Autoruns 64 Vs Autoruns 64a Access
Paul Jackson 26. Feb 12, 2021, 3:23 AM. Hello, The Sysinternals Autoruns utility includes multiple executable files: autoruns.exe, Microsoft Learn Sysinternals Utilities - Microsoft Learn
Choosing the wrong one can mean missed entries, particularly on modern hardware. This article explains the technical differences between autoruns64 and autoruns64a , their use cases, and how to select the right one for your system. What is Autoruns64.exe?
If you attempt to load autoruns64a.exe on a traditional Intel or AMD platform, the execution will crash instantly. Your operating system will display a crash prompt stating that the file is not a valid Win32 application because the CPU physically cannot process ARM instruction code natively.
: Command-line version of autoruns64a.exe (ARM). autoruns 64 vs autoruns 64a
Autoruns 64a, on the other hand, is an alternate version of Autoruns 64. The "a" in 64a stands for "alternate." This version is also designed for 64-bit Windows systems but uses a different approach to gather information about startup entries. Autoruns 64a uses the Windows API, but it also employs additional techniques to gather more comprehensive information about startup entries, including:
The existence of multiple executables is not due to redundancy but rather a matter of processor architecture support. Windows runs on different types of processors, and an executable compiled for one type generally cannot run natively on another. The main architectures are:
Although the 32-bit version ( autoruns.exe ) can run on 64-bit Windows, it operates under the WOW64 (Windows-32-on-Windows-64) emulation layer. While functional, the 64-bit version offers a more complete view of the system. Paul Jackson 26
At first glance, they appear redundant. Both are 64-bit executables. Both bear the same icon. Both perform the same core function. But beneath the surface lies a critical distinction related to Windows on Windows (WoW64), file system redirection, and processor architectures.
: The 64-bit (x64) graphical interface version optimized for standard Intel and AMD systems.
Autoruns doesn't just read basic startup folders; it deep-dives into your computer's drivers, active codecs, and boot-execute images. These items operate directly alongside the Windows kernel. A native application ( autoruns64.exe on x64, or autoruns64a.exe on ARM64) ensures that the security descriptors and driver signatures it analyzes match the native architecture of the kernel environment. What Happens if You Run the Wrong Version? Your operating system will display a crash prompt
| System | Architecture | Test | Result | | :--- | :--- | :--- | :--- | | Dell XPS 13 (Intel i7) | x64 | autoruns64a.exe | Fails to launch (invalid architecture) | | Dell XPS 13 (Intel i7) | x64 | autoruns64.exe | Works perfectly. Detected 342 startup entries in 8 seconds. | | Surface Pro X (SQ2) | ARM64 | autoruns64.exe | Works via emulation. 323 entries in 22 seconds. (High CPU usage) | | Surface Pro X (SQ2) | ARM64 | autoruns64a.exe | Works natively. 323 entries in 4 seconds. (Low CPU usage) | | MacBook Pro M3 (Parallels Win11) | ARM64 VM | autoruns64a.exe | Works natively. Detected ARM64 hypervisor drivers correctly. |
Windows uses specific registry redirection layers (like Wow6432Node ) depending on the bit-depth and architecture of the application querying it. Running an incorrect binary can cause Autoruns to view a redirected sandbox environment rather than the actual live boot paths of the machine. 2. Native Driver Loading