Autoruns: KnownDlls wow64cpu, wowarmhw, xtajit, wow64, wow64win Missing

The Sysinternals Autoruns utility may highlight some entries in yellow, indicating to the user that some files (referenced in the KnownDLL registry key) are missing from the system. The file names are below:

  • C:\Windows\Syswow64\wow64cpu.dll (_wow64cpu)
  • C:\Windows\System32\wowarmhw.dll (_wowarmhw)
  • C:\Windows\Syswow64\wowarmhw.dll (_wowarmhw)
  • C:\Windows\System32\xtajit.dll (_xtajit)
  • C:\Windows\Syswow64\xtajit.dll (_xtajit)
  • C:\WINDOWS\Syswow64\wow64.dll (wow64)
  • C:\WINDOWS\Syswow64\wow64win.dll (wow64win)

autoruns knowndlls missing

(The warning appears regardless of the version/bitness of Autoruns you’re running — Autoruns.exe or Autoruns64.exe)

The known DLLs on the computer are populated in the following registry key in Windows:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs

The files referenced under the KnownDLLs key can be loaded only from the C:\Windows\System32 or C:\Windows\Syswow64 folders. In other words, the KnownDLLs registry key prevents DLLs from being loaded from the applications folder. It’s a security measure that prevents bogus/rogue copies of core system DLLs from being loaded from an applications folder.

Autoruns: KnownDlls wow64cpu, wowarmhw, wow64, xtajit, wow64win Missing

Why does Autoruns show that some KnownDLLs are missing? Are these files supposed to be present?

The yellow-highlighted entries in Autoruns’s “KnownDLLs” tab (as shown in the above image) are WOW64 emulator modules. The WOW64 emulator consists of the following DLLs:

  1. Wow64.dll
  2. Wow64Win.dll
  3. Wow64Cpu.dll (x64 only)
  4. IA32Exec.bin (Intel Itanium only)
  5. Wowia32x.dll (Intel Itanium only)
  6. xtajit.dll (ARM64 only)
  7. wowarmw.dll (ARM64 only)

As you see, some files are meant to be on 64-bit systems only, and others are supposed to be available only on ARM64 systems.

The Windows-On-Windows-64 (WOW64) support DLLs are present only in the System32 directory and Autoruns will report “file not found” for the corresponding SysWOW64 directory entries. This is normal.

The KnownDLLs registry location doesn’t mention the directory path for the DLLs ( i.e., C:\Windows\System32 or C:\Windows\SysWOW64), as you can see from the screenshot below:

autoruns knowndlls missing

For each entry/file listed under the above registry key, Autoruns simply looks if the files are in System32 and SysWOW64 folders. Some DLLs are missing from the System32 path because they are only 32-bit files (and so are in the SysWOW64 folder), while others are 64-bit and are in the System32 folder. Some files are missing on 32-bit and 64-bit computers because they are supposed to be only on ARM64-based systems.

Whereas Windows ships with both 32-bit and 64-bit versions of a file (such as advapi32.dll). However, it’s not necessary that there should be a 32-bit version equivalent for every 64-bit module, or vice versa. You don’t need to run DISM or SFC for this.

Therefore, you can safely ignore the Autoruns “File not found” warning (yellow highlighting of the WOW emulator files) in the KnownDLLs tab.

One small request: If you liked this post, please share this?

One "tiny" share from you would seriously help a lot with the growth of this blog. Some great suggestions:
  • Pin it!
  • Share it to your favorite blog + Facebook, Reddit
  • Tweet it!
So thank you so much for your support. It won't take more than 10 seconds of your time. The share buttons are right below. :)

Ramesh Srinivasan is passionate about Microsoft technologies and he has been a consecutive ten-time recipient of the Microsoft Most Valuable Professional award in the Windows Shell/Desktop Experience category, from 2003 to 2012. He loves to troubleshoot and write about Windows. Ramesh founded in 2005.

Leave a Reply