The aidd.dll library in Windows 11 features a task named AiddRunTask that, when executed via rundll32 from an administrative account, performs an automated audit of running processes and their loaded DLLs. This native functionality generates two primary artifacts in the C:\Windows\appcompat\AIDD\ directory: a textual dump and a structured SQLite database.
The resulting data provides a comprehensive mapping of executables to DLLs, including metadata such as file versions, publishers, and load counts over time. This built-in capability serves as a native alternative to the well-known Sysinternals listdlls.exe tool, offering forensic analysts and system administrators a powerful way to track module loading behavior without external dependencies.
Top comments (0)