aelupsvc.dll - Application Experience Service

filename	aelupsvc.dll
size	62464 (0xf400)
md5	8b5eefeec1e6d1a72a06c526628ad161

type	PE32 executable (DLL) (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0xe8

Rich Header

lib id	version	times used
132	30729	19
149	30729	3
1	0	126
147	30729	33
146	30729	1
131	30729	14
148	30729	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x4a5bd985
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x2102
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0xd200
SizeOfInitializedData	0x1c00
SizeOfUninitializedData	0
AddressOfEntryPoint	0x11f9
BaseOfCode	0x1000
BaseOfData	0xe000
ImageBase	0x71000000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	6.1
ImageVersion	6.1
SubsystemVersion	6.1
Reserved1	0
SizeOfImage	0x12000
SizeOfHeaders	0x600
CheckSum	0xfdf9
Subsystem	3
DllCharacteristics	0x140
SizeOfStackReserve	0x40000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v7.0 DLL

Sections

name	va	vsize	raw size	flags
.text	0x1000	0xd1b1	0xd200	R-X CODE
.data	0xf000	0x860	0xa00	RW- IDATA
.rsrc	0x10000	0x7f0	0x800	R-- IDATA
.reloc	0x11000	0x918	0xa00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0x5b4c	0x6f
IMPORT	0xd350	0x12c
RESOURCE	0x10000	0x7f0
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0x11000	0x918
DEBUG	0xe150	0x38
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0xb6b8	0x40
Bound_IAT	0x280	0x24c
IAT	0x1000	0x1f4
Delay_IAT	0xd238	0x60
CLR_Header	0	0

show previews

type	name	size
MUI	#1	240
WEVT_TEMPLATE	#1	574
VERSION	#1	940

module_name	hint	function_name
msvcrt.dll	1007	_wcsicmp
msvcrt.dll	115	__CxxFrameHandler3
msvcrt.dll	1013	_wcslwr_s
msvcrt.dll	20	void __cdecl operator delete(void *) ??3@YAXPAX@Z
msvcrt.dll	18	void * __cdecl operator new(unsigned int) ??2@YAPAXI@Z
msvcrt.dll	968	_vsnprintf
msvcrt.dll	1260	memmove
msvcrt.dll	1017	_wcsnicmp
msvcrt.dll	342	_errno
msvcrt.dll	1258	memcpy
msvcrt.dll	1129	_wtoi
msvcrt.dll	345	_except_handler4_common
msvcrt.dll	1337	tolower
msvcrt.dll	1259	memcpy_s
msvcrt.dll	1262	memset
API-MS-WIN-Service-Core-L1-1-0.dll	1	SetServiceStatus
API-MS-WIN-Service-Core-L1-1-0.dll		RegisterServiceCtrlHandlerExW
API-MS-Win-Core-Debug-L1-1-0.dll	2	OutputDebugStringA
API-MS-Win-Core-ErrorHandling-L1-1-0.dll	5	SetUnhandledExceptionFilter
API-MS-Win-Core-ErrorHandling-L1-1-0.dll	1	GetLastError
API-MS-Win-Core-ErrorHandling-L1-1-0.dll	6	UnhandledExceptionFilter
API-MS-Win-Core-File-L1-1-0.dll	4	CreateFileW
API-MS-Win-Core-File-L1-1-0.dll	35	GetFileAttributesW
API-MS-Win-Core-File-L1-1-0.dll	31	GetDriveTypeW
API-MS-Win-Core-File-L1-1-0.dll	42	GetFinalPathNameByHandleW
API-MS-Win-Core-Handle-L1-1-0.dll		CloseHandle
API-MS-Win-Core-Interlocked-L1-1-0.dll	7	InterlockedIncrement
API-MS-Win-Core-Interlocked-L1-1-0.dll	2	InterlockedCompareExchange64
API-MS-Win-Core-Interlocked-L1-1-0.dll	3	InterlockedDecrement
API-MS-Win-Core-Interlocked-L1-1-0.dll	1	InterlockedCompareExchange
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	10	GetCurrentProcess
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	11	GetCurrentProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	17	GetProcessId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	13	GetCurrentThreadId
API-MS-Win-Core-ProcessThreads-L1-1-0.dll	42	TerminateProcess
API-MS-Win-Core-Profile-L1-1-0.dll		QueryPerformanceCounter
API-MS-Win-Core-SysInfo-L1-1-0.dll	11	GetSystemTimeAsFileTime
API-MS-Win-Core-SysInfo-L1-1-0.dll	8	GetSystemInfo
API-MS-Win-Core-SysInfo-L1-1-0.dll	14	GetTickCount
API-MS-Win-Core-ThreadPool-L1-1-0.dll	3	CloseThreadpool
API-MS-Win-Core-ThreadPool-L1-1-0.dll	10	CreateThreadpool
API-MS-Win-Core-ThreadPool-L1-1-0.dll	37	UnregisterWaitEx
API-MS-Win-Core-ThreadPool-L1-1-0.dll	9	CloseThreadpoolWork
API-MS-Win-Core-ThreadPool-L1-1-0.dll	35	SubmitThreadpoolWork
API-MS-Win-Core-ThreadPool-L1-1-0.dll	15	CreateThreadpoolWork
API-MS-Win-Core-ThreadPool-L1-1-0.dll	31	SetThreadpoolThreadMinimum
API-MS-Win-Core-ThreadPool-L1-1-0.dll	4	CloseThreadpoolCleanupGroup
API-MS-Win-Core-ThreadPool-L1-1-0.dll	5	CloseThreadpoolCleanupGroupMembers
API-MS-Win-Core-ThreadPool-L1-1-0.dll	30	SetThreadpoolThreadMaximum
API-MS-Win-Core-ThreadPool-L1-1-0.dll	11	CreateThreadpoolCleanupGroup
ntdll.dll	1447	ZwClose
ntdll.dll	226	NtCreateEvent
ntdll.dll	709	RtlCreateUserThread
ntdll.dll	8	AlpcGetMessageAttribute
ntdll.dll	183	NtAlpcCancelMessage
ntdll.dll	799	RtlExitUserThread
ntdll.dll	196	NtAlpcOpenSenderProcess
ntdll.dll	760	RtlDosPathNameToRelativeNtPathName_U
ntdll.dll	1107	RtlReleaseRelativeName
ntdll.dll	844	RtlFreeUnicodeString
ntdll.dll	690	RtlCreateHeap
ntdll.dll	555	NtWaitForSingleObject
ntdll.dll	11	AlpcInitializeMessageAttribute
ntdll.dll	182	NtAlpcAcceptConnectPort
ntdll.dll	185	NtAlpcCreatePort
ntdll.dll	609	RtlAllocateAndInitializeSid
ntdll.dll	1006	RtlLengthSid
ntdll.dll	698	RtlCreateSecurityDescriptor
ntdll.dll	681	RtlCreateAcl
ntdll.dll	585	RtlAddAccessAllowedAce
ntdll.dll	1146	RtlSetDaclSecurityDescriptor
ntdll.dll	842	RtlFreeSid
ntdll.dll	346	NtOpenKey
ntdll.dll	746	RtlDestroyHeap
ntdll.dll	468	NtResumeThread
ntdll.dll	493	NtSetInformationFile
ntdll.dll	395	NtQueryInformationFile
ntdll.dll	79	EtwTraceMessage
ntdll.dll	201	NtAlpcSendWaitReceivePort
ntdll.dll	923	RtlInitUnicodeString
ntdll.dll	203	NtApphelpCacheControl
ntdll.dll	12	AlpcMaxAllowedMessageLength
ntdll.dll	430	NtQueryValueKey
ntdll.dll	839	RtlFreeHeap
ntdll.dll	611	RtlAllocateHeap
ntdll.dll	931	RtlInitializeCriticalSectionAndSpinCount
ntdll.dll	729	RtlDeleteCriticalSection
ntdll.dll	487	NtSetEvent
ntdll.dll	778	RtlEnterCriticalSection
ntdll.dll	1003	RtlLeaveCriticalSection
ntdll.dll	212	NtClose
KERNEL32.dll	205	DelayLoadFailureHook
KERNEL32.dll	353	FreeLibrary
KERNEL32.dll	828	LoadLibraryExA
KERNEL32.dll	1104	SetEndOfFile
KERNEL32.dll	1123	SetFilePointer
KERNEL32.dll	1313	WriteFile
KERNEL32.dll	284	ExpandEnvironmentStringsW
KERNEL32.dll	714	HeapAlloc
KERNEL32.dll	839	LocalFree
KERNEL32.dll	585	GetProcessHeap
KERNEL32.dll	718	HeapFree
KERNEL32.dll	100	CompareStringW
KERNEL32.dll	1198	Sleep
KERNEL32.dll	1345	lstrcmpiW
KERNEL32.dll	1234	UnmapViewOfFile
KERNEL32.dll	854	MapViewOfFile
KERNEL32.dll	140	CreateFileMappingW
KERNEL32.dll	495	GetFileSize
KERNEL32.dll	580	GetProcAddress
API-MS-Win-Security-SDDL-L1-1-0.dll	2	ConvertStringSecurityDescriptorToSecurityDescriptorW

ord	entry_va	function_name
1	0x5bc0	ServiceMain
2	0x5709	SvchostPushServiceGlobals

module_name	AELUPSVC.dll
flags	0
timestamp	2009-07-13 23:12:27
version	0.0
ordinal_base	1
nFunctions	2
nNames	2
Names(2)	0x5b7c
Functions(2)	0x5b74
NameOrdinals(2)	0x5b84

StringTable 040904B0

CompanyName	Microsoft Corporation
FileDescription	Application Experience Service
FileVersion	6.1.7600.16385 (win7_rtm.090713-1255)
InternalName	aelupsvc.dll
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	aelupsvc.dll
ProductName	Microsoft® Windows® Operating System
ProductVersion	6.1.7600.16385

VS_FIXEDFILEINFO

FileVersion	6.1.7600.16385
ProductVersion	6.1.7600.16385
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0
FileOS	0x40004
FileType	2
FileSubtype	0

show previews

offset	size	type	comment
0	62464	DLL	07/14/2009 01:04:05	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi	Support Me on Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0x280

aelupsvc.dll-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904B0

VS_FIXEDFILEINFO

aelupsvc.dll
-