Blog Post

Sysinternals Blog
1 MIN READ

ProcExp, ZoomIt, BgInfo, ListDLLs, ProcDump, ProcMon, PsKill, Sigcheck, ZoomIt for macOS, RDCMan

Alex_Mihaiuc's avatar
Alex_Mihaiuc
Icon for Microsoft rankMicrosoft
Oct 15, 2026

Learn about the latest update to Process Explorer, ZoomIt, BgInfo, ListDLLs, ProcDump, Process Monitor, PsKill, Sigcheck, ZoomIt for macOS, and RDCMan

Process Explorer v17.2 This update to Process Explorer, an advanced process, DLL, and handle viewing utility, adds process efficiency mode support, persistent process activity history, live kerne...
Updated Oct 16, 2026
Version 2.0
trikster's avatar
trikster
Copper Contributor
Oct 20, 2026

deleted- duplicate post

  • Aaron_Margosis's avatar
    Aaron_Margosis
    Brass Contributor
    Oct 20, 2026

    My diagnosis: you're running the 32-bit version of Procexp on 64-bit Windows. Procexp.exe extracts a 64-bit version of itself into your temp directory and runs that. It used to name the temp-dir file "procexp.exe" (or procexp64.exe), but now it uses a temporary file name, leading to what you're seeing. Until the Sysinternals team updates, the best workaround is to run the 64-bit version directly -- run "procexp64.exe" instead of "procexp.exe".

    • tcarcaud's avatar
      tcarcaud
      Copper Contributor
      Oct 29, 2026

      For info, Crowdstrike Falcon scanner classify this behavior of procexp.exe extracting plus executing a temporary file with an arbitrary name highly suspicious and trigger alerts on corporate PCs.