Please fix the issue where explorer.exe (File Explorer) abnormally restarts when pasting, recycling, or deleting files after launching Windhawk from Windows 11 25H2 Dev Channel.

[Aminosserdiar]

The content is the same as the title; it returned to normal after exiting Windhawk. And it seems to be unrelated to any installed mods.

[m417z]

Does it happen when all mods are disabled? If not, check which mod causes it.

Also, collect and upload a crash dump. You should be able to get it with the following steps:

• Open regedit
• Go to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting
• Create a key named LocalDumps
• Create a DWORD value named DumpType with value 2
• Trigger the crash
• Go to the %LocalAppData%\CrashDumps folder, you should see a dump file in there

[Aminosserdiar]

Does it happen when all mods are disabled? If not, check which mod causes it.

Also, collect and upload a crash dump. You should be able to get it with the following steps:

• Open regedit
• Go to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting
• Create a key named LocalDumps
• Create a DWORD value named DumpType with value 2
• Trigger the crash
• Go to the %LocalAppData%\CrashDumps folder, you should see a dump file in there

Yes, these problems can occur even if all mods are turned off. However my computer is not around right now, so I can't provide the details of the error for the time being, sorry.

[Aminosserdiar]

Does it happen when all mods are disabled? If not, check which mod causes it.

Also, collect and upload a crash dump. You should be able to get it with the following steps:

• Open regedit
• Go to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting
• Create a key named LocalDumps
• Create a DWORD value named DumpType with value 2
• Trigger the crash
• Go to the %LocalAppData%\CrashDumps folder, you should see a dump file in there

Details

************* Preparing the environment for Debugger Extensions Gallery repositories **************
   ExtensionRepository : Implicit
   UseExperimentalFeatureForNugetShare : true
   AllowNugetExeUpdate : true
   NonInteractiveNuget : true
   AllowNugetMSCredentialProviderInstall : true
   AllowParallelInitializationOfLocalRepositories : true

   EnableRedirectToV8JsProvider : false

   -- Configuring repositories
      ----> Repository : LocalInstalled, Enabled: true
      ----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.109 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.266 seconds
   ----> Repository : UserExtensions, Enabled: true, Packages count: 0
   ----> Repository : LocalInstalled, Enabled: true, Packages count: 30

Microsoft (R) Windows Debugger Version 10.0.26100.7175 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Siyua\AppData\Local\CrashDumps\explorer.exe.9816.dmp]
User Mini Dump File with Full Memory: Only application data is available

Symbol search path is: srv*
Executable search path is: 
Windows 10 Version 26220 MP (6 procs) Free x64
Product: WinNt, suite: SingleUserTS
Edition build lab: 26100.1.amd64fre.ge_release.240331-1435
Debug session time: Sat Nov 15 12:29:54.000 2025 (UTC + 8:00)
System Uptime: 0 days 1:08:09.798
Process Uptime: 0 days 1:07:58.000
................................................................
................................................................
................................................................
................................................................
................................................................
...............................................................
Loading unloaded module list
..................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(2658.2014): Access violation - code c0000005 (first/second chance not available)
For analysis of this file, run !analyze -v
ntdll!NtWaitForMultipleObjects+0x14:
00007ffe`3a542724 c3              ret

Details

************* Preparing the environment for Debugger Extensions Gallery repositories **************
   ExtensionRepository : Implicit
   UseExperimentalFeatureForNugetShare : true
   AllowNugetExeUpdate : true
   NonInteractiveNuget : true
   AllowNugetMSCredentialProviderInstall : true
   AllowParallelInitializationOfLocalRepositories : true

   EnableRedirectToV8JsProvider : false

   -- Configuring repositories
      ----> Repository : LocalInstalled, Enabled: true
      ----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.109 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.266 seconds
   ----> Repository : UserExtensions, Enabled: true, Packages count: 0
   ----> Repository : LocalInstalled, Enabled: true, Packages count: 30

Microsoft (R) Windows Debugger Version 10.0.26100.7175 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Siyua\AppData\Local\CrashDumps\explorer.exe.9816.dmp]
User Mini Dump File with Full Memory: Only application data is available

Symbol search path is: srv*
Executable search path is: 
Windows 10 Version 26220 MP (6 procs) Free x64
Product: WinNt, suite: SingleUserTS
Edition build lab: 26100.1.amd64fre.ge_release.240331-1435
Debug session time: Sat Nov 15 12:29:54.000 2025 (UTC + 8:00)
System Uptime: 0 days 1:08:09.798
Process Uptime: 0 days 1:07:58.000
................................................................
................................................................
................................................................
................................................................
................................................................
...............................................................
Loading unloaded module list
..................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(2658.2014): Access violation - code c0000005 (first/second chance not available)
For analysis of this file, run !analyze -v
ntdll!NtWaitForMultipleObjects+0x14:
00007ffe`3a542724 c3              ret

There're 4 dump files and I chose the latest two to show what happened.

[Aminosserdiar]

Does it happen when all mods are disabled? If not, check which mod causes it.
Also, collect and upload a crash dump. You should be able to get it with the following steps:

• Open regedit
• Go to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting
• Create a key named LocalDumps
• Create a DWORD value named DumpType with value 2
• Trigger the crash
• Go to the %LocalAppData%\CrashDumps folder, you should see a dump file in there

[...]

There're 4 dump files and I chose the latest two to show what happened.

Details

************* Preparing the environment for Debugger Extensions Gallery repositories **************
   ExtensionRepository : Implicit
   UseExperimentalFeatureForNugetShare : true
   AllowNugetExeUpdate : true
   NonInteractiveNuget : true
   AllowNugetMSCredentialProviderInstall : true
   AllowParallelInitializationOfLocalRepositories : true

   EnableRedirectToV8JsProvider : false

   -- Configuring repositories
      ----> Repository : LocalInstalled, Enabled: true
      ----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.000 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.016 seconds
   ----> Repository : UserExtensions, Enabled: true, Packages count: 0
   ----> Repository : LocalInstalled, Enabled: true, Packages count: 30

Microsoft (R) Windows Debugger Version 10.0.26100.7175 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Siyua\AppData\Local\CrashDumps\explorer.exe.9816.dmp]
User Mini Dump File with Full Memory: Only application data is available

Symbol search path is: srv*
Executable search path is: 
Windows 10 Version 26220 MP (6 procs) Free x64
Product: WinNt, suite: SingleUserTS
Edition build lab: 26100.1.amd64fre.ge_release.240331-1435
Debug session time: Sat Nov 15 12:29:54.000 2025 (UTC + 8:00)
System Uptime: 0 days 1:08:09.798
Process Uptime: 0 days 1:07:58.000
................................................................
................................................................
................................................................
................................................................
................................................................
...............................................................
Loading unloaded module list
..................................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(2658.2014): Access violation - code c0000005 (first/second chance not available)
For analysis of this file, run !analyze -v
ntdll!NtWaitForMultipleObjects+0x14:
00007ffe`3a542724 c3              ret
0:004> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

Failed to request MethodData, not in JIT code range

KEY_VALUES_STRING: 1

    Key  : AV.Dereference
    Value: NullPtr

    Key  : AV.Fault
    Value: Read

    Key  : Analysis.CPU.mSec
    Value: 8405

    Key  : Analysis.Elapsed.mSec
    Value: 103708

    Key  : Analysis.IO.Other.Mb
    Value: 82

    Key  : Analysis.IO.Read.Mb
    Value: 1

    Key  : Analysis.IO.Write.Mb
    Value: 173

    Key  : Analysis.Init.CPU.mSec
    Value: 3733

    Key  : Analysis.Init.Elapsed.mSec
    Value: 61303

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 241

    Key  : CLR.BuiltBy
    Value: NET481REL1LAST_25H2_C

    Key  : CLR.Engine
    Value: CLR

    Key  : CLR.Version
    Value: 4.8.9323.0

    Key  : Failure.Bucket
    Value: NULL_POINTER_READ_c0000005_shell32.dll!COperationStatusTileRateChart::COperationStatusTileRateChart

    Key  : Failure.Hash
    Value: {f6d0fcf8-440f-b0be-4688-8926cdb7c1aa}

    Key  : Timeline.OS.Boot.DeltaSec
    Value: 4089

    Key  : Timeline.Process.Start.DeltaSec
    Value: 4078

    Key  : WER.OS.Branch
    Value: ge_release

    Key  : WER.OS.Version
    Value: 10.0.26100.1

    Key  : WER.Process.Version
    Value: 10.0.26100.7070


FILE_IN_CAB:  explorer.exe.9816.dmp

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

CONTEXT:  (.ecxr)
rax=00008449bcecfca2 rbx=0000000000000000 rcx=0000000047cf9450
rdx=0000000000000001 rsi=000000003d57ec10 rdi=0000000047cf9450
rip=00007ffe39b0203f rsp=000000000548e0b0 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=0000000000ff0320
r11=000000000548e040 r12=000000004817c8c0 r13=0000000000000001
r14=0000000000000001 r15=000000003d57eb60
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
shell32!COperationStatusTileRateChart::COperationStatusTileRateChart+0x33:
00007ffe`39b0203f 498b00          mov     rax,qword ptr [r8] ds:00000000`00000000=????????????????
Resetting default scope

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ffe39b0203f (shell32!COperationStatusTileRateChart::COperationStatusTileRateChart+0x0000000000000033)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000

PROCESS_NAME:  explorer.exe

READ_ADDRESS:  0000000000000000 

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p            0x%p                    %s

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

STACK_TEXT:  
00000000`0548e0b0 00007ffe`399210e6     : 00000000`00000000 00000000`00000000 00000000`000807bc 00000000`3d57ec10 : shell32!COperationStatusTileRateChart::COperationStatusTileRateChart+0x33
00000000`0548e100 00007ffe`39b0ad96     : 00000000`3d57eb60 00000000`0548e270 00000000`00000001 00000000`00000000 : shell32!COperationStatusTileRateChart::s_CreateInstance+0x72
00000000`0548e130 00007ffe`3990ff4f     : 00000000`00000001 00000000`48550e50 00000000`00000001 00000000`0548e270 : shell32!COperationStatusTile::_CreateRateChart+0x106
00000000`0548e170 00007ffe`39b0c534     : 00000000`00000000 00007ffd`c8fc1f17 00000000`48550d80 00000000`000807bc : shell32!COperationStatusTile::_CreateTileElement+0x1ab
00000000`0548e430 00007ffe`39870833     : 00000000`47f50820 00000000`00010184 00000000`00000001 00000000`00000001 : shell32!COperationStatusTile::_Initialize+0x90
00000000`0548e460 00007ffe`3987067e     : 00000000`327aad80 00000000`0548e561 00000000`00000001 00000000`000807bc : shell32!COperationStatusTile::s_CreateInstance+0xaf
00000000`0548e4b0 00007ffe`38c13663     : 00000000`327aad40 00000000`00010184 00000000`00000000 00000000`00000000 : shell32!COperationStatusService::RegisterOperationTile+0x1ae
00000000`0548e5b0 00007ffe`38c1570e     : 00007ffe`2a05a3e0 00000000`0548ecf0 00000000`0af2e1e0 00000000`00000000 : rpcrt4!Invoke+0x73
00000000`0548e630 00007ffe`38b56c50     : 00007ffe`38a9cd82 00000000`1279ae60 00000000`4816a7f0 00000000`0548ecf0 : rpcrt4!Ndr64StubWorker+0x6ee
00000000`0548ec40 00007ffe`38833dcd     : 00000000`00000000 00000000`0548ee50 00007ffe`2a06a540 00000000`00000000 : rpcrt4!NdrStubCall3+0xc0
00000000`0548ecb0 00007ffe`38833d0b     : 00000000`00000001 00000000`0af2e1e0 00000000`00000000 00000000`00000000 : combase!CStdStubBuffer_Invoke+0x7d
00000000`0548ecf0 00007ffe`38833286     : 00000000`010d91e8 00000000`0548ee00 00000000`0548ed98 00000000`328ba2a8 : combase!ObjectMethodExceptionHandlingAction<<lambda_c9f3956a20c9da92a64affc24fdd69ec> >+0x47
00000000`0548ed50 00007ffe`388328d1     : 00000000`47d38920 00000000`0548efa0 00000000`3b6d8580 00000000`80004021 : combase!DefaultStubInvoke+0x376
00000000`0548ef10 00007ffe`388ad8a6     : 00390042`00000006 00000000`47d38920 00000000`0548f160 00000000`00000000 : combase!StubInvoke+0x321
00000000`0548f060 00007ffe`3883cf64     : 00000000`00000000 00000000`00000000 00000000`03c9d5d0 00000000`00000000 : combase!ServerCall::ContextInvoke+0x2c6
00000000`0548f290 00007ffe`387d7785     : 00000000`00000000 00000000`3b6d8580 00000000`00000083 00007ffe`387d7384 : combase!ReentrantSTAInvokeInApartment+0x194
00000000`0548f380 00007ffe`387d3530     : 00000000`0af2e150 00000000`3b6d8580 00000000`0af2e150 00000000`00000000 : combase!ComInvokeWithLockAndIPID+0xcf5
00000000`0548f670 00007ffe`38910a9b     : 00000000`3b6d8590 00000000`010c0a40 00000000`00000400 00000000`00000000 : combase!ThreadDispatch+0x440
00000000`0548f7d0 00007ffe`39457846     : 00000000`00000000 00000000`0548fa88 00000000`00000001 00000000`00000000 : combase!ThreadWndProc+0x19b
00000000`0548f830 00007ffe`3945539d     : 00000000`0548fa48 00007ffe`38910900 00000000`0001013a 00000000`00000000 : user32!UserCallWinProcCheckWow+0x356
00000000`0548f990 00007ffe`3964a992     : 00000000`0548fa48 00000000`03c35cb0 00000000`00000000 00000000`00000000 : user32!DispatchMessageWorker+0x1dd
00000000`0548fa10 00007ffe`39649c47     : 00000000`00000001 00000000`00000000 00000000`00000718 00000000`00000000 : SHCore!WorkThreadManager::CThread::ThreadProc+0x1de
00000000`0548fab0 00007ffe`3939e8d7     : 00000000`03c35cb0 00000000`00000000 00000000`00000000 00000000`00000000 : SHCore!<lambda_9844335fc14345151eefcc3593dd6895>::<lambda_invoker_cdecl>+0x17
00000000`0548fae0 00007ffe`3a46c53c     : 00000000`00000000 00000000`00000000 000004f0`fffffb30 000004d0`fffffb30 : kernel32!BaseThreadInitThunk+0x17
00000000`0548fb10 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x2c


STACK_COMMAND:  ~4s; .ecxr ; kb

SYMBOL_NAME:  shell32!COperationStatusTileRateChart::COperationStatusTileRateChart+33

MODULE_NAME: shell32

IMAGE_NAME:  shell32.dll

FAILURE_BUCKET_ID:  NULL_POINTER_READ_c0000005_shell32.dll!COperationStatusTileRateChart::COperationStatusTileRateChart

OS_VERSION:  10.0.26100.1

BUILDLAB_STR:  ge_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

IMAGE_VERSION:  10.0.26100.7070

FAILURE_ID_HASH:  {f6d0fcf8-440f-b0be-4688-8926cdb7c1aa}

Followup:     MachineOwner
---------

0:004> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

Failed to request MethodData, not in JIT code range

KEY_VALUES_STRING: 1

    Key  : AV.Dereference
    Value: NullPtr

    Key  : AV.Fault
    Value: Read

    Key  : Analysis.CPU.mSec
    Value: 4749

    Key  : Analysis.Elapsed.mSec
    Value: 4838

    Key  : Analysis.IO.Other.Mb
    Value: 82

    Key  : Analysis.IO.Read.Mb
    Value: 1

    Key  : Analysis.IO.Write.Mb
    Value: 173

    Key  : Analysis.Init.CPU.mSec
    Value: 12155

    Key  : Analysis.Init.Elapsed.mSec
    Value: 165024

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 262

    Key  : CLR.BuiltBy
    Value: NET481REL1LAST_25H2_C

    Key  : CLR.Engine
    Value: CLR

    Key  : CLR.Version
    Value: 4.8.9323.0

    Key  : Failure.Bucket
    Value: NULL_POINTER_READ_c0000005_shell32.dll!COperationStatusTileRateChart::COperationStatusTileRateChart

    Key  : Failure.Hash
    Value: {f6d0fcf8-440f-b0be-4688-8926cdb7c1aa}

    Key  : Timeline.OS.Boot.DeltaSec
    Value: 4089

    Key  : Timeline.Process.Start.DeltaSec
    Value: 4078

    Key  : WER.OS.Branch
    Value: ge_release

    Key  : WER.OS.Version
    Value: 10.0.26100.1

    Key  : WER.Process.Version
    Value: 10.0.26100.7070


FILE_IN_CAB:  explorer.exe.9816.dmp

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

CONTEXT:  (.ecxr)
rax=00008449bcecfca2 rbx=0000000000000000 rcx=0000000047cf9450
rdx=0000000000000001 rsi=000000003d57ec10 rdi=0000000047cf9450
rip=00007ffe39b0203f rsp=000000000548e0b0 rbp=0000000000000000
 r8=0000000000000000  r9=0000000000000000 r10=0000000000ff0320
r11=000000000548e040 r12=000000004817c8c0 r13=0000000000000001
r14=0000000000000001 r15=000000003d57eb60
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010202
shell32!COperationStatusTileRateChart::COperationStatusTileRateChart+0x33:
00007ffe`39b0203f 498b00          mov     rax,qword ptr [r8] ds:00000000`00000000=????????????????
Resetting default scope

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ffe39b0203f (shell32!COperationStatusTileRateChart::COperationStatusTileRateChart+0x0000000000000033)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: 0000000000000000
Attempt to read from address 0000000000000000

PROCESS_NAME:  explorer.exe

READ_ADDRESS:  0000000000000000 

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p            0x%p                    %s

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  0000000000000000

STACK_TEXT:  
00000000`0548e0b0 00007ffe`399210e6     : 00000000`00000000 00000000`00000000 00000000`000807bc 00000000`3d57ec10 : shell32!COperationStatusTileRateChart::COperationStatusTileRateChart+0x33
00000000`0548e100 00007ffe`39b0ad96     : 00000000`3d57eb60 00000000`0548e270 00000000`00000001 00000000`00000000 : shell32!COperationStatusTileRateChart::s_CreateInstance+0x72
00000000`0548e130 00007ffe`3990ff4f     : 00000000`00000001 00000000`48550e50 00000000`00000001 00000000`0548e270 : shell32!COperationStatusTile::_CreateRateChart+0x106
00000000`0548e170 00007ffe`39b0c534     : 00000000`00000000 00007ffd`c8fc1f17 00000000`48550d80 00000000`000807bc : shell32!COperationStatusTile::_CreateTileElement+0x1ab
00000000`0548e430 00007ffe`39870833     : 00000000`47f50820 00000000`00010184 00000000`00000001 00000000`00000001 : shell32!COperationStatusTile::_Initialize+0x90
00000000`0548e460 00007ffe`3987067e     : 00000000`327aad80 00000000`0548e561 00000000`00000001 00000000`000807bc : shell32!COperationStatusTile::s_CreateInstance+0xaf
00000000`0548e4b0 00007ffe`38c13663     : 00000000`327aad40 00000000`00010184 00000000`00000000 00000000`00000000 : shell32!COperationStatusService::RegisterOperationTile+0x1ae
00000000`0548e5b0 00007ffe`38c1570e     : 00007ffe`2a05a3e0 00000000`0548ecf0 00000000`0af2e1e0 00000000`00000000 : rpcrt4!Invoke+0x73
00000000`0548e630 00007ffe`38b56c50     : 00007ffe`38a9cd82 00000000`1279ae60 00000000`4816a7f0 00000000`0548ecf0 : rpcrt4!Ndr64StubWorker+0x6ee
00000000`0548ec40 00007ffe`38833dcd     : 00000000`00000000 00000000`0548ee50 00007ffe`2a06a540 00000000`00000000 : rpcrt4!NdrStubCall3+0xc0
00000000`0548ecb0 00007ffe`38833d0b     : 00000000`00000001 00000000`0af2e1e0 00000000`00000000 00000000`00000000 : combase!CStdStubBuffer_Invoke+0x7d
00000000`0548ecf0 00007ffe`38833286     : 00000000`010d91e8 00000000`0548ee00 00000000`0548ed98 00000000`328ba2a8 : combase!ObjectMethodExceptionHandlingAction<<lambda_c9f3956a20c9da92a64affc24fdd69ec> >+0x47
00000000`0548ed50 00007ffe`388328d1     : 00000000`47d38920 00000000`0548efa0 00000000`3b6d8580 00000000`80004021 : combase!DefaultStubInvoke+0x376
00000000`0548ef10 00007ffe`388ad8a6     : 00390042`00000006 00000000`47d38920 00000000`0548f160 00000000`00000000 : combase!StubInvoke+0x321
00000000`0548f060 00007ffe`3883cf64     : 00000000`00000000 00000000`00000000 00000000`03c9d5d0 00000000`00000000 : combase!ServerCall::ContextInvoke+0x2c6
00000000`0548f290 00007ffe`387d7785     : 00000000`00000000 00000000`3b6d8580 00000000`00000083 00007ffe`387d7384 : combase!ReentrantSTAInvokeInApartment+0x194
00000000`0548f380 00007ffe`387d3530     : 00000000`0af2e150 00000000`3b6d8580 00000000`0af2e150 00000000`00000000 : combase!ComInvokeWithLockAndIPID+0xcf5
00000000`0548f670 00007ffe`38910a9b     : 00000000`3b6d8590 00000000`010c0a40 00000000`00000400 00000000`00000000 : combase!ThreadDispatch+0x440
00000000`0548f7d0 00007ffe`39457846     : 00000000`00000000 00000000`0548fa88 00000000`00000001 00000000`00000000 : combase!ThreadWndProc+0x19b
00000000`0548f830 00007ffe`3945539d     : 00000000`0548fa48 00007ffe`38910900 00000000`0001013a 00000000`00000000 : user32!UserCallWinProcCheckWow+0x356
00000000`0548f990 00007ffe`3964a992     : 00000000`0548fa48 00000000`03c35cb0 00000000`00000000 00000000`00000000 : user32!DispatchMessageWorker+0x1dd
00000000`0548fa10 00007ffe`39649c47     : 00000000`00000001 00000000`00000000 00000000`00000718 00000000`00000000 : SHCore!WorkThreadManager::CThread::ThreadProc+0x1de
00000000`0548fab0 00007ffe`3939e8d7     : 00000000`03c35cb0 00000000`00000000 00000000`00000000 00000000`00000000 : SHCore!<lambda_9844335fc14345151eefcc3593dd6895>::<lambda_invoker_cdecl>+0x17
00000000`0548fae0 00007ffe`3a46c53c     : 00000000`00000000 00000000`00000000 000004f0`fffffb30 000004d0`fffffb30 : kernel32!BaseThreadInitThunk+0x17
00000000`0548fb10 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!RtlUserThreadStart+0x2c


STACK_COMMAND:  ~4s; .ecxr ; kb

SYMBOL_NAME:  shell32!COperationStatusTileRateChart::COperationStatusTileRateChart+33

MODULE_NAME: shell32

IMAGE_NAME:  shell32.dll

FAILURE_BUCKET_ID:  NULL_POINTER_READ_c0000005_shell32.dll!COperationStatusTileRateChart::COperationStatusTileRateChart

OS_VERSION:  10.0.26100.1

BUILDLAB_STR:  ge_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

IMAGE_VERSION:  10.0.26100.7070

FAILURE_ID_HASH:  {f6d0fcf8-440f-b0be-4688-8926cdb7c1aa}

Followup:     MachineOwner
---------

These are the analysis results of the contents of the explorer.exe.9816.dmp file (after removing BitLocker's disk encryption).

[Aminosserdiar]

Does it happen when all mods are disabled? If not, check which mod causes it.
Also, collect and upload a crash dump. You should be able to get it with the following steps:

• Open regedit
• Go to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting
• Create a key named LocalDumps
• Create a DWORD value named DumpType with value 2
• Trigger the crash
• Go to the %LocalAppData%\CrashDumps folder, you should see a dump file in there

[...]

There're 4 dump files and I chose the latest two to show what happened.

[...]

These are the analysis results of the contents of the explorer.exe.9816.dmp file.

Details

************* Preparing the environment for Debugger Extensions Gallery repositories **************
   ExtensionRepository : Implicit
   UseExperimentalFeatureForNugetShare : true
   AllowNugetExeUpdate : true
   NonInteractiveNuget : true
   AllowNugetMSCredentialProviderInstall : true
   AllowParallelInitializationOfLocalRepositories : true

   EnableRedirectToV8JsProvider : false

   -- Configuring repositories
      ----> Repository : LocalInstalled, Enabled: true
      ----> Repository : UserExtensions, Enabled: true

>>>>>>>>>>>>> Preparing the environment for Debugger Extensions Gallery repositories completed, duration 0.062 seconds

************* Waiting for Debugger Extensions Gallery to Initialize **************

>>>>>>>>>>>>> Waiting for Debugger Extensions Gallery to Initialize completed, duration 0.031 seconds
   ----> Repository : UserExtensions, Enabled: true, Packages count: 0
   ----> Repository : LocalInstalled, Enabled: true, Packages count: 30

Microsoft (R) Windows Debugger Version 10.0.26100.7175 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.


Loading Dump File [C:\Users\Siyua\AppData\Local\CrashDumps\explorer.exe.10312.dmp]
User Mini Dump File with Full Memory: Only application data is available

Symbol search path is: srv*
Executable search path is: 
Windows 10 Version 26220 MP (6 procs) Free x64
Product: WinNt, suite: SingleUserTS
Edition build lab: 26100.1.amd64fre.ge_release.240331-1435
Debug session time: Sat Nov 15 10:59:56.000 2025 (UTC + 8:00)
System Uptime: 0 days 0:11:09.052
Process Uptime: 0 days 0:02:34.000
................................................................
................................................................
................................................................
................................................................
................................................................
................................................................
...............
Loading unloaded module list
..........
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(2848.1ed4): Access violation - code c0000005 (first/second chance not available)
For analysis of this file, run !analyze -v
<Unloaded_taskbar-volume-control_1.2.2_25>+0x314f:
00007ffa`2396314f ??              ???
0:004> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** WARNING: Unable to verify timestamp for taskbar-volume-control_1.2.2_25
Failed to request MethodData, not in JIT code range

KEY_VALUES_STRING: 1

    Key  : AV.Fault
    Value: Execute

    Key  : Analysis.CPU.mSec
    Value: 4343

    Key  : Analysis.Elapsed.mSec
    Value: 15846

    Key  : Analysis.IO.Other.Mb
    Value: 3

    Key  : Analysis.IO.Read.Mb
    Value: 0

    Key  : Analysis.IO.Write.Mb
    Value: 4

    Key  : Analysis.Init.CPU.mSec
    Value: 3781

    Key  : Analysis.Init.Elapsed.mSec
    Value: 28271

    Key  : Analysis.Memory.CommitPeak.Mb
    Value: 172

    Key  : CLR.BuiltBy
    Value: NET481REL1LAST_25H2_C

    Key  : CLR.Engine
    Value: CLR

    Key  : CLR.Version
    Value: 4.8.9323.0

    Key  : Failure.Bucket
    Value: BAD_INSTRUCTION_PTR_c0000005_taskbar-volume-control_1.2.2_25!Unloaded

    Key  : Failure.Hash
    Value: {2ee153fc-04c4-964f-ef09-fd6793f65e13}

    Key  : Timeline.OS.Boot.DeltaSec
    Value: 669

    Key  : Timeline.Process.Start.DeltaSec
    Value: 154

    Key  : WER.OS.Branch
    Value: ge_release

    Key  : WER.OS.Version
    Value: 10.0.26100.1

    Key  : WER.Process.Version
    Value: 10.0.26100.7070


FILE_IN_CAB:  explorer.exe.10312.dmp

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

CONTEXT:  (.ecxr)
rax=0000000000000000 rbx=0000000000000246 rcx=0000000000000000
rdx=0000000000000000 rsi=00000000084e0ca0 rdi=0000000020160001
rip=00007ffa2396314f rsp=000000000552f460 rbp=000000000552f7d0
 r8=0000000000ab1440  r9=0000000042f37f00 r10=0000000000ab0000
r11=0002000000101000 r12=0000000000000001 r13=0000000000000002
r14=00000000000b02f4 r15=0000000000000001
iopl=0         nv up ei pl nz na pe nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010200
taskbar_volume_control_1_2+0x314f:
00007ffa`2396314f ??              ???
Resetting default scope

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ffa2396314f (taskbar_volume_control_1_2+0x000000000000314f)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000008
   Parameter[1]: 00007ffa2396314f
Attempt to execute non-executable address 00007ffa2396314f

PROCESS_NAME:  explorer.exe

EXECUTE_ADDRESS: 7ffa2396314f

FAILED_INSTRUCTION_ADDRESS: 
taskbar-volume-control_1.2.2_25!Unloaded+314f
00007ffa`2396314f ??              ???

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%p            0x%p                    %s

EXCEPTION_CODE_STR:  c0000005

EXCEPTION_PARAMETER1:  0000000000000008

EXCEPTION_PARAMETER2:  00007ffa2396314f

IP_ON_HEAP:  00000000000b02f4
The fault address in not in any loaded module, please check your build's rebase
log at <releasedir>\bin\build_logs\timebuild\ntrebase.log for module which may
contain the address if it were loaded.

IP_IN_FREE_BLOCK: b02f4

FRAME_ONE_INVALID: 1

STACK_TEXT:  
00000000`0552f460 00000000`000b02f4     : 00000000`00000246 00000000`00000246 00000000`084e0ca0 000004b0`00000000 : taskbar_volume_control_1_2+0x314f
00000000`0552f468 00000000`00000246     : 00000000`00000246 00000000`084e0ca0 000004b0`00000000 00000000`00000000 : 0xb02f4
00000000`0552f470 00000000`00000246     : 00000000`084e0ca0 000004b0`00000000 00000000`00000000 00000000`00000000 : 0x246
00000000`0552f478 00000000`084e0ca0     : 000004b0`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x246
00000000`0552f480 000004b0`00000000     : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000246 : 0x84e0ca0
00000000`0552f488 00000000`00000000     : 00000000`00000000 00000000`00000000 00000000`00000246 00007ff9`efbf3410 : 0x000004b0`00000000


STACK_COMMAND:  ~4s; .ecxr ; kb

SYMBOL_NAME:  taskbar-volume-control_1.2.2_25!Unloaded+314f

MODULE_NAME: taskbar-volume-control_1.2

IMAGE_NAME:  taskbar-volume-control_1.2.2_25

FAILURE_BUCKET_ID:  BAD_INSTRUCTION_PTR_c0000005_taskbar-volume-control_1.2.2_25!Unloaded

OS_VERSION:  10.0.26100.1

BUILDLAB_STR:  ge_release

OSPLATFORM_TYPE:  x64

OSNAME:  Windows 10

FAILURE_ID_HASH:  {2ee153fc-04c4-964f-ef09-fd6793f65e13}

Followup:     MachineOwner
---------

These are the analysis results of the contents of the explorer.exe.10312.dmp file (before removing BitLocker's disk encryption).

[m417z]

Thanks.

These are the analysis results of the contents of the explorer.exe.9816.dmp file (after removing BitLocker's disk encryption).

The crash happens in Explorer code, and I see no indication that it's related to Windhawk.

These are the analysis results of the contents of the explorer.exe.10312.dmp file (before removing BitLocker's disk encryption).

This crash is related to the Taskbar Volume Control mod, and it seems to occur when the mod is unloaded. There's a known issue related to mod unloading which can cause a crash in rare cases. The issue will be fixed in the next update.

The crash happens only once after exiting/restarting Windhawk, right?

[Aminosserdiar]

Thanks.

These are the analysis results of the contents of the explorer.exe.9816.dmp file (after removing BitLocker's disk encryption).

The crash happens in Explorer code, and I see no indication that it's related to Windhawk.

These are the analysis results of the contents of the explorer.exe.10312.dmp file (before removing BitLocker's disk encryption).

This crash is related to the Taskbar Volume Control mod, and it seems to occur when the mod is unloaded. There's a known issue related to mod unloading which can cause a crash in rare cases. The issue will be fixed in the next update.
The crash happens only once after exiting/restarting Windhawk, right?

Crashes don't happen again after exiting Windhawk, and even crashes could happen before installing Taskbar Volume Control when Windhawk starts.

[m417z]

crashes could happen before installing Taskbar Volume Control when Windhawk starts.

Could you provide a crash dump for that?

[Aminosserdiar]

crashes could happen before installing Taskbar Volume Control when Windhawk starts.

Could you provide a crash dump for that?

Those I've offered were the dumps before installing Taskbar Volume Control.

[m417z]

I commented on them. One of them was clearly with Taskbar Volume Control loaded.

In any case, perhaps that's related to the mod unloading issue that I mentioned, which, as I said, will be fixed in the next Windhawk version.

[Aminosserdiar]

I commented on them. One of them was clearly with Taskbar Volume Control loaded.

In any case, perhaps that's related to the mod unloading issue that I mentioned, which, as I said, will be fixed in the next Windhawk version.

OK, I'm waiting for it, thanks so much.

[m417z]

Please try version 1.7, let me know if it still crashes for you.