Process Explorer 17.2 crashes (0xC06D007E) when third-party perf counter DLLs need dependencies outside System32

Peter Fraser 0 Reputation points
2026-11-01T18:25:58.7033333+00:00

There’s no email address for Sysinternals bug reports. The channel Microsoft uses in practice is Microsoft Q&A at learn.microsoft.com/answers, tagged Sysinternals. Past Process Explorer bug reports have gone there, for example this Process Explorer v17.04 bug report and this Process Explorer 16.42 Help bug. The Sysinternals forum on Tech Community is the alternative, but a reply there says plainly it’s “not an engineering issue tracker”. I’d post on Q&A. Q&A doesn’t accept .dmp attachments, so the text offers the dumps on request.

Title: Process Explorer 17.2 crashes (0xC06D007E) when third-party perf counter DLLs need dependencies outside System32

Process Explorer 17.2 (procexp64.exe, built 2026-10-15; both the standalone
download and the Microsoft Store Sysinternals Suite 2026.10.0.0 package)
crashes with exception 0xC06D007E (delay-load module not found) on a
system with SQL Server 2019 installed. Earlier versions ran on the same
machine without problems.

Environment
- Windows 11, build 26100/26300 (KERNELBASE.dll 10.0.26100.9711)
- SQL Server 2019 (MSSQLSERVER default instance, 15.0.2200.2 GDR)

Analysis of the crash dumps
- The fault is in KERNELBASE.dll at offset 0xC408A, exception 0xC06D007E,
  DelayLoadInfo.dwLastError = 126.
- The delay-load is issued by SQL Server's performance counter providers,
  which Windows loads into procexp when it reads performance counters:
    C:\Windows\System32\perf-MSSQLSERVER-sqlctr15.0.2200.2.dll
    C:\Windows\System32\perf-MSSQL15.MSSQLSERVER-sqlagtctr.dll
  Both delay-load instapi150.dll (IsDefaultInstanceName,
  GetSQLServiceByName), which is installed in
  C:\Program Files\Microsoft SQL Server\150\Shared\.
- procexp64.exe 17.2 has DependentLoadFlags = 0x800
  (LOAD_LIBRARY_SEARCH_SYSTEM32) and imports SetDefaultDllDirectories.
  With the DLL search limited to System32, the counter provider cannot
  find instapi150.dll. The delay-load exception is not handled, and the
  process terminates.

Confirmation
- Adding ...\150\Shared to PATH has no effect (as expected under
  LOAD_LIBRARY_SEARCH_SYSTEM32).
- Setting "Disable Performance Counters" = 1 on each SQL counter
  provider stops the crash, one provider at a time.
- Copying instapi150.dll into System32 stops the crash.

Suggested fix
Process Explorer should not terminate because a third-party counter
provider fails to load. Either guard the counter-collection path against
delay-load exceptions, or restore the default DLL search for that path.
Any machine with SQL Server (and probably other vendors' counter
providers with dependencies outside System32) will hit this.

I can provide the crash dumps on request.

Peter Fraser
Sysinternals
Sysinternals

Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.

0 comments No comments

1 answer

Sort by: Newest
  1. Jim Willsher 0 Reputation points
    2026-11-02T13:49:32.36+00:00

    Different exception code, but I'm also getting crashes with 17.20 and I suspect it could be a similar issue. That said, disabling performance counters for SQL and SQL Agent does not solve the problem.

    Step to recreate: click the .Net Assemblies tab on a process. Boom.

    Faulting application name: procexp64.exe, version: 17.2.0.0, time stamp: 0x6ad089e9

    Faulting module name: procexp64.exe, version: 17.2.0.0, time stamp: 0x6ad089e9

    Exception code: 0xc0000409

    Fault offset: 0x00000000000fbe02

    Faulting process ID: 0x3a48

    Faulting application start time: 0x01dd6acf35d8b4be

    Was this answer helpful?

    0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.