for personal, non-commercial purposes. There is no trial period, no feature expiration, and no mandatory registration.

The free Home Edition covers everything most people need: it analyzes minidump files on your local machine, identifies the driver or component responsible for each crash, and generates a plain-language report explaining the probable cause. Resplendence Software has offered this free edition since the tool’s initial release, and there are no signs of that changing. The Home Edition does not display ads, nag screens, or upsell popups during analysis. You get a full crash report every time.

• Home Edition: free for personal use, no registration required
• Professional Edition: $34.95 USD (EUR 29.95) for a single license
• No subscription model – the Professional license is a one-time purchase
• Upgrades from older Professional versions cost around $19.95 USD

Pro tip: The free Home Edition is sufficient for diagnosing crashes on your own PC. The Professional Edition adds value mainly for IT technicians who need to analyze dump files from multiple machines over a network, or who want command-line automation and symbol server integration.

Download the free Home Edition from our download section.

The Home Edition handles local crash analysis for free, while the Professional Edition ($34.95) adds network analysis, command-line support, and deeper technical reporting.

For everyday users troubleshooting their own BSOD errors, the free Home Edition covers everything needed. It reads minidump files from your C:WindowsMinidump directory, identifies the faulting driver, and explains the crash in readable language. The Professional Edition targets system administrators and IT support staff who need to analyze crash dumps from remote computers across a network without physically sitting at each machine.

• Network/remote dump analysis: Professional only
• Command-line interface for scripting and automation: Professional only
• Kernel stack traces with full symbol resolution: Professional only
• Loaded module list at crash time: Professional only
• Custom dump directory analysis (analyze dumps from any folder): Professional only
• Sortable columns and uptime tracking reports: Professional only
• Commercial use license: Professional only

Pro tip: If you manage 10+ workstations and regularly handle BSOD tickets, the Professional Edition pays for itself after a couple of incidents. The network analysis feature lets you pull dump files from any machine on your domain without needing remote desktop access.

See the complete feature breakdown in our features section.

Installing WhoCrashed takes about two minutes. Download the installer from the official site, run it, and click through a standard Windows setup wizard.

The installer (whocrashed_setup.exe) is approximately 11 MB for the Home Edition. It does not require a reboot after installation. WhoCrashed installs to C:Program FilesResplendenceWhoCrashed by default. The setup wizard has no bundled software offers or tricky checkboxes to watch out for.

1. Visit the download section and click the download button for the Home Edition
2. Save whocrashed_setup.exe to your Downloads folder
3. Double-click the installer. If Windows SmartScreen appears, click “More info” then “Run anyway”
4. Accept the license agreement and click Next
5. Choose the install directory (default is fine for most users) and click Install
6. Click Finish. WhoCrashed is ready to use

Pro tip: Right-click the installer and select “Run as administrator” before launching it. While the installer usually requests elevation on its own, doing this manually avoids rare cases where UAC settings block the elevation prompt silently.

For a more detailed walkthrough, visit our Getting Started guide.

Most WhoCrashed installation errors come down to insufficient permissions or a corrupted download. Running the installer as administrator fixes the majority of cases.

If the installer fails or hangs, the first thing to check is whether you are running it with administrator rights. WhoCrashed needs to register components with the Windows Debug Engine, which requires elevated privileges. On Windows 10 and 11, right-click whocrashed_setup.exe and select “Run as administrator.” If the download itself is corrupted, the installer may crash immediately or show a CRC error. Re-download the file from the official source.

1. Right-click the installer and select “Run as administrator”
2. If you get a “file is corrupted” error, delete the downloaded file and re-download from resplendence.com/whocrashed
3. Temporarily disable your antivirus if it blocks the installer (some heuristic engines flag dbgeng.dll interactions)
4. If you see an error about dbgeng.dll or SetCheckUserInterruptShared, your Windows installation may be missing debug components. Run “sfc /scannow” in an elevated Command Prompt to repair system files
5. On Windows 8.1, some users report the error “procedure entry point SetCheckUserInterruptShared could not be located.” Update to the latest Windows 8.1 service pack or use an older WhoCrashed version

Pro tip: If WhoCrashed refuses to install on an older system, try extracting the installer with 7-Zip instead of running it. You can sometimes run WhoCrashed.exe directly from the extracted folder without a formal installation.

Check our system requirements to confirm your OS version is supported.

WhoCrashed does not offer an official portable version. The standard installer is the only distribution method from Resplendence Software.

Unlike BlueScreenView (which is fully portable), WhoCrashed relies on a proper installation because it registers components with the Windows Debug Engine during setup. The installed size is under 30 MB, so disk space is not a concern. If you need to analyze crash dumps on a machine where you cannot install software, the Professional Edition lets you copy dump files to another PC and analyze them there using the custom dump directory feature.

• No official portable (.zip) version exists
• The installer does not require a reboot, so installation is quick
• For portable crash analysis, BlueScreenView (free, from NirSoft) is a common alternative
• Professional Edition can analyze dump files copied from other machines, which partially works around the portability limitation

Pro tip: If you regularly need portable BSOD analysis, keep BlueScreenView on a USB drive for quick field diagnostics, and use WhoCrashed on your main workstation for its more detailed, readable reports. The two tools complement each other well.

Learn more about installation options in our Getting Started guide.

If WhoCrashed reports “no valid crash dumps were found,” your system is either not configured to save minidump files, or the dump directory is empty because the crashes were not true BSODs.

Windows needs to be explicitly configured to write small memory dumps after a crash. By default, most Windows installations have this enabled, but some OEM configurations or group policies disable it. WhoCrashed looks in C:WindowsMinidump for .dmp files. If that folder does not exist or is empty, there is nothing to analyze. This is the single most common issue users report on Reddit and Microsoft Q&A forums.

1. Open the Start menu and search for “Advanced system settings”
2. Click “Settings” under “Startup and Recovery”
3. Under “Write debugging information,” select “Small memory dump (256 KB)”
4. Make sure the dump file path shows %SystemRoot%Minidump
5. Click OK, then restart your computer
6. Wait for the next crash, then run WhoCrashed again

Pro tip: If your computer freezes or reboots without showing a blue screen, the crash may be caused by a hardware failure (like a faulty PSU or overheating GPU) that cuts power before Windows can write a dump file. In that case, WhoCrashed will not find anything because no dump was created. Check your Event Viewer (eventvwr.msc) under Windows Logs > System for “Kernel-Power” event ID 41, which indicates an unexpected shutdown.

For more troubleshooting steps, visit our Getting Started guide.

WhoCrashed failing to open is usually caused by a missing or incompatible version of dbgeng.dll, the Windows Debug Engine library that WhoCrashed depends on.

This problem appears most often on Windows 8.1 and older systems where certain system updates are missing. On Windows 10 and 11, the issue is rare. If WhoCrashed crashes on launch with an error referencing dbgeng.dll or “SetCheckUserInterruptShared,” your system’s debug engine needs updating. The fix is straightforward in most cases.

1. Open an elevated Command Prompt (search “cmd,” right-click, “Run as administrator”)
2. Run: sfc /scannow – this repairs missing or corrupted system files including dbgeng.dll
3. If sfc does not fix it, run: DISM /Online /Cleanup-Image /RestoreHealth
4. Install all pending Windows Updates, particularly cumulative and servicing stack updates
5. Uninstall WhoCrashed, reboot, and reinstall the latest version from the official site

Pro tip: On Windows 8.1 specifically, the dbgeng.dll issue is a known bug. If system file repair does not resolve it, install the Windows Software Development Kit (SDK) for Windows 8.1, which includes an updated debug engine. Alternatively, upgrade to Windows 10 where this problem does not occur.

Check our system requirements to verify your OS version is compatible.

When WhoCrashed identifies a driver (like ntoskrnl.exe, nvlddmkm.sys, or atikmdag.sys), the next step is to update, roll back, or replace that specific driver.

WhoCrashed’s report names the .sys file that was active at the time of the crash. This does not always mean that driver is the root cause – sometimes a driver crashes because another component corrupted memory. But it is the right starting point. For example, nvlddmkm.sys is the NVIDIA display driver, atikmdag.sys is AMD’s display driver, and ntoskrnl.exe is the Windows kernel itself (which often points to a hardware issue like bad RAM).

1. Note the driver filename from the WhoCrashed report (e.g., nvlddmkm.sys)
2. Search the filename online to identify which device or software it belongs to
3. Visit the hardware manufacturer’s website and download the latest driver
4. If the crash started after a recent driver update, roll back: open Device Manager, right-click the device, select Properties > Driver > Roll Back Driver
5. If the report points to ntoskrnl.exe or hal.dll, run Windows Memory Diagnostic (mdsched.exe) to test your RAM

Pro tip: If the same driver keeps appearing across multiple crash reports, that is a strong signal. A single appearance could be a fluke. Three or more crashes blaming the same driver file is a pattern worth acting on. Use WhoCrashed’s report timeline to spot repeating offenders.

See our features section for more on how WhoCrashed identifies crash causes.

WhoCrashed does not have a built-in auto-updater. To update, download the latest installer from the official website and install it over the existing version.

The current version is 7.10, released in August 2025. Resplendence Software publishes updates periodically to add support for new Windows versions and improve crash analysis accuracy. There is no need to uninstall the old version first. Running the new installer overwrites the previous installation while keeping your preferences. The update process takes under a minute.

1. Open WhoCrashed and click Help > About to check your current version
2. Visit resplendence.com/whocrashed to see the latest version available
3. Download the new installer if a newer version exists
4. Run the installer – it will upgrade the existing installation automatically
5. No reboot required after updating

Pro tip: WhoCrashed updates are infrequent (a few times per year at most), so checking every couple of months is sufficient. Major Windows releases (like a new Windows 11 version) are the most common trigger for a WhoCrashed update, since new crash dump formats or debug engine changes can affect analysis accuracy.

Get the latest version from our download section.

WhoCrashed 7.10 is the latest release as of August 2025. It includes updated Windows 11 compatibility and improved crash dump analysis accuracy for newer driver formats.

Resplendence Software does not publish detailed public changelogs for every point release, but version 7.x brought several improvements over the 6.x line. The analysis engine was updated to handle crash dumps from Windows 11 23H2 and 24H2 correctly. The report formatting was refined to provide clearer explanations of common crash causes. The Professional Edition gained better symbol server integration for faster remote analysis.

• Full Windows 11 24H2 support for crash dump analysis
• Updated debug engine integration for recent Windows builds
• Improved driver identification in crash reports
• The Home Edition installer remains around 11 MB, the Professional around 18 MB
• No changes to system requirements – still works on Windows XP SP3 and later

Pro tip: If you are running an older version (5.x or 6.x) and analyzing crashes on a Windows 11 machine, upgrade to 7.10. Older versions may misidentify drivers or fail to parse newer dump file formats, leading to inaccurate or incomplete reports.

Download version 7.10 from our download section.

Both are good, but they serve slightly different users. WhoCrashed gives you readable, plain-language crash reports. BlueScreenView gives you raw technical data in a table format. Most Reddit users recommend keeping both installed.

WhoCrashed (developed by Resplendence Software) analyzes minidump files and produces a report that tells you in plain English which driver likely caused the crash and what to do about it. BlueScreenView (developed by NirSoft) displays crash data in a spreadsheet-like table showing the bug check code, parameters, driver filename, and memory addresses. BlueScreenView is free, portable (no installation required), and lighter at under 1 MB. WhoCrashed is free for the Home Edition but has a paid Professional tier at $34.95.

• WhoCrashed: best for beginners and non-technical users who want a clear explanation
• BlueScreenView: best for experienced users who can interpret raw crash data and stop codes
• WhoCrashed can suggest whether hardware failure might be involved; BlueScreenView does not
• BlueScreenView is portable (runs from a USB drive); WhoCrashed requires installation
• For deep analysis, IT professionals often use WinDbg (Microsoft’s free debugger), which has the steepest learning curve but the most power

Pro tip: The best workflow is to run WhoCrashed first for a quick, understandable summary, then open BlueScreenView to cross-reference the specific driver and bug check code. If both tools point to the same driver, you have high confidence in the diagnosis.

Learn more about WhoCrashed’s analysis capabilities in our features section.

The free Home Edition can only analyze crash dumps on the local machine. The Professional Edition ($34.95) can analyze dumps from remote computers over a network or from any custom directory.

With the Professional Edition, you can point WhoCrashed at a network share or a local folder containing .dmp files copied from another machine. This is the main selling point for IT support teams who manage multiple workstations. You can collect minidump files from a crashed PC (copy the contents of C:WindowsMinidump), drop them into any folder on your workstation, and tell WhoCrashed Professional to analyze that directory. The command-line interface also supports this, making it possible to script batch analysis across dozens of machines.

• Home Edition: local machine only, reads from C:WindowsMinidump
• Professional Edition: any directory, network paths (UNC), remote machines
• Command-line usage (Professional): whocrashed.exe /analyze /dumpdir:”D:collected-dumps”
• For Home Edition users, manually copy .dmp files to C:WindowsMinidump as a workaround (not officially supported but sometimes works)

Pro tip: If you are an IT admin handling BSOD tickets, set up a shared network folder where users can drop their minidump files. Then use WhoCrashed Professional’s command-line mode to batch-analyze all dumps in that folder. This saves you from remote-desktopping into every affected machine.

Compare Home vs Professional features in our features section.

WhoCrashed uninstalls cleanly through the standard Windows Add/Remove Programs interface. No leftover files, registry entries, or background services remain after removal.

The uninstallation process is straightforward and takes about 30 seconds. WhoCrashed does not install system services, startup entries, or browser extensions, so there is nothing to manually clean up after uninstalling. The crash dump files in C:WindowsMinidump are Windows system files and are not affected by uninstalling WhoCrashed – they remain untouched.

1. Open Settings > Apps > Installed apps (Windows 11) or Control Panel > Programs and Features (Windows 10)
2. Find “WhoCrashed” in the list and click Uninstall
3. Confirm the removal when prompted
4. The uninstaller removes all files from C:Program FilesResplendenceWhoCrashed
5. No reboot required after uninstalling

Pro tip: Your crash dump files (C:WindowsMinidump) are created by Windows, not by WhoCrashed. Uninstalling WhoCrashed does not delete these files. If you want to clean up old dump files to free disk space, you can safely delete the contents of the Minidump folder manually or use Disk Cleanup.

If you are reinstalling, grab the latest version from our download section.