Why does UiPath.Executor.exe crash with exit code 0xC0000005 before any workflow activity executes?
Overview
When UiPath Robot attempts to execute an automation, the job may fail immediately with exit code 0xC0000005 (Attempted to read or write protected memory). The process UiPath.Executor.exe terminates before any workflow activity runs.
This is a process-level crash, not a standard workflow exception. It cannot be caught by a Try/Catch activity and will not produce a meaningful error in Orchestrator or UiPath Assistant.
Symptoms
Confirm this KB applies before proceeding:
- The job shows Faulted within 1–3 seconds of starting
- No activities appear in the Robot execution logs before the crash
- Windows Event Viewer shows an Application Error for
UiPath.Executor.exewith exception code0xc0000005 - Orchestrator or Assistant shows only: "Job stopped with an unexpected exit code: 0xC0000005"
- The issue is consistent and reproducible, not intermittent
Note: If activities started executing before the failure, this KB does not apply.
Self-Troubleshooting
Work through these three checks in order.
Check 1 — Did a Package Update Trigger This?
Goal: Determine if a recently updated activity package caused the crash.
- Check
project.jsonor Orchestrator → Packages, identify any packages updated around the time crashes started - In UiPath Studio → Manage Packages, downgrade the suspected package to the previously working version
- Stop UiRobotSvc via
services.msc, close Studio and Assistant - Delete the affected package folder from
%userprofile%\.nuget\packages\<package-name>\ - Republish and retest
If downgrading resolves it: Stay on the working version and report the regression to UiPath Support with the affected package name and version numbers.
If downgrading does not help: Proceed to Check 2.
Check 2 — Is This Machine-Specific?
Goal: Determine if the issue is tied to this machine or the environment.
- Run the same package version on a different Robot machine or environment
- Run the automation in UiPath Studio debug mode on the affected machine
| Result | What It Means |
|---|---|
| Works on a different machine | Environment-specific - likely AV/EDR or IT policy → Check 3 |
| Crashes in Studio debug mode too | Package or runtime issue - escalate to Support |
| Only fails via Robot/Orchestrator, not Studio | Executor context issue (service account, permissions) - escalate to Support |
Check 3 — Is Antivirus or EDR Blocking UiPath?
Goal: Rule out security software interference.
- Open your AV/EDR management console and check for quarantined or blocked files in:
C:\Program Files\UiPath\%userprofile%\.nuget\packages\%programdata%\UiPath\
- If a block is found, add the above paths as exclusions in your security tool
- Retest after the policy reloads
If adding exclusions resolves it: The issue is confirmed as AV/EDR interference. Work with your security team to make the exclusions permanent.
If none of the above resolved the issue: Collect the information below and contact UiPath Support.
Escalating to UiPath Support
If self-troubleshooting did not resolve the issue, collect the following before opening a ticket. Submitting everything upfront avoids back-and-forth and gets to resolution faster.
1. UiPath Diagnostic Tool logs from the Robot Machine
Capture the Diagnostic tool logs after reproducing the crash, following this guide: How To Collect The UiPath Diagnostic Tool Logs?
2. Crash Dump / WER Report (if present)
Check these locations - if a crash report was auto-generated, include it:
%localappdata%\CrashDumps\%programdata%\Microsoft\Windows\WER\ReportArchive\
Look for folders named UiPath.Executor.exe.*.wer
3. project.json
- Located in the root of the automation project folder
- Contains exact package versions in use - required for regression analysis
4. Self-Troubleshooting Results
Provide your findings from the three checks above:
- Which package versions were tested and on which machines
- Whether the crash is reproduced in Studio debug mode
- Whether AV/EDR exclusions were tested, and the result
- Name and version of AV/EDR software running on the affected machine