Share via

procmon.exe vs procmon64.exe

misvin 21 Reputation points
2021-06-05T13:36:38.87+00:00

Environment:
Windows 10 Pro 21H1 (64-bit)
Process Monitor 3.82

The 32-bit Procmon.exe contains the 64-bit exe inside it as a binary resource. When the 32-bit exe starts, it extracts the 64-bit version out to the %Temp% folder as Procmon64.exe and then executes that.

Question:
What is the difference between start Process Monitor 3.82 application from Procmon.exe and Procmon64.exe on Windows 10 (64-bit)?

Sysinternals
Sysinternals
Advanced system utilities to manage, troubleshoot, and diagnose Windows and Linux systems and applications.
1,250 questions
0 comments
Accepted answer
  1. Castorix31 90,686 Reputation points
    2021-06-13T10:12:53.187+00:00

    There is no difference
    procmon.exe checks the OS (mainly with IsWow64Process)
    and if x64, it extracts Procmon64.exe from resources and launches it with ShellExecuteEx

    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. WndSks 1 Reputation point
    2021-06-13T00:33:31.59+00:00

    Nano Server and other minimal SKUs don't have WoW64 support (at all or by default) and therefore the 32-bit process will not be able to run.

    On systems with WoW64 there is no difference other than the minor overhead of extracting and running the embedded 64-bit binary.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.