Autoruns: KnownDlls wow64cpu, wowarmhw, xtajit, wow64, wow64win Missing

The Sysinternals Autoruns utility may highlight some entries in yellow, indicating to the user that some files (referenced in the KnownDLL registry key) are missing from the system. The file names are below:

• C:\Windows\Syswow64\wow64cpu.dll (_wow64cpu)
• C:\Windows\System32\wowarmhw.dll (_wowarmhw)
• C:\Windows\Syswow64\wowarmhw.dll (_wowarmhw)
• C:\Windows\System32\xtajit.dll (_xtajit)
• C:\Windows\Syswow64\xtajit.dll (_xtajit)
• C:\WINDOWS\Syswow64\wow64.dll (wow64)
• C:\WINDOWS\Syswow64\wow64win.dll (wow64win)

(The warning appears regardless of the version/bitness of Autoruns you’re running — Autoruns.exe or Autoruns64.exe)

The known DLLs on the computer are populated in the following registry key in Windows:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs

The files referenced under the KnownDLLs key can be loaded only from the C:\Windows\System32 or C:\Windows\Syswow64 folders. In other words, the KnownDLLs registry key prevents DLLs from being loaded from the applications folder. It’s a security measure that prevents bogus/rogue copies of core system DLLs from being loaded from an applications folder.

Autoruns: KnownDlls wow64cpu, wowarmhw, wow64, xtajit, wow64win Missing

Why does Autoruns show that some KnownDLLs are missing? Are these files supposed to be present?

The yellow-highlighted entries in Autoruns’s “KnownDLLs” tab (as shown in the above image) are WOW64 emulator modules. The WOW64 emulator consists of the following DLLs:

1. Wow64.dll
2. Wow64Win.dll
3. Wow64Cpu.dll (x64 only)
4. IA32Exec.bin (Intel Itanium only)
5. Wowia32x.dll (Intel Itanium only)
6. xtajit.dll (ARM64 only)
7. wowarmw.dll (ARM64 only)

As you see, some files are meant to be on 64-bit systems only, and others are supposed to be available only on ARM64 systems.

The Windows-On-Windows-64 (WOW64) support DLLs are present only in the System32 directory and Autoruns will report “file not found” for the corresponding SysWOW64 directory entries. This is normal.

The KnownDLLs registry location doesn’t mention the directory path for the DLLs ( i.e., C:\Windows\System32 or C:\Windows\SysWOW64), as you can see from the screenshot below:

For each entry/file listed under the above registry key, Autoruns simply looks if the files are in System32 and SysWOW64 folders. Some DLLs are missing from the System32 path because they are only 32-bit files (and so are in the SysWOW64 folder), while others are 64-bit and are in the System32 folder. Some files are missing on 32-bit and 64-bit computers because they are supposed to be only on ARM64-based systems.

Whereas Windows ships with both 32-bit and 64-bit versions of a file (such as advapi32.dll). However, it’s not necessary that there should be a 32-bit version equivalent for every 64-bit module, or vice versa. You don’t need to run DISM or SFC for this.

Therefore, you can safely ignore the Autoruns “File not found” warning (yellow highlighting of the WOW emulator files) in the KnownDLLs tab.