Scenario: You have a new Snapdragon X Elite laptop. Malware hides a persistence entry via a custom ARM64 shell extension.
Recommendation: Use autoruns64a exclusively on ARM64 hosts.
Use autoruns64.exe. The ARM64 build does not run on x64 Windows – you’ll get an “invalid Win32 application” error.
One of Autoruns' most powerful features is its "Hide Windows Entries" and "Include Empty Locations" options. It also has a specific behavior: when you run a 32-bit autoruns.exe on a 64-bit OS, it will warn you and ask if you want to launch the 64-bit version instead.
Microsoft has implemented a clever autoruns.exe launcher stub in recent versions (post v14.0). The 32-bit executable detects the OS architecture and can spawn the appropriate 64-bit child process. However, this stub only works for x86 → x64, not for x64 → ARM64.
Thus, if you are on ARM64 and double-click autoruns.exe (32-bit), it will still launch the emulated autoruns64.exe, not autoruns64a.exe. You must manually choose autoruns64a.exe.
Microsoft has aggressively pushed Windows on ARM. Devices like the Surface Pro X, Lenovo ThinkPad X13s, and the new Surface Laptop Studio 2 (ARM variant) run Windows 11 ARM64. These devices can run x86 and x64 applications through emulation (Prism), but native ARM64 applications run faster, use less battery, and have full access to the underlying hardware without emulation overhead.
autoruns64.exe is compiled for the AMD64 instruction set (standard Intel/AMD 64-bit CPUs). Run this on an ARM64 Windows device, and it will work—albeit under emulation (which can be slow, memory-intensive, and potentially miss some low-level ARM-specific startup artifacts).
autoruns64a.exe is compiled natively for ARM64 architecture. It runs without emulation, is faster, and is more reliable for deep system introspection on ARM-based Windows PCs.
| Feature | Autoruns 64 (x64) | Autoruns 64a (ARM64) | |---------|------------------|----------------------| | Target architecture | AMD64 / Intel 64 | ARM64 (e.g., Snapdragon) | | Runs on x64 Windows | ✅ Native, best performance | ❌ Won’t start (invalid image) | | Runs on ARM64 Windows | ✅ Via emulation (Prism) | ✅ Native, no emulation | | Registry/WOW64 access | Full native x64 registry view | Full native ARM64 registry view | | Driver scanning | Sees x64 kernel drivers | Sees ARM64 kernel drivers | | Memory footprint | ~3–4 MB | ~2.5–3 MB | | Startup speed (ARM64 host) | ~1.2 seconds (emulated) | ~0.6 seconds (native) | autoruns 64 vs autoruns 64a
The existence of both autoruns64.exe and autoruns64a.exe is not redundancy—it is Microsoft’s commitment to supporting a heterogeneous computing future. As Windows on ARM gains market share (especially with the Snapdragon X Elite series challenging Intel’s dominance), understanding this distinction becomes crucial.
Remember the rule:
Ignore the letter “a” at your own peril. On ARM64, using the emulated version might work, but it is like driving a race car with the parking brake on. For speed, accuracy, and forensic integrity, match the binary architecture to the CPU architecture.
Now, go forth and autorun—with confidence and clarity.
This article is current as of Autoruns version 14.11. Always consult the official Sysinternals documentation for updates as ARM64 Windows continues to evolve.
The primary difference between autoruns64.exe autoruns64a.exe processor architecture
they are designed to run on. Both are 64-bit versions of the Sysinternals Autoruns utility, but they target different hardware platforms. Microsoft Learn Core Technical Differences autoruns64.exe (x64) : This version is built for x86-64 (AMD64/Intel 64)
processors. It is the standard executable for the vast majority of modern 64-bit Windows laptops and desktops using Intel Core or AMD Ryzen chips. autoruns64a.exe (ARM64) : The "a" suffix stands for . This version is compiled specifically for
processors, such as the Qualcomm Snapdragon chips found in "Always Connected" PCs (e.g., Surface Pro 9 with 5G or Samsung Galaxy Book). Microsoft Learn Functionality Comparison Scenario: You have a new Snapdragon X Elite laptop
Aside from their underlying architecture, the two files offer identical features for managing startup locations: autoruns64.exe autoruns64a.exe Full Graphical User Interface (GUI) Full Graphical User Interface (GUI) 64-bit Windows (x64) 64-bit Windows (ARM64) Scans registry, services, and tasks Scans registry, services, and tasks Supports VirusTotal hash checks Supports VirusTotal hash checks Which One Should You Use?
For a standard Windows installation on an Intel or AMD processor, you should use autoruns64.exe
. If you try to run the wrong version, Windows will typically display an error stating that the file is "not a valid Win32 application". Microsoft Learn
If you prefer using the command line instead of the visual interface, look for the counterparts autorunsc64.exe autorunsc64a.exe (ARM64), where the "c" indicates the command-line version. Microsoft Learn suspicious startup items? Which autoruns executable to use? - Microsoft Q&A
Paul Jackson 26. Feb 12, 2021, 3:23 AM. Hello, The Sysinternals Autoruns utility includes multiple executable files: autoruns.exe, Microsoft Learn Which autoruns executable to use? - Microsoft Q&A
Paul Jackson 26. Feb 12, 2021, 3:23 AM. Hello, The Sysinternals Autoruns utility includes multiple executable files: autoruns.exe, Microsoft Learn Which autoruns executable to use? - Microsoft Q&A
Paul Jackson 26. Feb 12, 2021, 3:23 AM. Hello, The Sysinternals Autoruns utility includes multiple executable files: autoruns.exe, Microsoft Learn Sysinternals Utilities - Microsoft Learn
When you download the Sysinternals Autoruns utility from Microsoft, the ZIP file contains several executables with similar names. The primary difference between Autoruns 64 and Autoruns 64a is the hardware architecture they are designed to support:
Autoruns64.exe: This is the standard 64-bit version built for x64 (Intel or AMD) processors. It is the correct version for the vast majority of modern Windows desktop and laptop computers. Microsoft has aggressively pushed Windows on ARM
Autoruns64a.exe: The "a" stands for ARM. This version is specifically compiled for 64-bit ARM processors, such as those found in the Surface Pro 11, Surface Pro X, or other "Windows on ARM" devices. Quick Comparison Table Executable Architecture Autoruns.exe x86 (32-bit) Older 32-bit Windows systems or legacy compatibility. Autoruns64.exe x64 (64-bit) Standard Intel or AMD 64-bit Windows PCs. Autoruns64a.exe Modern Windows laptops with ARM-based processors. Autorunsc64.exe x64 (Command-line)
Command-line automation and scripting on standard 64-bit PCs. Autorunsc64a.exe ARM64 (Command-line) Command-line automation on ARM-based devices. Why Multiple Versions Exist
The Sysinternals suite provides different binaries to ensure the tool can run natively on the specific CPU architecture of your device. While a 64-bit ARM device can often emulate x64 software (like autoruns64.exe), running the native 64a version ensures better performance and more accurate scanning of system locations that might be architecture-specific, such as certain registry keys or driver paths. Which One Should You Run?
For most users, Autoruns64.exe is the correct choice. If you attempt to run autoruns64a.exe on a standard Intel or AMD computer, you will likely encounter an error stating that it is "not a valid Win32 application". Conversely, if you are using a newer "Copilot+ PC" or an ARM-based tablet, you should choose the 64a variant for the best experience. Key Features of Autoruns
Regardless of which version you choose, the functionality remains the same: Which autoruns executable to use? - Microsoft Q&A
Paul Jackson 26. Feb 12, 2021, 3:23 AM. Hello, The Sysinternals Autoruns utility includes multiple executable files: autoruns.exe, Microsoft Learn Autoruns - Sysinternals - Microsoft Learn
If you run the wrong version:
Recommendation: Download the full Autoruns Suite from Microsoft, then just launch the correct file for your hardware. All versions have identical features.
Here’s a technical review comparing Autoruns 64 (standard x64 build) vs Autoruns 64a (ARM64 build), intended for system administrators, forensic analysts, and power users on Windows.