Should I block it?

No, this file is 100% safe to run.

Additional versions

6.3.9600.16384 (winblue_rtm.130821-1623)	0.62%
6.3.9600.16384 (winblue_rtm.130821-1623)	0.21%
6.3.9431.0 (winmain_bluemp.130615-1214)	0.21%
6.2.9200.16384 (win8_rtm.120725-1247)	0.41%
6.2.9200.16384 (win8_rtm.120725-1247)	2.27%
6.2.9200.16384 (win8_rtm.120725-1247)	0.41%
6.2.9200.16384 (win8_rtm.120725-1247)	0.82%
6.2.8102.0 (winmain_win8m3.110823-1455)	0.21%
6.1.7600.16385 (win7_rtm.090713-1255)	38.14%
6.1.7600.16385 (win7_rtm.090713-1255)	25.77%
6.1.7600.16385 (win7_rtm.090713-1255)	0.21%
6.0.6000.16386 (vista_rtm.061101-2205)	3.30%
6.0.6000.16386 (vista_rtm.061101-2205)	27.42%

PE file structure

Show functions

Import table

advapi32.dll

SetServiceStatus, DeregisterEventSource, ReportEventW, RegisterEventSourceW, RegisterServiceCtrlHandlerExW

api-ms-win-core-debug-l1-1-0.dll

OutputDebugStringA

api-ms-win-core-delayload-l1-1-1.dll

ResolveDelayLoadedAPI, DelayLoadFailureHook

api-ms-win-core-errorhandling-l1-1-0.dll

SetUnhandledExceptionFilter, GetLastError, UnhandledExceptionFilter

api-ms-win-core-errorhandling-l1-1-1.dll

GetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter

api-ms-win-core-file-l1-1-0.dll

CreateFileW, GetFileAttributesW, GetDriveTypeW, GetFinalPathNameByHandleW

api-ms-win-core-file-l1-1-1.dll

CreateFileW, GetDriveTypeW, GetFinalPathNameByHandleW, GetFileAttributesW

api-ms-win-core-file-l1-2-0.dll

GetDriveTypeW, GetFileAttributesW, GetFinalPathNameByHandleW, CreateFileW

api-ms-win-core-handle-l1-1-0.dll

CloseHandle

api-ms-win-core-interlocked-l1-1-0.dll

InterlockedIncrement, InterlockedCompareExchange64, InterlockedDecrement, InterlockedCompareExchange

api-ms-win-core-interlocked-l1-2-0.dll

InterlockedDecrement, InterlockedIncrement, InterlockedCompareExchange64

api-ms-win-core-processthreads-l1-1-0.dll

GetCurrentProcess, GetCurrentProcessId, GetProcessId, GetCurrentThreadId, TerminateProcess

api-ms-win-core-processthreads-l1-1-1.dll

GetCurrentThreadId, TerminateProcess, GetCurrentProcess, GetProcessId, GetCurrentProcessId

api-ms-win-core-profile-l1-1-0.dll

QueryPerformanceCounter

api-ms-win-core-registry-l1-1-0.dll

RegGetValueW

api-ms-win-core-sysinfo-l1-1-0.dll

GetSystemTimeAsFileTime, GetSystemInfo, GetTickCount

api-ms-win-core-sysinfo-l1-1-1.dll

GetTickCount, GetSystemTimeAsFileTime

api-ms-win-core-sysinfo-l1-2-0.dll

GetTickCount, GetSystemTimeAsFileTime

api-ms-win-core-threadpool-l1-1-0.dll

CloseThreadpool, CreateThreadpool, UnregisterWaitEx, CloseThreadpoolWork, SubmitThreadpoolWork, CreateThreadpoolWork, SetThreadpoolThreadMinimum, CloseThreadpoolCleanupGroup, CloseThreadpoolCleanupGroupMembers, SetThreadpoolThreadMaximum, CreateThreadpoolCleanupGroup

api-ms-win-core-threadpool-l1-1-1.dll

CloseThreadpoolWork, SetThreadpoolThreadMaximum, CreateThreadpoolCleanupGroup, SetThreadpoolThreadMinimum, CreateThreadpoolWork, CloseThreadpool, CloseThreadpoolCleanupGroup, CloseThreadpoolCleanupGroupMembers, SubmitThreadpoolWork, UnregisterWaitEx, CreateThreadpool

api-ms-win-core-threadpool-l1-2-0.dll

SetThreadpoolThreadMaximum, SetThreadpoolThreadMinimum, CreateThreadpoolCleanupGroup, CloseThreadpoolCleanupGroupMembers, CloseThreadpoolCleanupGroup, CloseThreadpool, SubmitThreadpoolWork, CreateThreadpoolWork, CloseThreadpoolWork, CreateThreadpool

api-ms-win-security-sddl-l1-1-0.dll

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-service-core-l1-1-0.dll

SetServiceStatus, RegisterServiceCtrlHandlerExW

api-ms-win-service-core-l1-1-1.dll

RegisterServiceCtrlHandlerExW, SetServiceStatus

apphelp.dll

ApphelpCheckRunApp, ApphelpCheckRunAppEx, ApphelpDebugPrintf

kernel32.dll

DelayLoadFailureHook, FreeLibrary, LoadLibraryExA, SetEndOfFile, SetFilePointer, WriteFile, ExpandEnvironmentStringsW, HeapAlloc, LocalFree, GetProcessHeap, HeapFree, CompareStringW, Sleep, lstrcmpiW, UnmapViewOfFile, MapViewOfFile, CreateFileMappingW, GetFileSize, GetProcAddress, GetSystemTimeAsFileTime, GetCurrentThreadId, GetTickCount, QueryPerformanceCounter, GetProcessId, TerminateProcess, CreateFileW, InterlockedCompareExchange64, GetSystemInfo, UnregisterWait, OutputDebugStringA, GetLastError, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcessId, GetVolumePathNameW, DisableThreadLibraryCalls, GetModuleHandleW, CreateActCtxW, QueryActCtxW, ReleaseActCtx, FindFirstFileW, SetErrorMode, SetFilePointerEx, ReadFile, GetFileTime, VirtualQuery, GetFileSizeEx, GetFileInformationByHandle, GetVolumeNameForVolumeMountPointW, GetVolumeInformationW, CompareStringA, LocalAlloc, SetLastError, IsDBCSLeadByte, LoadLibraryExW, lstrlenA, VirtualProtect, VirtualAlloc, GetLongPathNameW, VirtualFree, OutputDebugStringW, GetEnvironmentVariableW, FindNextFileW, FindClose, UnregisterWaitEx, GetSystemWindowsDirectoryW, GetBinaryTypeW, CreateMutexW, WaitForSingleObject, ReleaseMutex, GetFileAttributesExW, PackageIdFromFullName, CompareFileTime, GetModuleFileNameW, InterlockedCompareExchange

kernelbase.dll

ResolveDelayLoadedAPI

msvcrt.dll

DllMain

ntdll.dll

ZwClose, NtCreateEvent, RtlCreateUserThread, AlpcGetMessageAttribute, NtAlpcCancelMessage, RtlExitUserThread, NtAlpcOpenSenderProcess, RtlDosPathNameToRelativeNtPathName_U, RtlReleaseRelativeName, RtlFreeUnicodeString, RtlCreateHeap, NtWaitForSingleObject, AlpcInitializeMessageAttribute, NtAlpcAcceptConnectPort, NtAlpcCreatePort, RtlAllocateAndInitializeSid, RtlLengthSid, RtlCreateSecurityDescriptor, RtlCreateAcl, RtlAddAccessAllowedAce, RtlSetDaclSecurityDescriptor, RtlFreeSid, NtOpenKey, RtlDestroyHeap, NtResumeThread, NtSetInformationFile, NtQueryInformationFile, EtwTraceMessage, NtAlpcSendWaitReceivePort, RtlInitUnicodeString, NtApphelpCacheControl, AlpcMaxAllowedMessageLength, NtQueryValueKey, RtlFreeHeap, RtlAllocateHeap, RtlInitializeCriticalSectionAndSpinCount, RtlDeleteCriticalSection, NtSetEvent, RtlEnterCriticalSection, RtlLeaveCriticalSection, NtClose, NtQuerySystemInformation, NtDelayExecution, NtResetEvent, NtWaitForMultipleObjects, NtTerminateThread, RtlUnwind, _vsnprintf, memset, memcpy, RtlValidateHeap, RtlSizeHeap, RtlAdjustPrivilege, RtlNtStatusToDosError, RtlCheckTokenMembership, NtOpenFile, EtwEventUnregister, EtwEventRegister, EtwEventWrite, RtlGetVersion, RtlImageRvaToVa, RtlImageDirectoryEntryToData, RtlAppendUnicodeToString, RtlAppendUnicodeStringToString, DbgPrintEx, RtlFormatCurrentUserKeyPath, RtlDowncaseUnicodeString, NlsMbCodePageTag, NtQueryKey, NtEnumerateValueKey, RtlExpandEnvironmentStrings_U, RtlAnsiStringToUnicodeString, NtMapViewOfSection, RtlInitAnsiString, RtlInitString, LdrGetDllHandle, NtQueryInformationProcess, NtQueryDirectoryFile, NtUnmapViewOfSection, RtlQueryEnvironmentVariable_U, RtlxAnsiStringToUnicodeSize, NtCreateFile, RtlGetNativeSystemInformation, RtlUnicodeStringToInteger, RtlDoesFileExists_U, RtlGetFullPathName_U, NtCreateSection, LdrGetProcedureAddressEx, RtlDosPathNameToNtPathName_U, RtlUnicodeStringToAnsiString, RtlFreeAnsiString, LdrResSearchResource, LdrResFindResource, RtlUpcaseUnicodeString, RtlCopyUnicodeString, RtlUpcaseUnicodeChar, RtlUpcaseUnicodeToMultiByteN, RtlGUIDFromString, RtlInitializeCriticalSection, EtwEventWriteNoRegistration, RtlCreateUnicodeString, RtlInitUnicodeStringEx, NtFreeVirtualMemory, NtAllocateVirtualMemory, NtProtectVirtualMemory, NtQueryVirtualMemory

Export table

ServiceMain

SvchostPushServiceGlobals

aelupsvc.dll

Application Experience Service by Microsoft

Remove aelupsvc.dll

Version:	6.2.9200.16384 (win8_rtm.120725-1247)
MD5:	79cf09e53a6d3ef6851b6a779d4b18b3
SHA1:	a5d8f5d973df67cb423211427b88768ef2777776
SHA256:	d4f78198b4a549a83bacb2b10dceb859a748458234df2ab8731ca7f46aa2965b

This is a Windows system installed file with Windows File Protection (WFP) enabled.

What is aelupsvc.dll?

This service checks a Microsoft maintained database for known problems with popular programs and automatically enables workarounds, either at first installation (using UAC) or at application launch.

About aelupsvc.dll (from Microsoft)

“The Application Experience Lookup Service is a new service that was introduced in Windows Server 2003 Service Pack 1 (SP1). This service is part of an infrastructure that automatically applies softwar”

Overview

aelupsvc.dll is loaded as dynamic link library that runs in the context of a process. The assembly utilizes the .NET run-time framework (which is required to be installed on the PC). This version is installed on Windows 8.

Details

File name:	aelupsvc.dll
Publisher:	Microsoft Corporation
Product name:	Application Experience Service
Description:	Microsoft® Windows® Operating System
Typical file path:	C:\Windows\System32\aelupsvc.dll
Original name:	aelupsvc.dll.mui
File version:	6.2.9200.16384 (win8_rtm.120725-1247)
Product version:	6.2.9200.16384
Size:	166 KB (169,984 bytes)
Digital DNA
PE subsystem:	Windows Console
File packed:	No
Code language:	Microsoft Visual C# / Basic .NET
.NET CLR:	Yes
.NET NGENed:	No

More details

Behaviors

Hosted services

Runs as a shared service under the Windows svcHost

Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'
Shared name is 'AeLookupSvc'

Distribution by Windows OS

OS version	distribution
Windows 7 Home Premium	29.00%
Windows Vista Home Premium	23.00%
Windows 7 Ultimate	21.00%
Windows 7 Professional	8.00%
Windows Vista Home Basic	4.00%
Windows 7 Home Basic	2.00%
Windows 8	2.00%
Windows Vista Business	2.00%
Windows Vista Ultimate	2.00%
Windows 7 Starter	1.50%
Windows 8.1	1.00%
Windows 8 Enterprise	1.00%
Windows 8 Pro	1.00%
Windows 8.1 Enterprise	0.50%
Windows Developer Preview	0.50%
Windows 8.1 Pro Preview	0.50%
Windows 8.1 Pro	0.50%
Windows 8 Pro N	0.50%

Distribution by country

United States installs about 52.53% of Application Experience Service.

Distribution by PC manufacturer

PC Manufacturer	distribution
Dell	24.03%
Hewlett-Packard	19.38%
Acer	13.18%
Toshiba	11.63%
ASUS	9.30%
Lenovo	6.20%
Sony	4.65%
Gateway	3.10%
GIGABYTE	1.94%
Intel	1.55%
American Megatrends	1.16%
Alienware	1.16%
Samsung	0.78%
MSI	0.78%
NEC	0.78%
Packard Bell	0.39%

Remove Adware and Spyware Programs, FREE Download!