{"id":10401,"date":"2026-09-26T23:39:13","date_gmt":"2026-09-26T23:39:13","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=10401"},"modified":"2026-09-26T23:39:13","modified_gmt":"2026-09-26T23:39:13","slug":"1-little-known-secret-of-aidd-dll","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2026\/09\/26\/1-little-known-secret-of-aidd-dll\/","title":{"rendered":"1 little known secret of aidd.dll"},"content":{"rendered":"\n<p>When you run (from admin account):<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">rundll32 aidd.dll, AiddRunTask<\/pre>\n\n\n\n<p>a lot of interesting things are happening. There are at least 2 files of interest being created:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">c:\\Windows\\appcompat\\AIDD\\AIDDProcessLoadedDllListDBdump.txt<br>c:\\Windows\\appcompat\\AIDD\\ProcessLoadedDllList.db<\/pre>\n\n\n\n<p>They include a textual and SQLite-based list of executables running and DLLs loaded.<\/p>\n\n\n\n<p>The text file includes 3 sections:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">@#1 Executable<br>@#2 DLL<br>@#3 ExecutableDLL<\/pre>\n\n\n\n<p>and the SQLite database file includes 3 tables:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">CREATE TABLE Executable (ID INTEGER PRIMARY KEY AUTOINCREMENT,Path TEXT UNIQUE NOT NULL,Publisher TEXT,ProductName TEXT,Version TEXT,ProgramID TEXT,FileID TEXT);\n\nCREATE TABLE DLL (ID INTEGER PRIMARY KEY AUTOINCREMENT,Path TEXT UNIQUE NOT NULL,Publisher TEXT,ProductName TEXT,Version TEXT,FileID TEXT);\n\nCREATE TABLE ExecutableDLL (ID INTEGER PRIMARY KEY AUTOINCREMENT,ExecutableID INTEGER NOT NULL,DllID INTEGER NOT NULL,DetectedAtLaunch INTEGER DEFAULT 0,LoadCount INTEGER DEFAULT 1,LastLoaded DATETIME,Month1_flag INTEGER DEFAULT 0,Month2_flag INTEGER DEFAULT 0,Month3_flag INTEGER DEFAULT 0,Month4_flag INTEGER DEFAULT 0,Month5_flag INTEGER DEFAULT 0,Month6_flag INTEGER DEFAULT 0,Month7_flag INTEGER DEFAULT 0,Month8_flag INTEGER DEFAULT 0,Month9_flag INTEGER DEFAULT 0,Month10_flag INTEGER DEFAULT 0,Month11_flag INTEGER DEFAULT 0,Month12_flag INTEGER DEFAULT 0,Month1_year INTEGER DEFAULT 0,Month2_year INTEGER DEFAULT 0,Month3_year INTEGER DEFAULT 0,Month4_year INTEGER DEFAULT 0,Month5_year INTEGER DEFAULT 0,Month6_year INTEGER DEFAULT 0,Month7_year INTEGER DEFAULT 0,Month8_year INTEGER DEFAULT 0,Month9_year INTEGER DEFAULT 0,Month10_year INTEGER DEFAULT 0,Month11_year INTEGER DEFAULT 0,Month12_year INTEGER DEFAULT 0,FOREIGN KEY (ExecutableID) REFERENCES Executable(ID),FOREIGN KEY (DllID) REFERENCES DLL(ID),UNIQUE(ExecutableID, DllID));<\/pre>\n\n\n\n<p>This is a quick&amp;dirty equivalent of what you can get with Sysinternals&#8217; tool listdlls.exe now available natively on Windows 11 26H2<\/p>\n","protected":false},"excerpt":{"rendered":"<p>When you run (from admin account): rundll32 aidd.dll, AiddRunTask a lot of interesting things are happening. There are at least 2 files of interest being created: c:\\Windows\\appcompat\\AIDD\\AIDDProcessLoadedDllListDBdump.txtc:\\Windows\\appcompat\\AIDD\\ProcessLoadedDllList.db They include a textual and SQLite-based list of executables running and DLLs loaded. &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2026\/09\/26\/1-little-known-secret-of-aidd-dll\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[53,126],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10401"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=10401"}],"version-history":[{"count":1,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10401\/revisions"}],"predecessor-version":[{"id":10402,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/10401\/revisions\/10402"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=10401"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=10401"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=10401"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}