KnownDlls

For 32-bit DLLs the KnownDLLs registry entry only affects the search for implicitly loaded DLLs.

KB 164501

Some people might consider this a security feature (though an admittedly rather weak one), but in fact security was never the intent of this feature. Known DLLs was really all about performance.

Raymond Chen

The \KnownDlls sections are computed as the transitive closure of the DLLs listed in KnownDLLs. So if a DLL’s listed in KnownDLLs, all of the DLL’s that are statically linked with the DLL are ALSO listed in the \KnownDlls section.

Larry Osterman

Windows 95 RTM

Registry KERNEL32.DLL, USER32.DLL, GDI32.DLL, WOW32.DLL, WINMM.DLL, WINNT.DLL, RPCRT4.DLL, ADVAPI32.DLL, COMDLG32.DLL, CRTDLL.DLL, SHELL32.DLL, SHSCRAP.DLL, LZ32.DLL, OLECLI32.DLL, OLESVR32.DLL, VERSION.DLL, COMCTL32.DLL, MSNP32.DLL, NWNP32.DLL, MPR.DLL, MPRSERV.DLL, MSSHRUI.DLL, MSNET32.DLL, NWNET32.DLL, MSPWL32.DLL, OLE32.DLL, OLEAUT32.DLL, OLEDLG.DLL, OLETHK32.DLL, NETBIOS.DLL, MSAB32.DLL, NWAB32.DLL, SVRAPI.DLL, CHOOSUSR.DLL, SYNCUI.DLL, LINKINFO.DLL, MSVCRT20.DLL, RICHED32.DLL, WINSPOOL.DRV, MFC30.DLL, MFCUIA32.DLL, MFCANS32.DLL, NTDLL.DLL, RASAPI32.DLL, TAPI32.DLL, UMDM32.DLL

Windows 95 OSR2

Registry KERNEL32.DLL, USER32.DLL, GDI32.DLL, WOW32.DLL, WINMM.DLL, WINNT.DLL, RPCRT4.DLL, ADVAPI32.DLL, COMDLG32.DLL, CRTDLL.DLL, SHELL32.DLL, SHSCRAP.DLL, LZ32.DLL, OLECLI32.DLL, OLESVR32.DLL, VERSION.DLL, COMCTL32.DLL, MSNP32.DLL, NWNP32.DLL, MPR.DLL, MPRSERV.DLL, MSSHRUI.DLL, MSNET32.DLL, NWNET32.DLL, MSPWL32.DLL, OLE32.DLL, OLEAUT32.DLL, OLEDLG.DLL, OLETHK32.DLL, NETBIOS.DLL, MSAB32.DLL, NWAB32.DLL, SVRAPI.DLL, CHOOSUSR.DLL, SYNCUI.DLL, LINKINFO.DLL, MSVCRT20.DLL, RICHED32.DLL, WINSPOOL.DRV, MFC30.DLL, MFCUIA32.DLL, MFCANS32.DLL, NTDLL.DLL, RASAPI32.DLL, TAPI32.DLL, UMDM32.DLL, SHDOCVW.DLL, SHLWAPI.DLL

Windows 98

Registry KERNEL32.DLL, USER32.DLL, GDI32.DLL, WOW32.DLL, WINMM.DLL, WINNT.DLL, RPCRT4.DLL, ADVAPI32.DLL, COMDLG32.DLL, CRTDLL.DLL, SHELL32.DLL, SHSCRAP.DLL, LZ32.DLL, OLECLI32.DLL, OLESVR32.DLL, VERSION.DLL, COMCTL32.DLL, MSNP32.DLL, NWNP32.DLL, MPR.DLL, MPRSERV.DLL, MSSHRUI.DLL, MSNET32.DLL, NWNET32.DLL, MSPWL32.DLL, OLE32.DLL, OLEAUT32.DLL, OLEDLG.DLL, OLETHK32.DLL, NETBIOS.DLL, MSAB32.DLL, NWAB32.DLL, SVRAPI.DLL, CHOOSUSR.DLL, SYNCUI.DLL, LINKINFO.DLL, MSVCRT20.DLL, RICHED32.DLL, WINSPOOL.DRV, MFC30.DLL, MFCUIA32.DLL, MFCANS32.DLL, NTDLL.DLL, RASAPI32.DLL, TAPI32.DLL, UMDM32.DLL, SHDOCVW.DLL, SHLWAPI.DLL, WININET.DLL, URLMON.DLL, MSHTML.DLL, NETAPI32.DLL, HLINK.DLL, MSRATING.DLL, MSVCRT40.DLL, MFC40.DLL, URL.DLL, RSABASE.DLL, WINTRUST.DLL, DIGSIG.DLL, VSREVOKE.DLL, MSVCRT.DLL, IMAGEHLP.DLL

Windows 98 SE

Registry DIGSIG.DLL, KERNEL32.DLL, USER32.DLL, GDI32.DLL, WOW32.DLL, WINMM.DLL, WINNT.DLL, RPCRT4.DLL, ADVAPI32.DLL, COMDLG32.DLL, CRTDLL.DLL, SHELL32.DLL, SHSCRAP.DLL, LZ32.DLL, OLECLI32.DLL, OLESVR32.DLL, VERSION.DLL, COMCTL32.DLL, MSNP32.DLL, NWNP32.DLL, MPR.DLL, MPRSERV.DLL, MSSHRUI.DLL, MSNET32.DLL, NWNET32.DLL, MSPWL32.DLL, OLE32.DLL, OLEAUT32.DLL, OLEDLG.DLL, OLETHK32.DLL, NETBIOS.DLL, MSAB32.DLL, NWAB32.DLL, SVRAPI.DLL, CHOOSUSR.DLL, SYNCUI.DLL, LINKINFO.DLL, MSVCRT20.DLL, RICHED32.DLL, WINSPOOL.DRV, MFC30.DLL, MFCUIA32.DLL, MFCANS32.DLL, NTDLL.DLL, RASAPI32.DLL, TAPI32.DLL, UMDM32.DLL, SHDOCVW.DLL, SHLWAPI.DLL, WININET.DLL, URLMON.DLL, IMAGEHLP.DLL, NETAPI32.DLL, MSRATING.DLL, MSVCRT40.DLL, MFC40.DLL, RSABASE.DLL, WINTRUST.DLL, MSVCRT.DLL

Windows ME

Registry NT1003.SYS, DIGSIG.DLL, KERNEL32.DLL, USER32.DLL, GDI32.DLL, WOW32.DLL, WINMM.DLL, WINNT.DLL, RPCRT4.DLL, ADVAPI32.DLL, COMDLG32.DLL, CRTDLL.DLL, SHELL32.DLL, SHSCRAP.DLL, LZ32.DLL, OLECLI32.DLL, OLESVR32.DLL, VERSION.DLL, COMCTL32.DLL, MSNP32.DLL, NWNP32.DLL, MPR.DLL, MPRSERV.DLL, MSSHRUI.DLL, MSNET32.DLL, NWNET32.DLL, MSPWL32.DLL, OLE32.DLL, OLEAUT32.DLL, OLEDLG.DLL, OLETHK32.DLL, NETBIOS.DLL, MSAB32.DLL, NWAB32.DLL, SVRAPI.DLL, CHOOSUSR.DLL, SYNCUI.DLL, LINKINFO.DLL, RICHED32.DLL, WINSPOOL.DRV, NTDLL.DLL, RASAPI32.DLL, TAPI32.DLL, UMDM32.DLL, MSVCRT.DLL, MSVCRT20.DLL, MSVCRT40.DLL, MFC30.DLL, MFC40.DLL, MFCANS32.DLL, MFCUIA32.DLL, RSABASE.DLL, WINTRUST.DLL, SHDOCVW.DLL, SHLWAPI.DLL, WININET.DLL, URLMON.DLL, IMAGEHLP.DLL, NETAPI32.DLL, MSRATING.DLL

Windows NT4 SP2..SP6

Registry kernel32.dll, gdi32.dll, user32.dll, rpcrt4.dll, advapi32.dll, comdlg32.dll, crtdll.dll, shell32.dll, lz32.dll, olecli32.dll, olesvr32.dll, version.dll, ole32.dll, oleaut32.dll, olecnv32.dll, olethk32.dll
KnownDlls gdi32.dll, MPR.dll, ole32.dll, olesvr32.dll, lz32.dll, shell32.dll, user32.dll, version.dll, olecli32.dll, crtdll.dll, COMCTL32.dll, advapi32.dll, oleaut32.dll, olecnv32.dll, wow32.dll, comdlg32.dll, olethk32.dll, MSVCRT.dll, rpcrt4.dll, kernel32.dll

Windows 2000 SP0 & SP4

Registry advapi32.dll, comdlg32.dll, gdi32.dll, imagehlp.dll, kernel32.dll, lz32.dll, ole32.dll, oleaut32.dll, olecli32.dll, olecnv32.dll, olesvr3
2.dll, olethk32.dll, rpcrt4.dll, shell32.dll, url.dll, urlmon.dll, user32.dll, version.dll, wininet.dll, wldap32.dll
KnownDlls url.dll, imagehlp.dll, gdi32.dll, MPR.dll, urlmon.dll, ole32.dll, olesvr32.dll, lz32.dll, wldap32.dll, shell32.dll, user32.dll, version.dll, olecli32.dll, COMCTL32.DLL, advapi32.dll, oleaut32.dll, olecnv32.dll, wow32.dll, SHLWAPI.DLL, comdlg32.dll, wininet.dll, olethk32.dll, SVCRT.DLL, rpcrt4.dll, kernel32.dll

Windows XP RTM & SP1

Registry advapi32.dll, comdlg32.dll, gdi32.dll, imagehlp.dll, kernel32.dll, lz32.dll, ole32.dll, oleaut32.dll, olecli32.dll, olecnv32.dll, olesvr32.dll, olethk32.dll, rpcrt4.dll, shell32.dll, url.dll, urlmon.dll, user32.dll, version.dll, wininet.dll, wldap32.dll
KnownDlls url.dll, imagehlp.dll, gdi32.dll, appHelp.dll, MPR.dll, urlmon.dll, ole32.dll, lz32.dll, olesvr32.dll, wldap32.dll, shell32.dll, user32.dll, version.dll, olecli32.dll, MSASN1.dll, COMCTL32.dll, CRYPT32.dll, advapi32.dll, oleaut32.dll, olecnv32.dll, wow32.dll, SHLWAPI.dll, USERENV.dll, comdlg32.dll, wininet.dll, olethk32.dll, msvcrt.dll, rpcrt4.dll, kernel32.dll

Windows XP SP2

Registry advapi32.dll, comdlg32.dll, gdi32.dll, imagehlp.dll, kernel32.dll, lz32.dll, ole32.dll, oleaut32.dll, olecli32.dll, olecnv32.dll, olesvr32.dll, olethk32.dll, rpcrt4.dll, shell32.dll, url.dll, urlmon.dll, user32.dll, version.dll, wininet.dll, wldap32.dll
KnownDlls url.dll, imagehlp.dll, gdi32.dll, appHelp.dll, MPR.dll, urlmon.dll, ole32.dll, olesvr32.dll, lz32.dll, wldap32.dll, shell32.dll, user32.dll, version.dll, olecli32.dll, MSASN1.dll, COMCTL32.dll, CRYPT32.dll, advapi32.dll, oleaut32.dll, olecnv32.dll, wow32.dll, SHLWAPI.dll, CRYPTUI.dll, USERENV.dll, comdlg32.dll, wininet.dll, olethk32.dll, WINTRUST.dll, msvcrt.dll, rpcrt4.dll, SHDOCVW.dll, kernel32.dll, NETAPI32.dll

Windows XP SP3

Registry advapi32.dll, comdlg32.dll, gdi32.dll, imagehlp.dll, kernel32.dll, lz32.dll, ole32.dll, oleaut32.dll, olecli32.dll, olecnv32.dll, olesvr32.dll, olethk32.dll, rpcrt4.dll, shell32.dll, url.dll, urlmon.dll, user32.dll, version.dll, wininet.dll, wldap32.dll
KnownDlls url.dll, imagehlp.dll, gdi32.dll, appHelp.dll, Secur32.dll, MPR.dll, urlmon.dll, ole32.dll, olesvr32.dll, lz32.dll, shell32.dll, wldap32.dll, user32.dll, version.dll, olecli32.dll, MSASN1.dll, COMCTL32.dll, CRYPT32.dll, advapi32.dll, oleaut32.dll, olecnv32.dll, wow32.dll, SHLWAPI.dll, CRYPTUI.dll, USERENV.dll, comdlg32.dll, wininet.dll, olethk32.dll, WINTRUST.dll, msvcrt.dll, rpcrt4.dll, SHDOCVW.dll, kernel32.dll, NETAPI32.dll

Windows Vista SP2

Registry clbcatq.dll, ole32.dll, advapi32.dll, COMDLG32.dll, gdi32.dll, IERTUTIL.dll, IMAGEHLP.dll, IMM32.dll, kernel32.dll, LPK.dll, MSCTF.dll, MSVCRT.dll, NORMALIZ.dll, NSI.dll, OLEAUT32.dll, rpcrt4.dll, Setupapi.dll, SHELL32.dll, SHLWAPI.dll, URLMON.dll, user32.dll, USP10.dll, WININET.dll, WLDAP32.dll, WS2_32.dll
KnownDlls IMAGEHLP.dll, gdi32.dll, NORMALIZ.dll, ole32.dll, URLMON.dll, USP10.dll, WLDAP32.dll, SHELL32.dll, user32.dll, COMCTL32.dll, PSAPI.DLL, advapi32.dll, OLEAUT32.dll, SHLWAPI.dll, IERTUTIL.dll, WS2_32.dll, LPK.dll, COMDLG32.dll, Setupapi.dll, MSCTF.dll, WININET.dll, IMM32.dll, MSVCRT.dll, rpcrt4.dll, clbcatq.dll, kernel32.dll, NSI.dll

Windows 8

Registry rpcrt4.dll, combase.dll, gdiplus.dll, IMAGEHLP.dll, MSVCRT.dll, SHLWAPI.dll, COMDLG32.dll, NORMALIZ.dll, PSAPI.DLL, WLDAP32.dll, ole32.dll, IMM32.dll, URLMON.dll, MSCTF.dll, OLEAUT32.dll, LPK.dll, clbcatq.dll, WS2_32.dll, SHELL32.dll, gdi32.dll, difxapi.dll, Setupapi.dll, kernel32.dll, advapi32.dll, user32.dll, IERTUTIL.dll, WININET.dll, NSI.dll, sechost.dll
KnownDlls kernel32.dll, WININET.dll, WS2_32.dll, SHLWAPI.dll, MSCTF.dll, kernelbase.dll, gdiplus.dll, MSASN1.dll, user32.dll, COMCTL32.dll, CFGMGR32.dll, IMM32.dll, combase.dll, rpcrt4.dll, ntdll.dll, COMDLG32.dll, IMAGEHLP.dll, IERTUTIL.dll, SHELL32.dll, URLMON.dll, sechost.dll, WINTRUST.dll, LPK.dll, NORMALIZ.dll, difxapi.dll, profapi.dll, Setupapi.dll, CRYPT32.dll, USERENV.dll, DEVOBJ.dll, gdi32.dll, MSVCRT.dll, advapi32.dll, NSI.dll, PSAPI.DLL, WLDAP32.dll, OLEAUT32.dll, ole32.dll, clbcatq.dll

Windows 8.1

Registry kernel32.dll, advapi32.dll, rpcrt4.dll, sechost.dll, gdiplus.dll, IMAGEHLP.dll, MSVCRT.dll, SHLWAPI.dll, combase.dll, COMDLG32.dll, NORMALIZ.dll, PSAPI.DLL, WLDAP32.dll, ole32.dll, IMM32.dll, SHCORE.dll, MSCTF.dll, OLEAUT32.dll, WS2_32.dll, SHELL32.dll, gdi32.dll, clbcatq.dll, Setupapi.dll, user32.dll, difxapi.dll, NSI.dll
KnownDlls kernelbase.dll, gdi32.dll, IMAGEHLP.dll, NORMALIZ.dll, ole32.dll, combase.dll, CFGMGR32.dll, SHELL32.dll, WLDAP32.dll, gdiplus.dll, user32.dll, MSASN1.dll, COMCTL32.dll, CRYPT32.dll, SHCORE.dll, PSAPI.DLL, advapi32.dll, OLEAUT32.dll, ntdll.dll, SHLWAPI.dll, WS2_32.dll, sechost.dll, COMDLG32.dll, difxapi.dll, Setupapi.dll, MSCTF.dll, WINTRUST.dll, IMM32.dll, MSVCRT.dll, rpcrt4.dll, clbcatq.dll, kernel32.dll, NSI.dll

Windows 10 (10532)

Registry advapi32.dll, clbcatq.dll, combase.dll, COMDLG32.dll, coml2.dll, difxapi.dll, gdi32.dll, gdiplus.dll, IMAGEHLP.dll, IMM32.dll, kernel32.dll, MSCTF.dll, MSVCRT.dll, NORMALIZ.dll, NSI.dll, ole32.dll, OLEAUT32.dll, PSAPI.DLL, rpcrt4.dll, sechost.dll, Setupapi.dll, SHCORE.dll, SHELL32.dll, SHLWAPI.dll, user32.dll, WLDAP32.dll, WS2_32.dll
KnownDlls kernelbase.dll, gdi32.dll, IMAGEHLP.dll, NORMALIZ.dll, ole32.dll, combase.dll, kernel.appcore.dll, cfgmgr32.dll, WLDAP32.dll, gdiplus.dll, SHELL32.dll, coml2.dll, profapi.dll, user32.dll, MSASN1.dll, powrprof.dll, COMCTL32.dll, CRYPT32.dll, SHCORE.dll, PSAPI.DLL, advapi32.dll, OLEAUT32.dll, ntdll.dll, SHLWAPI.dll, WS2_32.dll, sechost.dll, COMDLG32.dll, difxapi.dll, Setupapi.dll, MSCTF.dll, WINTRUST.dll, IMM32.dll, windows.storage.dll, MSVCRT.dll, clbcatq.dll, rpcrt4.dll, kernel32.dll, NSI.dll

Windows 10 1511 (10586.th2_release.151112-1900)

Registry advapi32.dll, clbcatq.dll, combase.dll, COMDLG32.dll, coml2.dll, difxapi.dll, gdi32.dll, gdiplus.dll, IMAGEHLP.dll, IMM32.dll, kernel32.dll, MSCTF.dll, MSVCRT.dll, NORMALIZ.dll, NSI.dll, ole32.dll, OLEAUT32.dll, PSAPI.DLL, rpcrt4.dll, sechost.dll, Setupapi.dll, SHCORE.dll, SHELL32.dll, SHLWAPI.dll, user32.dll, WLDAP32.dll, WS2_32.dll
KnownDlls kernelbase.dll, gdi32.dll, IMAGEHLP.dll, NORMALIZ.dll, ole32.dll, combase.dll, kernel.appcore.dll, CFGMGR32.dll, SHELL32.dll, WLDAP32.dll, gdiplus.dll, coml2.dll, profapi.dll, user32.dll, MSASN1.dll, powrprof.dll, COMCTL32.dll, CRYPT32.dll, SHCORE.dll, PSAPI.DLL, bcryptPrimitives.dll, OLEAUT32.dll, advapi32.dll, ntdll.dll, SHLWAPI.dll, WS2_32.dll, sechost.dll, COMDLG32.dll, difxapi.dll, Setupapi.dll, MSCTF.dll, WINTRUST.dll, IMM32.dll, windows.storage.dll, MSVCRT.dll, FirewallAPI.dll, clbcatq.dll, rpcrt4.dll, kernel32.dll, NSI.dll, NETAPI32.dll
Advertisements