--- title: "Forensic Root-Cause Case Study: How a Sleeping Bluetooth Keyboard and Dell Peripheral Manager (VID_FFFF&PID_BACE) Spawned 1,349 Calculator Instances in Explorer.exe | GreenTree Field Notes" url: https://www.greentreehosting.com/field-notes/windows-twinui-event-5961-dell-dpmservice-calculator-spawn-storm-forensics/ description: "By Gene Salvatore: Exact timeline correlation between Microsoft-Windows-TWinUI/Operational Event ID 5961 and Dell Peripheral Manager DPMService-log.txt (ReadFile failed gle: 0x3e5 on Col04) firing APPCOMMAND_LAUNCH_APP2 (AppKey\\18) at 0.2ms intervals." format: text/markdown generated_from: prerendered HTML (build time) --- [ALL SYSADMIN FIELD NOTES & RUNBOOKS](https://www.greentreehosting.com/field-notes) FN-2026-05 // ROOT-CAUSE FORENSICSRoot-Cause Forensics · 8 min read # Forensic Root-Cause Case Study: How a Sleeping Bluetooth Keyboard and Dell Peripheral Manager (VID_FFFF&PID_BACE) Spawned 1,349 Calculator Instances in Explorer.exe When a machine locks up three times in four days with zero obvious error dialogs, most people reboot, reinstall drivers at random, or blame Windows. Here is how our infrastructure engineering workflow traced a mysterious workstation crash to the exact millisecond—and why root-cause forensics beats trial-and-error every time. Published: 2026-10-25•Last tested: 2026-10-25•Tested on Windows 11 Pro 24H2 (Dell Latitude 9450), Dell KB700/KB7221W (VID_413C&PID_2511) & Dell Peripheral Manager 1.7.x 01 // THE SYMPTOM A Dell Latitude 9450 workstation periodically froze until virtual memory hit 0 and explorer.exe crashed—even when undocked, on battery power, and unplugged from all USB cables. 02 // THE ROOT CAUSE When the paired Dell KB700/KB7221W Bluetooth LE keyboard (VID_413C&PID_2511) went to sleep or dropped out of range across the room, Dell Peripheral Manager (DPMService.exe) failed ReadFile on Col04 (gle: 0x3e5) and left its software virtual USB keyboard (VID_FFFF&PID_BACE) stuck blasting APPCOMMAND_LAUNCH_APP2 (Launch Calculator) into explorer.exe ~3,000 times per second. 03 // THE PERMANENT FIX Two-layer defense: (1) Place an idempotent single-instance guard on HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\18 so Calculator only opens or focuses one window, and (2) Stop and disable the buggy DPMService background service. EVENT CORRELATION 3 / 3 Crashes DPMService-log.txt gle: 0x3e5 preceded TWinUI Event ID 5961 on Oct 22, Oct 24 & Oct 25 PACKET STORM RATE Every 0.2ms 1,349+ Calculator activations fired across 15+ threads in explorer.exe until RAM exhausted HIDDEN VIRTUAL HID VID_FFFF&PID_BACE Dell Peripheral Manager Virtual Device - 1 injected media/app keys even while undocked TWO-LAYER REMEDIATION AppKey\18 + Service Single-instance registry guard on AppKey\18 + disabling DPMService stops the repeat loop **Sysadmin Safety Notice:**Test registry and service changes on a non-production system first. Always back up HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\18 using reg export before modifying registry keys. INTERACTIVE SYSADMIN RUNBOOK · SAVED IN YOUR BROWSER ## Interactive Workstation & Server Hang Forensic Triage Checklist Use this diagnostic sequence if a Windows workstation or server experiences mysterious Explorer hangs or runaway app spawns: PROGRESS: 0 OF 5 STEPS VERIFIED (0%)CLICK ANY STEP TO CHECK OFF Check Microsoft-Windows-TWinUI/Operational (Event ID 5961) around the exact freeze timestamp Look for high-frequency UWP/Store app activation bursts (such as Microsoft.WindowsCalculator) firing hundreds of times within a few seconds. Enumerate all present HID and Virtual HID devices (including software filter drivers) Unplugging physical USB cables does not remove software virtual HID keyboards (like VID_FFFF&PID_BACE) or internal Bluetooth LE pairings (BTHLE\DEV_...). Inspect C:\ProgramData\Dell\Dell Peripheral Manager\DPMService\Log\DPMService-log.txt Search for ReadFile failed (gle: 0x3e5) on HID Col04 immediately preceding the TWinUI activation storm. Back up and add a Single-Instance Guard on HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\18 Export the existing key first, then override AppKey\18 (APPCOMMAND_LAUNCH_APP2) so pressing the Calculator key checks if CalculatorApp.exe is already running and focuses it instead of spawning infinite instances. Stop and disable DPMService (Dell Peripheral Manager Service) Standard Windows Bluetooth LE and USB HID drivers operate Dell keyboards and mice natively without the buggy DPMService virtual device. FIELD NOTE 01 // THE PUZZLE: WHY DID IT HAPPEN UNDOCKED? ## 1. Correlating TWinUI Event ID 5961 With DPMService-log.txt Across All Three Crashes What made this bug deceptive at first glance was that it happened even when the laptop (a Dell Latitude 9450) was completely undocked, sitting on battery power, with no external USB keyboard plugged in. Yet three times in four days (`Oct 22`, `Oct 24`, and `Oct 25`), `explorer.exe` suddenly spun up 15+ threads and consumed every byte of system commit memory until the machine locked up. Instead of guessing, we pulled the `Microsoft-Windows-TWinUI/Operational` log right before each crash and cross-referenced every background service log on the machine. That uncovered two critical facts: • **1. The Hidden Virtual Keyboard (`USB\VID_FFFF&PID_BACE`):** Dell Peripheral Manager (`DPMService.exe`) installs a software **Virtual USB Keyboard (`Dell Peripheral Manager Virtual Device - 1`)** inside Windows to translate programmable hotkeys. • **2. Direct Bluetooth LE Pairing Across the Room:** The external **Dell KB700 / KB7221W keyboard (`VID_413C&PID_2511`)** was paired directly to the laptop’s internal Bluetooth LE radio—not just the USB dongle in the dock. When the laptop was undocked or carried into another room, the keyboard’s Bluetooth LE connection went to sleep or dropped out of range. At that exact moment, `DPMService` logged `ReadFile failed (gle: 0x3e5)` on `Col04` (the programmable Calculator key channel)—and its virtual HID device got stuck blasting `APPCOMMAND_LAUNCH_APP2` (`Launch Calculator`) into `explorer.exe` **every 0.2 milliseconds**! | Crash Date | DPMService-log.txt Failure Event | TWinUI Calculator Storm Start | Calculator Spawns Logged | | --- | --- | --- | --- | | Thu Oct 22 | 19:29:26 — ReadFile failed (gle: 0x3e5) on HID VID_413C&PID_2511 Col04 | 19:31:57 (Event ID 5961) | 229+ instances (crashed explorer.exe) | | Sat Oct 24 | 06:10:06 — ReadFile failed (gle: 0x3e5) on HID VID_413C&PID_2511 Col04 | 06:11:00 (Event ID 5961) | 350+ instances (forced reboot at 07:33 AM) | | Sun Oct 25 | 06:19:35 — ReadFile failed (gle: 0x3e5) on HID VID_413C&PID_2511 Col04 | 06:20:53 (Event ID 5961) | 1,349+ instances (fired every 0.2ms until virtual memory hit 0) | FIELD NOTE 02 // THE TWO-LAYER PERMANENT FIX ## 2. Stopping the Storm Permanently While Keeping the Calculator Key Working In systems engineering, we never rely on a single fix when a two-layer defense costs nothing extra: • **Layer 1 — Single-Instance Guard on `Explorer\AppKey\18`:** Windows maps the hardware Calculator key (`APPCOMMAND_LAUNCH_APP2`) to registry key `18` under `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\18`. By default, Windows spawns a brand-new `CalculatorApp.exe` process every time that key fires—even if 500 copies are already opening. Routing `AppKey\18` through a tiny single-instance check ensures that if Calculator is not running, it opens **one** Calculator window; if Calculator is already running, it brings the existing window to the front and ignores any flood. • **Layer 2 — Disabling `DPMService`:** Because the Dell keyboard and mouse work natively over standard Windows Bluetooth and USB HID drivers, stopping and disabling `DPMService` removes the buggy `VID_FFFF&PID_BACE` virtual device altogether. PowerShell Diagnostic & Remediation Commands (Test on Non-Production System & Back Up Registry First) ``` # 0. Back up existing AppKey\18 registry key before making any changes reg export "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\18" "$env:USERPROFILE\Desktop\AppKey18-backup.reg" /y # 1. Check TWinUI Operational Log for Calculator Activation Storms (Event ID 5961) Get-WinEvent -LogName 'Microsoft-Windows-TWinUI/Operational' | Where-Object { $_.Id -eq 5961 -and $_.Message -match 'Calculator' } | Group-Object { $_.TimeCreated.ToString('yyyy-MM-dd HH:mm') } | Sort-Object Count -Descending | Select-Object -First 10 Count, Name # 2. Check Dell Peripheral Manager Log for ReadFile (gle: 0x3e5) on Col04 Select-String -Path "C:\ProgramData\Dell\Dell Peripheral Manager\DPMService\Log\DPMService-log.txt" -Pattern "ReadFile failed|0x3e5|Col04" | Select-Object -Last 15 # 3. Stop & Disable Dell Peripheral Manager Service (Standard Windows HID Drivers Remain Active) Stop-Service -Name "DPMService" -Force Set-Service -Name "DPMService" -StartupType Disabled ``` ⚠ Test on a non-production system first and verify backups before running administrative commands. SYSADMIN Q&A ## Common Questions on Dell DPMService & TWinUI Calculator Storm Forensics ### If I disable DPMService (Dell Peripheral Manager), will my Dell wireless keyboard and mouse still work? Yes. Standard Windows USB HID and Bluetooth LE drivers handle typing, mouse movement, scrolling, volume keys, and the dedicated Calculator key natively. Disabling DPMService simply removes Dell’s custom background service and its virtual USB device (VID_FFFF&PID_BACE). ### Why did the Calculator storm happen when the laptop was undocked and unplugged? Because the keyboard was paired via Bluetooth LE directly to the laptop’s internal radio in addition to the dock receiver. When the laptop was undocked or moved across the room, the weak/sleeping Bluetooth LE connection caused DPMService’s ReadFile call on HID Col04 to abort with error 0x3e5, leaving the virtual keyboard driver stuck repeating the Calculator key. ### What is AppKey\18 in the Windows Registry? Under HKLM and HKCU Software\Microsoft\Windows\CurrentVersion\Explorer\AppKey\18, Windows defines the action for APPCOMMAND_LAUNCH_APP2 (the dedicated Calculator media key found on many keyboards). Overriding AppKey\18 in HKCU lets you replace the default multi-instance launch behavior with a single-instance check. COMPANION CORNERSTONE REFERENCE GUIDE (/LIBRARY) ### Should You Run Your Own Server Stack? What Self-Hosting Actually Asks of You See why reading real event logs, correlating service timestamps, and maintaining multi-layer defenses is a full-time engineering discipline. [Read Full Engineering Guide](https://www.greentreehosting.com/library/should-you-run-your-own-server-stack) ACCOUNTABLE SYSTEMS ENGINEERING ### Why Forensic Methodology Matters on Your Production Servers Too Whether we are tracing a workstation HID storm, a PostgreSQL lock, a BIND DNS serial mismatch, or an intermittent mail relay delay, we read the actual logs, correlate the timestamps, and fix the root cause permanently. [Explore Managed Cloud & Server Care](https://www.greentreehosting.com/hosting)[Read Our 28-Year Engineering Story](https://www.greentreehosting.com/story) RELATED FIELD NOTES & RUNBOOKS ## Related Notes From the Sysadmin Desk [View All 8 Field Notes](https://www.greentreehosting.com/field-notes) [DNS & Linux Infrastructure7 min readAuthoritative BIND DNS in the Real World: Why Secondary Nameservers Serve Stale TTLs (And How to Catch Zone Drift in 60 Seconds)Always increment the YYYYMMDDnn SOA serial before rndc reload, strip stale per-record TTL overrides, align registrar glue/NS records with the zone, and query every delegated nameserver directly.Open Field Note & Checklist](https://www.greentreehosting.com/field-notes/bind-dns-soa-serial-drift-and-60-second-ttl-troubleshooting)[DNS & Linux Infrastructure8 min readWritable Standby PostgreSQL Failback Merges: Why ON CONFLICT (id) DO NOTHING Silently Drops Rows on Sequential IDs (And How to Fix It With UUIDs or Split Sequence Ranges)Audit every table in the failback merge list: use UUID primary keys (DEFAULT gen_random_uuid()) on append-only lead/submission tables, or configure non-overlapping odd/even sequence steps (INCREMENT BY 2) dynamically above MAX(id)—and check secondary unique constraints and payload hashes before skipping.Open Field Note & Checklist](https://www.greentreehosting.com/field-notes/postgres-standby-failback-merge-id-collision-and-uuid-vs-sequence-ranges)[Web App Security & Linux Ops7 min readLocking the Front Door on Modern Web Apps: Why Your Production Container Should Never Serve From the Project Root (Plus Our 8-Point Pre-Launch Gate)Enforce strict path.resolve(DIST_DIR) confinement with explicit 403/404 dotfile blocking, disable production .map files, keep secrets strictly server-side, and run an 8-point negative-testing gate before launch.Open Field Note & Checklist](https://www.greentreehosting.com/field-notes/docker-static-asset-isolation-and-8-point-pre-launch-security-gate)