filenameaelupsvc.dll
size62464 (0xf400)
md58b5eefeec1e6d1a72a06c526628ad161
typePE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe8

Rich Header

lib idversiontimes used
1323072919
149307293
10126
1473072933
146307291
1313072914
148307291
145307291

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x4a5bd985
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x2102
Magic0x10b
LinkerVersion9.0
SizeOfCode0xd200
SizeOfInitializedData0x1c00
SizeOfUninitializedData0
AddressOfEntryPoint0x11f9
BaseOfCode0x1000
BaseOfData0xe000
ImageBase0x71000000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion6.1
ImageVersion6.1
SubsystemVersion6.1
Reserved10
SizeOfImage0x12000
SizeOfHeaders0x600
CheckSum0xfdf9
Subsystem3
DllCharacteristics0x140
SizeOfStackReserve0x40000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

namevavsizeraw sizeflags
.text0x10000xd1b10xd200R-X CODE
.data0xf0000x8600xa00RW- IDATA
.rsrc0x100000x7f00x800R-- IDATA
.reloc0x110000x9180xa00R-- IDATA DISCARDABLE

Data Directory

typevasize
EXPORT0x5b4c0x6f
IMPORT0xd3500x12c
RESOURCE0x100000x7f0
EXCEPTION00
SECURITY00
BASERELOC0x110000x918
DEBUG0xe1500x38
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0xb6b80x40
Bound_IAT0x2800x24c
IAT0x10000x1f4
Delay_IAT0xd2380x60
CLR_Header00
typenamesizecp
MUI#12400
WEVT_TEMPLATE#15740
VERSION#19400
module_namehintordfunction_name
msvcrt.dll1007_wcsicmp
msvcrt.dll115__CxxFrameHandler3
msvcrt.dll1013_wcslwr_s
msvcrt.dll20void __cdecl operator delete(void *)

??3@YAXPAX@Z

msvcrt.dll18void * __cdecl operator new(unsigned int)

??2@YAPAXI@Z

msvcrt.dll968_vsnprintf
msvcrt.dll1260memmove
msvcrt.dll1017_wcsnicmp
msvcrt.dll342_errno
msvcrt.dll1258memcpy
msvcrt.dll1129_wtoi
msvcrt.dll345_except_handler4_common
msvcrt.dll1337tolower
msvcrt.dll1259memcpy_s
msvcrt.dll1262memset
API-MS-WIN-Service-Core-L1-1-0.dll1SetServiceStatus
API-MS-WIN-Service-Core-L1-1-0.dllRegisterServiceCtrlHandlerExW
API-MS-Win-Core-Debug-L1-1-0.dll2OutputDebugStringA
API-MS-Win-Core-ErrorHandling-L1-1-0.dll5SetUnhandledExceptionFilter
API-MS-Win-Core-ErrorHandling-L1-1-0.dll1GetLastError
API-MS-Win-Core-ErrorHandling-L1-1-0.dll6UnhandledExceptionFilter
API-MS-Win-Core-File-L1-1-0.dll4CreateFileW
API-MS-Win-Core-File-L1-1-0.dll35GetFileAttributesW
API-MS-Win-Core-File-L1-1-0.dll31GetDriveTypeW
API-MS-Win-Core-File-L1-1-0.dll42GetFinalPathNameByHandleW
API-MS-Win-Core-Handle-L1-1-0.dllCloseHandle
API-MS-Win-Core-Interlocked-L1-1-0.dll7InterlockedIncrement
API-MS-Win-Core-Interlocked-L1-1-0.dll2InterlockedCompareExchange64
API-MS-Win-Core-Interlocked-L1-1-0.dll3InterlockedDecrement
API-MS-Win-Core-Interlocked-L1-1-0.dll1InterlockedCompareExchange
API-MS-Win-Core-ProcessThreads-L1-1-0.dll10GetCurrentProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll11GetCurrentProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll17GetProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll13GetCurrentThreadId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll42TerminateProcess
API-MS-Win-Core-Profile-L1-1-0.dllQueryPerformanceCounter
API-MS-Win-Core-SysInfo-L1-1-0.dll11GetSystemTimeAsFileTime
API-MS-Win-Core-SysInfo-L1-1-0.dll8GetSystemInfo
API-MS-Win-Core-SysInfo-L1-1-0.dll14GetTickCount
API-MS-Win-Core-ThreadPool-L1-1-0.dll3CloseThreadpool
API-MS-Win-Core-ThreadPool-L1-1-0.dll10CreateThreadpool
API-MS-Win-Core-ThreadPool-L1-1-0.dll37UnregisterWaitEx
API-MS-Win-Core-ThreadPool-L1-1-0.dll9CloseThreadpoolWork
API-MS-Win-Core-ThreadPool-L1-1-0.dll35SubmitThreadpoolWork
API-MS-Win-Core-ThreadPool-L1-1-0.dll15CreateThreadpoolWork
API-MS-Win-Core-ThreadPool-L1-1-0.dll31SetThreadpoolThreadMinimum
API-MS-Win-Core-ThreadPool-L1-1-0.dll4CloseThreadpoolCleanupGroup
API-MS-Win-Core-ThreadPool-L1-1-0.dll5CloseThreadpoolCleanupGroupMembers
API-MS-Win-Core-ThreadPool-L1-1-0.dll30SetThreadpoolThreadMaximum
API-MS-Win-Core-ThreadPool-L1-1-0.dll11CreateThreadpoolCleanupGroup
ntdll.dll1447ZwClose
ntdll.dll226NtCreateEvent
ntdll.dll709RtlCreateUserThread
ntdll.dll8AlpcGetMessageAttribute
ntdll.dll183NtAlpcCancelMessage
ntdll.dll799RtlExitUserThread
ntdll.dll196NtAlpcOpenSenderProcess
ntdll.dll760RtlDosPathNameToRelativeNtPathName_U
ntdll.dll1107RtlReleaseRelativeName
ntdll.dll844RtlFreeUnicodeString
ntdll.dll690RtlCreateHeap
ntdll.dll555NtWaitForSingleObject
ntdll.dll11AlpcInitializeMessageAttribute
ntdll.dll182NtAlpcAcceptConnectPort
ntdll.dll185NtAlpcCreatePort
ntdll.dll609RtlAllocateAndInitializeSid
ntdll.dll1006RtlLengthSid
ntdll.dll698RtlCreateSecurityDescriptor
ntdll.dll681RtlCreateAcl
ntdll.dll585RtlAddAccessAllowedAce
ntdll.dll1146RtlSetDaclSecurityDescriptor
ntdll.dll842RtlFreeSid
ntdll.dll346NtOpenKey
ntdll.dll746RtlDestroyHeap
ntdll.dll468NtResumeThread
ntdll.dll493NtSetInformationFile
ntdll.dll395NtQueryInformationFile
ntdll.dll79EtwTraceMessage
ntdll.dll201NtAlpcSendWaitReceivePort
ntdll.dll923RtlInitUnicodeString
ntdll.dll203NtApphelpCacheControl
ntdll.dll12AlpcMaxAllowedMessageLength
ntdll.dll430NtQueryValueKey
ntdll.dll839RtlFreeHeap
ntdll.dll611RtlAllocateHeap
ntdll.dll931RtlInitializeCriticalSectionAndSpinCount
ntdll.dll729RtlDeleteCriticalSection
ntdll.dll487NtSetEvent
ntdll.dll778RtlEnterCriticalSection
ntdll.dll1003RtlLeaveCriticalSection
ntdll.dll212NtClose
KERNEL32.dll205DelayLoadFailureHook
KERNEL32.dll353FreeLibrary
KERNEL32.dll828LoadLibraryExA
KERNEL32.dll1104SetEndOfFile
KERNEL32.dll1123SetFilePointer
KERNEL32.dll1313WriteFile
KERNEL32.dll284ExpandEnvironmentStringsW
KERNEL32.dll714HeapAlloc
KERNEL32.dll839LocalFree
KERNEL32.dll585GetProcessHeap
KERNEL32.dll718HeapFree
KERNEL32.dll100CompareStringW
KERNEL32.dll1198Sleep
KERNEL32.dll1345lstrcmpiW
KERNEL32.dll1234UnmapViewOfFile
KERNEL32.dll854MapViewOfFile
KERNEL32.dll140CreateFileMappingW
KERNEL32.dll495GetFileSize
KERNEL32.dll580GetProcAddress
API-MS-Win-Security-SDDL-L1-1-0.dll2ConvertStringSecurityDescriptorToSecurityDescriptorW
ordentry_vafunction_name
10x5bc0ServiceMain
20x5709SvchostPushServiceGlobals
module_nameAELUPSVC.dll
flags0
timestamp2009-07-13 23:12:27
version0.0
ordinal_base1
nFunctions2
nNames2
Names(2)0x5b7c
Functions(2)0x5b74
NameOrdinals(2)0x5b84

StringTable 040904B0

CompanyNameMicrosoft Corporation
FileDescriptionApplication Experience Service
FileVersion6.1.7600.16385 (win7_rtm.090713-1255)
InternalNameaelupsvc.dll
LegalCopyright© Microsoft Corporation. All rights reserved.
OriginalFilenameaelupsvc.dll
ProductNameMicrosoft® Windows® Operating System
ProductVersion6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion6.1.7600.16385
ProductVersion6.1.7600.16385
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType2
FileSubtype0
offsetsizetypecomment
062464DLL07/14/2009 01:04:05#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] can't find file_offset of VA 0x280