Certain operating system–supplied DLLs get special treatment. These are called known DLLs. They are just like any other DLL except that the operating system always looks for them in the same directory in order to load them. Inside the registry is the following key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ Session Manager\KnownDLLs
Here’s what this subkey looks like on my machine using the RegEdit.exe utility.
As you can see, this key contains a set of value names that are the names of certain DLLs. Each of these value names has value data that happens to be identical to the value name with a .dll file extension. (This does not ...