KnownDlls
For 32-bit DLLs the KnownDLLs registry entry only affects the search for implicitly loaded DLLs.
Some people might consider this a security feature (though an admittedly rather weak one), but in fact security was never the intent of this feature. Known DLLs was really all about performance.
The \KnownDlls sections are computed as the transitive closure of the DLLs listed in KnownDLLs. So if a DLL’s listed in KnownDLLs, all of the DLL’s that are statically linked with the DLL are ALSO listed in the \KnownDlls section.
Windows 95 RTM
| Registry | KERNEL32.DLL, USER32.DLL, GDI32.DLL, WOW32.DLL, WINMM.DLL, WINNT.DLL, RPCRT4.DLL, ADVAPI32.DLL, COMDLG32.DLL, CRTDLL.DLL, SHELL32.DLL, SHSCRAP.DLL, LZ32.DLL, OLECLI32.DLL, OLESVR32.DLL, VERSION.DLL, COMCTL32.DLL, MSNP32.DLL, NWNP32.DLL, MPR.DLL, MPRSERV.DLL, MSSHRUI.DLL, MSNET32.DLL, NWNET32.DLL, MSPWL32.DLL, OLE32.DLL, OLEAUT32.DLL, OLEDLG.DLL, OLETHK32.DLL, NETBIOS.DLL, MSAB32.DLL, NWAB32.DLL, SVRAPI.DLL, CHOOSUSR.DLL, SYNCUI.DLL, LINKINFO.DLL, MSVCRT20.DLL, RICHED32.DLL, WINSPOOL.DRV, MFC30.DLL, MFCUIA32.DLL, MFCANS32.DLL, NTDLL.DLL, RASAPI32.DLL, TAPI32.DLL, UMDM32.DLL |
|---|
Windows 95 OSR2
| Registry | KERNEL32.DLL, USER32.DLL, GDI32.DLL, WOW32.DLL, WINMM.DLL, WINNT.DLL, RPCRT4.DLL, ADVAPI32.DLL, COMDLG32.DLL, CRTDLL.DLL, SHELL32.DLL, SHSCRAP.DLL, LZ32.DLL, OLECLI32.DLL, OLESVR32.DLL, VERSION.DLL, COMCTL32.DLL, MSNP32.DLL, NWNP32.DLL, MPR.DLL, MPRSERV.DLL, MSSHRUI.DLL, MSNET32.DLL, NWNET32.DLL, MSPWL32.DLL, OLE32.DLL, OLEAUT32.DLL, OLEDLG.DLL, OLETHK32.DLL, NETBIOS.DLL, MSAB32.DLL, NWAB32.DLL, SVRAPI.DLL, CHOOSUSR.DLL, SYNCUI.DLL, LINKINFO.DLL, MSVCRT20.DLL, RICHED32.DLL, WINSPOOL.DRV, MFC30.DLL, MFCUIA32.DLL, MFCANS32.DLL, NTDLL.DLL, RASAPI32.DLL, TAPI32.DLL, UMDM32.DLL, SHDOCVW.DLL, SHLWAPI.DLL |
|---|
Windows 98
| Registry | KERNEL32.DLL, USER32.DLL, GDI32.DLL, WOW32.DLL, WINMM.DLL, WINNT.DLL, RPCRT4.DLL, ADVAPI32.DLL, COMDLG32.DLL, CRTDLL.DLL, SHELL32.DLL, SHSCRAP.DLL, LZ32.DLL, OLECLI32.DLL, OLESVR32.DLL, VERSION.DLL, COMCTL32.DLL, MSNP32.DLL, NWNP32.DLL, MPR.DLL, MPRSERV.DLL, MSSHRUI.DLL, MSNET32.DLL, NWNET32.DLL, MSPWL32.DLL, OLE32.DLL, OLEAUT32.DLL, OLEDLG.DLL, OLETHK32.DLL, NETBIOS.DLL, MSAB32.DLL, NWAB32.DLL, SVRAPI.DLL, CHOOSUSR.DLL, SYNCUI.DLL, LINKINFO.DLL, MSVCRT20.DLL, RICHED32.DLL, WINSPOOL.DRV, MFC30.DLL, MFCUIA32.DLL, MFCANS32.DLL, NTDLL.DLL, RASAPI32.DLL, TAPI32.DLL, UMDM32.DLL, SHDOCVW.DLL, SHLWAPI.DLL, WININET.DLL, URLMON.DLL, MSHTML.DLL, NETAPI32.DLL, HLINK.DLL, MSRATING.DLL, MSVCRT40.DLL, MFC40.DLL, URL.DLL, RSABASE.DLL, WINTRUST.DLL, DIGSIG.DLL, VSREVOKE.DLL, MSVCRT.DLL, IMAGEHLP.DLL |
|---|
Windows 98 SE
| Registry | DIGSIG.DLL, KERNEL32.DLL, USER32.DLL, GDI32.DLL, WOW32.DLL, WINMM.DLL, WINNT.DLL, RPCRT4.DLL, ADVAPI32.DLL, COMDLG32.DLL, CRTDLL.DLL, SHELL32.DLL, SHSCRAP.DLL, LZ32.DLL, OLECLI32.DLL, OLESVR32.DLL, VERSION.DLL, COMCTL32.DLL, MSNP32.DLL, NWNP32.DLL, MPR.DLL, MPRSERV.DLL, MSSHRUI.DLL, MSNET32.DLL, NWNET32.DLL, MSPWL32.DLL, OLE32.DLL, OLEAUT32.DLL, OLEDLG.DLL, OLETHK32.DLL, NETBIOS.DLL, MSAB32.DLL, NWAB32.DLL, SVRAPI.DLL, CHOOSUSR.DLL, SYNCUI.DLL, LINKINFO.DLL, MSVCRT20.DLL, RICHED32.DLL, WINSPOOL.DRV, MFC30.DLL, MFCUIA32.DLL, MFCANS32.DLL, NTDLL.DLL, RASAPI32.DLL, TAPI32.DLL, UMDM32.DLL, SHDOCVW.DLL, SHLWAPI.DLL, WININET.DLL, URLMON.DLL, IMAGEHLP.DLL, NETAPI32.DLL, MSRATING.DLL, MSVCRT40.DLL, MFC40.DLL, RSABASE.DLL, WINTRUST.DLL, MSVCRT.DLL |
|---|
Windows ME
| Registry | NT1003.SYS, DIGSIG.DLL, KERNEL32.DLL, USER32.DLL, GDI32.DLL, WOW32.DLL, WINMM.DLL, WINNT.DLL, RPCRT4.DLL, ADVAPI32.DLL, COMDLG32.DLL, CRTDLL.DLL, SHELL32.DLL, SHSCRAP.DLL, LZ32.DLL, OLECLI32.DLL, OLESVR32.DLL, VERSION.DLL, COMCTL32.DLL, MSNP32.DLL, NWNP32.DLL, MPR.DLL, MPRSERV.DLL, MSSHRUI.DLL, MSNET32.DLL, NWNET32.DLL, MSPWL32.DLL, OLE32.DLL, OLEAUT32.DLL, OLEDLG.DLL, OLETHK32.DLL, NETBIOS.DLL, MSAB32.DLL, NWAB32.DLL, SVRAPI.DLL, CHOOSUSR.DLL, SYNCUI.DLL, LINKINFO.DLL, RICHED32.DLL, WINSPOOL.DRV, NTDLL.DLL, RASAPI32.DLL, TAPI32.DLL, UMDM32.DLL, MSVCRT.DLL, MSVCRT20.DLL, MSVCRT40.DLL, MFC30.DLL, MFC40.DLL, MFCANS32.DLL, MFCUIA32.DLL, RSABASE.DLL, WINTRUST.DLL, SHDOCVW.DLL, SHLWAPI.DLL, WININET.DLL, URLMON.DLL, IMAGEHLP.DLL, NETAPI32.DLL, MSRATING.DLL |
|---|
Windows NT4 SP2..SP6
| Registry | kernel32.dll, gdi32.dll, user32.dll, rpcrt4.dll, advapi32.dll, comdlg32.dll, crtdll.dll, shell32.dll, lz32.dll, olecli32.dll, olesvr32.dll, version.dll, ole32.dll, oleaut32.dll, olecnv32.dll, olethk32.dll |
|---|---|
| KnownDlls | gdi32.dll, MPR.dll, ole32.dll, olesvr32.dll, lz32.dll, shell32.dll, user32.dll, version.dll, olecli32.dll, crtdll.dll, COMCTL32.dll, advapi32.dll, oleaut32.dll, olecnv32.dll, wow32.dll, comdlg32.dll, olethk32.dll, MSVCRT.dll, rpcrt4.dll, kernel32.dll |
Windows 2000 SP0 & SP4
| Registry | advapi32.dll, comdlg32.dll, gdi32.dll, imagehlp.dll, kernel32.dll, lz32.dll, ole32.dll, oleaut32.dll, olecli32.dll, olecnv32.dll, olesvr3 2.dll, olethk32.dll, rpcrt4.dll, shell32.dll, url.dll, urlmon.dll, user32.dll, version.dll, wininet.dll, wldap32.dll |
|---|---|
| KnownDlls | url.dll, imagehlp.dll, gdi32.dll, MPR.dll, urlmon.dll, ole32.dll, olesvr32.dll, lz32.dll, wldap32.dll, shell32.dll, user32.dll, version.dll, olecli32.dll, COMCTL32.DLL, advapi32.dll, oleaut32.dll, olecnv32.dll, wow32.dll, SHLWAPI.DLL, comdlg32.dll, wininet.dll, olethk32.dll, SVCRT.DLL, rpcrt4.dll, kernel32.dll |
Windows XP SP0 & SP1
| Registry | advapi32.dll, comdlg32.dll, gdi32.dll, imagehlp.dll, kernel32.dll, lz32.dll, ole32.dll, oleaut32.dll, olecli32.dll, olecnv32.dll, olesvr32.dll, olethk32.dll, rpcrt4.dll, shell32.dll, url.dll, urlmon.dll, user32.dll, version.dll, wininet.dll, wldap32.dll |
|---|---|
| KnownDlls | url.dll, imagehlp.dll, gdi32.dll, appHelp.dll, MPR.dll, urlmon.dll, ole32.dll, lz32.dll, olesvr32.dll, wldap32.dll, shell32.dll, user32.dll, version.dll, olecli32.dll, MSASN1.dll, COMCTL32.dll, CRYPT32.dll, advapi32.dll, oleaut32.dll, olecnv32.dll, wow32.dll, SHLWAPI.dll, USERENV.dll, comdlg32.dll, wininet.dll, olethk32.dll, msvcrt.dll, rpcrt4.dll, kernel32.dll |
Windows XP SP2
| Registry | advapi32.dll, comdlg32.dll, gdi32.dll, imagehlp.dll, kernel32.dll, lz32.dll, ole32.dll, oleaut32.dll, olecli32.dll, olecnv32.dll, olesvr32.dll, olethk32.dll, rpcrt4.dll, shell32.dll, url.dll, urlmon.dll, user32.dll, version.dll, wininet.dll, wldap32.dll |
|---|---|
| KnownDlls | url.dll, imagehlp.dll, gdi32.dll, appHelp.dll, MPR.dll, urlmon.dll, ole32.dll, olesvr32.dll, lz32.dll, wldap32.dll, shell32.dll, user32.dll, version.dll, olecli32.dll, MSASN1.dll, COMCTL32.dll, CRYPT32.dll, advapi32.dll, oleaut32.dll, olecnv32.dll, wow32.dll, SHLWAPI.dll, CRYPTUI.dll, USERENV.dll, comdlg32.dll, wininet.dll, olethk32.dll, WINTRUST.dll, msvcrt.dll, rpcrt4.dll, SHDOCVW.dll, kernel32.dll, NETAPI32.dll |
Windows XP SP3
| Registry | advapi32.dll, comdlg32.dll, gdi32.dll, imagehlp.dll, kernel32.dll, lz32.dll, ole32.dll, oleaut32.dll, olecli32.dll, olecnv32.dll, olesvr32.dll, olethk32.dll, rpcrt4.dll, shell32.dll, url.dll, urlmon.dll, user32.dll, version.dll, wininet.dll, wldap32.dll |
|---|---|
| KnownDlls | url.dll, imagehlp.dll, gdi32.dll, appHelp.dll, Secur32.dll, MPR.dll, urlmon.dll, ole32.dll, olesvr32.dll, lz32.dll, shell32.dll, wldap32.dll, user32.dll, version.dll, olecli32.dll, MSASN1.dll, COMCTL32.dll, CRYPT32.dll, advapi32.dll, oleaut32.dll, olecnv32.dll, wow32.dll, SHLWAPI.dll, CRYPTUI.dll, USERENV.dll, comdlg32.dll, wininet.dll, olethk32.dll, WINTRUST.dll, msvcrt.dll, rpcrt4.dll, SHDOCVW.dll, kernel32.dll, NETAPI32.dll |
Windows Vista SP2
| Registry | clbcatq.dll, ole32.dll, advapi32.dll, COMDLG32.dll, gdi32.dll, IERTUTIL.dll, IMAGEHLP.dll, IMM32.dll, kernel32.dll, LPK.dll, MSCTF.dll, MSVCRT.dll, NORMALIZ.dll, NSI.dll, OLEAUT32.dll, rpcrt4.dll, Setupapi.dll, SHELL32.dll, SHLWAPI.dll, URLMON.dll, user32.dll, USP10.dll, WININET.dll, WLDAP32.dll, WS2_32.dll |
|---|---|
| KnownDlls | IMAGEHLP.dll, gdi32.dll, NORMALIZ.dll, ole32.dll, URLMON.dll, USP10.dll, WLDAP32.dll, SHELL32.dll, user32.dll, COMCTL32.dll, PSAPI.DLL, advapi32.dll, OLEAUT32.dll, SHLWAPI.dll, IERTUTIL.dll, WS2_32.dll, LPK.dll, COMDLG32.dll, Setupapi.dll, MSCTF.dll, WININET.dll, IMM32.dll, MSVCRT.dll, rpcrt4.dll, clbcatq.dll, kernel32.dll, NSI.dll |
Windows 7 SP0
| Registry | clbcatq.dll, ole32.dll, advapi32.dll, COMDLG32.dll, gdi32.dll, IERTUTIL.dll, IMAGEHLP.dll, IMM32.dll, kernel32.dll, LPK.dll, MSCTF.dll, MSVCRT.dll, NORMALIZ.dll, NSI.dll, OLEAUT32.dll, PSAPI.DLL, rpcrt4.dll, sechost.dll, Setupapi.dll, SHELL32.dll, SHLWAPI.dll, URLMON.dll, user32.dll, USP10.dll, WININET.dll, WLDAP32.dll, WS2_32.dll, difxapi.dll |
|---|---|
| KnownDlls | kernelbase.dll, IMAGEHLP.dll, gdi32.dll, NORMALIZ.dll, URLMON.dll, ole32.dll, USP10.dll, DEVOBJ.dll, WLDAP32.dll, SHELL32.dll, CFGMGR32.dll, user32.dll, MSASN1.dll, COMCTL32.dll, PSAPI.DLL, CRYPT32.dll, advapi32.dll, OLEAUT32.dll, ntdll.dll, IERTUTIL.dll, SHLWAPI.dll, WS2_32.dll, LPK.dll, sechost.dll, COMDLG32.dll, difxapi.dll, Setupapi.dll, WININET.dll, MSCTF.dll, WINTRUST.dll, IMM32.dll, MSVCRT.dll, rpcrt4.dll, clbcatq.dll, kernel32.dll, NSI.dll |
Windows 8
| Registry | rpcrt4.dll, combase.dll, gdiplus.dll, IMAGEHLP.dll, MSVCRT.dll, SHLWAPI.dll, COMDLG32.dll, NORMALIZ.dll, PSAPI.DLL, WLDAP32.dll, ole32.dll, IMM32.dll, URLMON.dll, MSCTF.dll, OLEAUT32.dll, LPK.dll, clbcatq.dll, WS2_32.dll, SHELL32.dll, gdi32.dll, difxapi.dll, Setupapi.dll, kernel32.dll, advapi32.dll, user32.dll, IERTUTIL.dll, WININET.dll, NSI.dll, sechost.dll |
|---|---|
| KnownDlls | kernel32.dll, WININET.dll, WS2_32.dll, SHLWAPI.dll, MSCTF.dll, kernelbase.dll, gdiplus.dll, MSASN1.dll, user32.dll, COMCTL32.dll, CFGMGR32.dll, IMM32.dll, combase.dll, rpcrt4.dll, ntdll.dll, COMDLG32.dll, IMAGEHLP.dll, IERTUTIL.dll, SHELL32.dll, URLMON.dll, sechost.dll, WINTRUST.dll, LPK.dll, NORMALIZ.dll, difxapi.dll, profapi.dll, Setupapi.dll, CRYPT32.dll, USERENV.dll, DEVOBJ.dll, gdi32.dll, MSVCRT.dll, advapi32.dll, NSI.dll, PSAPI.DLL, WLDAP32.dll, OLEAUT32.dll, ole32.dll, clbcatq.dll |
Windows 8.1
| Registry | kernel32.dll, advapi32.dll, rpcrt4.dll, sechost.dll, gdiplus.dll, IMAGEHLP.dll, MSVCRT.dll, SHLWAPI.dll, combase.dll, COMDLG32.dll, NORMALIZ.dll, PSAPI.DLL, WLDAP32.dll, ole32.dll, IMM32.dll, SHCORE.dll, MSCTF.dll, OLEAUT32.dll, WS2_32.dll, SHELL32.dll, gdi32.dll, clbcatq.dll, Setupapi.dll, user32.dll, difxapi.dll, NSI.dll |
|---|---|
| KnownDlls | kernelbase.dll, gdi32.dll, IMAGEHLP.dll, NORMALIZ.dll, ole32.dll, combase.dll, CFGMGR32.dll, SHELL32.dll, WLDAP32.dll, gdiplus.dll, user32.dll, MSASN1.dll, COMCTL32.dll, CRYPT32.dll, SHCORE.dll, PSAPI.DLL, advapi32.dll, OLEAUT32.dll, ntdll.dll, SHLWAPI.dll, WS2_32.dll, sechost.dll, COMDLG32.dll, difxapi.dll, Setupapi.dll, MSCTF.dll, WINTRUST.dll, IMM32.dll, MSVCRT.dll, rpcrt4.dll, clbcatq.dll, kernel32.dll, NSI.dll |
Windows 10 (10532)
| Registry | advapi32.dll, clbcatq.dll, combase.dll, COMDLG32.dll, coml2.dll, difxapi.dll, gdi32.dll, gdiplus.dll, IMAGEHLP.dll, IMM32.dll, kernel32.dll, MSCTF.dll, MSVCRT.dll, NORMALIZ.dll, NSI.dll, ole32.dll, OLEAUT32.dll, PSAPI.DLL, rpcrt4.dll, sechost.dll, Setupapi.dll, SHCORE.dll, SHELL32.dll, SHLWAPI.dll, user32.dll, WLDAP32.dll, WS2_32.dll |
|---|---|
| KnownDlls | kernelbase.dll, gdi32.dll, IMAGEHLP.dll, NORMALIZ.dll, ole32.dll, combase.dll, kernel.appcore.dll, cfgmgr32.dll, WLDAP32.dll, gdiplus.dll, SHELL32.dll, coml2.dll, profapi.dll, user32.dll, MSASN1.dll, powrprof.dll, COMCTL32.dll, CRYPT32.dll, SHCORE.dll, PSAPI.DLL, advapi32.dll, OLEAUT32.dll, ntdll.dll, SHLWAPI.dll, WS2_32.dll, sechost.dll, COMDLG32.dll, difxapi.dll, Setupapi.dll, MSCTF.dll, WINTRUST.dll, IMM32.dll, windows.storage.dll, MSVCRT.dll, clbcatq.dll, rpcrt4.dll, kernel32.dll, NSI.dll |
Windows 10 1511 November Update (10586.th2_release.151112-1900)
| Registry | advapi32.dll, clbcatq.dll, combase.dll, COMDLG32.dll, coml2.dll, difxapi.dll, gdi32.dll, gdiplus.dll, IMAGEHLP.dll, IMM32.dll, kernel32.dll, MSCTF.dll, MSVCRT.dll, NORMALIZ.dll, NSI.dll, ole32.dll, OLEAUT32.dll, PSAPI.DLL, rpcrt4.dll, sechost.dll, Setupapi.dll, SHCORE.dll, SHELL32.dll, SHLWAPI.dll, user32.dll, WLDAP32.dll, WS2_32.dll |
|---|---|
| KnownDlls | kernelbase.dll, gdi32.dll, IMAGEHLP.dll, NORMALIZ.dll, ole32.dll, combase.dll, kernel.appcore.dll, CFGMGR32.dll, SHELL32.dll, WLDAP32.dll, gdiplus.dll, coml2.dll, profapi.dll, user32.dll, MSASN1.dll, powrprof.dll, COMCTL32.dll, CRYPT32.dll, SHCORE.dll, PSAPI.DLL, bcryptPrimitives.dll, OLEAUT32.dll, advapi32.dll, ntdll.dll, SHLWAPI.dll, WS2_32.dll, sechost.dll, COMDLG32.dll, difxapi.dll, Setupapi.dll, MSCTF.dll, WINTRUST.dll, IMM32.dll, windows.storage.dll, MSVCRT.dll, FirewallAPI.dll, clbcatq.dll, rpcrt4.dll, kernel32.dll, NSI.dll, NETAPI32.dll |
Windows 10 1803 April 2018 Update (10.0.17134.1)
| Registry | wow64.dll, wow64cpu.dll, wow64win.dll, wowarmhw.dll, advapi32.dll, clbcatq.dll, combase.dll, COMDLG32.dll, coml2.dll, difxapi.dll, gdi32.dll, gdiplus.dll, IMAGEHLP.dll, IMM32.dll, kernel32.dll, MSCTF.dll, MSVCRT.dll, NORMALIZ.dll, NSI.dll, ole32.dll, OLEAUT32.dll, PSAPI.DLL, rpcrt4.dll, sechost.dll, Setupapi.dll, SHCORE.dll, SHELL32.dll, SHLWAPI.dll, user32.dll, WLDAP32.dll, WS2_32.dll |
|---|---|
| KnownDlls | kernelbase.dll, IMAGEHLP.dll, gdi32.dll, NORMALIZ.dll, combase.dll, ole32.dll, kernel.appcore.dll, cfgmgr32.dll, WLDAP32.dll, SHELL32.dll, gdiplus.dll, coml2.dll, FLTLIB.DLL, win32u.dll, profapi.dll, user32.dll, MSASN1.dll, powrprof.dll, gdi32full.dll, COMCTL32.dll, CRYPT32.dll, PSAPI.DLL, SHCORE.dll, bcryptPrimitives.dll, OLEAUT32.dll, advapi32.dll, ntdll.dll, SHLWAPI.dll, msvcp_win.dll, WS2_32.dll, sechost.dll, COMDLG32.dll, difxapi.dll, Setupapi.dll, MSCTF.dll, WINTRUST.dll, IMM32.dll, windows.storage.dll, MSVCRT.dll, clbcatq.dll, rpcrt4.dll, kernel32.dll, NSI.dll, ucrtbase.dll |
WindowsSucks 