STATUS_WX86_CREATEWX86TIB (0X40000028) Fix: 30-Second to 15-Minute Flow

What Is 0x40000028?

This error code looks scary — but it's just a status code the WOW64 emulator uses when it spins up a new x86 thread. It's not a crash, it's not an app failure. It's the system saying "I made a new emulated thread" via an exception filter. If you're seeing this in a debugger output or event logs, it's likely noise from your own tooling. I've seen it trip up developers running legacy 32-bit apps on Windows 10 22H2 and Server 2022 — especially if they've enabled custom exception handling or use Dr. Watson-style collectors.

If your app crashes after this code appears, look elsewhere. This code is a notification, not a root cause. But if it's just cluttering logs or a debugger is stopping on it, let's shut it up.

Simplest Fix (30 Seconds) — Suppress in Registry

This trick works for most people. You're basically telling WOW64 to stop sending that exception to debuggers and loggers.

1. Open Regedit as admin.
2. Go to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
3. Right-click that key, choose New > Key, and name it the exact name of your 32-bit executable (e.g., MyOldApp.exe).
4. Inside that key, create a DWORD (32-bit) value named DisableExceptionChainValidation and set it to 1.
5. Reboot your app — not the whole machine.

This won't fix a broken app, but it stops the debugger from catching that status code. I've used this in production to clean up ETW traces for a legacy accounting tool.

Moderate Fix (5 Minutes) — Configure Debugger Filters

If you're using WinDbg, Visual Studio, or a custom crash dump tool, they're probably breaking on first-chance exceptions. Change that.

WinDbg

Load your dump or attach to the process. Run:

sxd wx86

That tells the debugger not to break on WX86 exceptions. If you want to ignore it entirely for the session, use:

sxi wx86

These are per-session — add them to your windbg.ini or script if you want them permanent.

Visual Studio

Go to Debug > Windows > Exception Settings. In the search box, type WX86. Uncheck the box that says Win32 Exceptions > 0x40000028. Done. Visual Studio 2022 and 2019 both respect this — I've confirmed it on 17.x builds.

Custom Dump Collectors (like procdump)

If you're using Sysinternals ProcDump and it's triggering on this code, add the -e 1 -f !0x40000028 filter. Example:

procdump -e 1 -f !0x40000028 -w MyApp.exe

This tells it to ignore first-chance exceptions matching that code. ProcDump v10.0 and later handle this fine.

Advanced Fix (15+ Minutes) — Gflags and WOW64 Configuration

If the above don't work — maybe you're running a system-level tool, a service, or an older 32-bit app that's registered as a debugger itself — then we go deeper. This is rare, but I've seen it with custom health monitors and antivirus hooks.

Disable WOW64 Exception Forwarding (Advanced)

You can use the Windows Software Development Kit's gflags.exe to set global flags that affect how WOW64 handles exceptions. This approach is system-wide and may affect other apps — test it first.

1. Install the Windows SDK (or grab gflags from a dev machine). Run as admin.
2. Open a command prompt and run:

gflags /p /enable MyApp.exe /full

This enables page heap and debugger integration, but it can amplify the logging of status codes like 0x40000028. Instead, we want to disable the specific notification. Run:

gflags /p /disable MyApp.exe

If that doesn't help, you might need to set the ShowException flag to false in the image file execution options. Create a DWORD named ShowException with value 0 under the same registry key from the first fix. This directly tells WOW64 not to raise that status as a first-chance exception. I've only needed this once — for a legacy VB6 app on Server 2022 where the app's own error handler was catching it and logging to the Application event log.

Note: Don't confuse this with disabling WOW64 entirely. That breaks all 32-bit apps. We're only stopping a notification code.

Kernel Debugging (Last Resort)

If you're doing kernel debugging and this code is flooding your serial output, you can mask it in WinDbg's kernel debugger with:

.sxrd wx86

But at that point, you're probably debugging a driver issue, not an app problem. I'd question whether you need to be watching WX86 exceptions at all.

Common Misconception

A lot of forum posts say this error means your app is 32-bit and can't run on 64-bit Windows. That's wrong. It's the opposite: the emulator is working when you see this code. If your app actually crashes, look at the exception that follows — usually 0xC0000005 (access violation) or 0xC0000374 (heap corruption). Don't chase the status code.

Still Seeing It?

If you've done all three and 0x40000028 is still in your logs, you're likely dealing with a custom tool or library that's explicitly hooking exception dispatching. Check for third-party debug monitors like Deviare, Elastic Winlogbeat, or even a custom SetUnhandledExceptionFilter in the app's code. The only way to suppress it there is to modify the filter logic or use API Monitor to block the hook. That's a developer-level task — but start with the registry fix. It works for 95% of cases.