Process Explorer latest version will not start in Windows 10 - earlier versions from 2012 do RRS feed

  • Question

  • event viewer shows 

    Faulting application name: procexp64.exe, version:, time stamp: 0x5d70cac3
    Faulting module name: procexp64.exe, version:, time stamp: 0x5d70cac3
    Exception code: 0xc0000409
    Fault offset: 0x00000000000ab1f8
    Faulting process id: 0x5418
    Faulting application start time: 0x01d5963a9a372794
    Faulting application path: C:\Users\SLATTE~1\AppData\Local\Temp\procexp64.exe
    Faulting module path: C:\Users\SLATTE~1\AppData\Local\Temp\procexp64.exe
    Report Id: 33d61471-38bb-4440-8f42-7eb67b4e7e1a
    Faulting package full name: 
    Faulting package-relative application ID: 

    same problem on 32 bit version 

    will not start under any circumstances 

    an older version 15.22 works fine.   

    version of Windows 

    Microsoft Windows [Version 10.0.17134.1069]  64 bit win 10 

    Any ideas ? 

    Friday, November 8, 2019 1:47 PM

All replies

  • The error means:

    err 0xc0000409
    # for hex 0xc0000409 / decimal -1073740791
      STATUS_STACK_BUFFER_OVERRUN                                    ntstatus.h
    # The system detected an overrun of a stack-based buffer in
    # this application. This overrun could potentially allow a
    # malicious user to gain control of this application.
    # 1 matches found for "0xc0000409"

    What is that?

    Why you are receiving that error? Is it possible that you enabled Control Flow Guard on your system?


    Friday, November 8, 2019 4:36 PM
  • After looking at my machine it seems that those settings are on by default.. and on my Windows version procexp64 always works like a charm.

    SO, it must be something else.

    DO you have any antivirus that inject something in the running process? You can see this using Autoruns in the Image Hijacks and Appinit sections


    Friday, November 8, 2019 4:44 PM
  • It is not CFG

    There are no image hijacks per Autoruns 

    As I said, an earlier version of procexp.exe works OK so it must be a bug in procexp somewhere 

    Monday, November 11, 2019 4:08 PM
  • As WER is already configured on your system, please add the latest registry key to collect user dumps from it:

    Then, once you have collected the dump, share it via some onedrive folder or anything you prefer.

    Hopefully someone will have a look at it.


    Monday, November 11, 2019 9:27 PM
  • Yes indeed. Thank you Mario.

    CSL99 please contact me offline at and I will take a look at the dump for you.


    Tuesday, November 12, 2019 3:37 PM
  • will do 
    Tuesday, November 12, 2019 4:18 PM
  • Deleting the registry key fixed this for me.

    I was getting the same error.


    Sorry i didn't troubleshoot this a great deal, just tried a suggestion i found on StackOverflow from 6 years ago.

    FYI - I installed sysinternals using chocolatey and it recently updated using chocolatey. I don't know if the problem occurred prior to this version or even if chocolatey is the culprit.

    After deleting the key, I just had to agree to the EULA again and all is working.

    Tuesday, July 14, 2020 7:29 AM
  • Interesting. Thanks for the suggestion. If anybody else experiences this issue and have a dump file that they can share with us could you contact me offline at and I can take a look for you.


    Wednesday, July 15, 2020 7:01 AM