Additional versions

1, 0, 0, 6	23.33%
1, 0, 0, 6	36.67%
1, 0, 0, 6	40.00%

efupdater.exe executes as a process with the local user's privileges. It is an auto-starting process that used the Windows Task Scheduler service to load when the user logs into Windows (sometimes this is required to bypass the UAC protection). It is installed with a couple of know programs including ExpressFiles published by Express Solutions, ExpressFiles from Express Solutions and ExpressFiles by Express Solutions. The file is digitally signed by Faglaro Enterprises Limited which was issued by the COMODO CA Limited certificate authority (CA).

CPU
Total CPU:	0.00088365%	0.028634%
Kernel CPU:	0.00049698%	0.013761%
User CPU:	0.00038667%	0.014873%
Kernel CPU time:	246,414 ms/min	100,923,805ms/min
CPU cycles:	115,957/sec	17,470,203/sec
Context switches:	4/sec	284/sec
Memory
Private memory:	9.08 MB	21.59 MB
Private (maximum):	13.49 MB
Private (minimum):	460 KB
Non-paged memory:	9.08 MB	21.59 MB
Virtual memory:	84.33 MB	140.96 MB
Virtual memory (peak):	89.34 MB	169.69 MB
Working set:	2.02 MB	18.61 MB
Working set (peak):	13.69 MB	37.95 MB
Page faults:	18,460/min	2,039/min
I/O
I/O read transfer:	7.86 KB/sec	1.02 MB/min
I/O read operations:	1/sec	343/min
I/O write transfer:	2 Bytes/sec	274.99 KB/min
I/O write operations:	1/sec	227/min
I/O other transfer:	1.65 KB/sec	448.09 KB/min
I/O other operations:	11/sec	1,671/min
Resource allocations
Threads:	4	12
Handles:	202	600
GUI GDI count:	27	103
GUI GDI peak:	26	142
GUI USER count:	6	49
GUI USER peak:	7	71

ntdll.dll
Total CPU:	0.01616325%	0.272967%
Kernel CPU:	0.01616325%	0.107585%
User CPU:	0.00000000%	0.165382%
CPU cycles:	389,058/sec	5,741,424/sec
Memory:	1.66 MB	1.16 MB
EFUpdater.exe (main module)
Total CPU:	0.00035784%
Kernel CPU:	0.00015196%
User CPU:	0.00020589%
CPU cycles:	13,552/sec
Memory:	256 KB