Versions

2, 0, 0, 38	4.55%
2, 0, 0, 38	13.64%
2, 0, 0, 38	9.09%
2, 0, 0, 38	4.55%
2, 0, 0, 38	13.64%
1, 0, 3, 1	4.55%
1, 0, 3, 1	36.36%
1, 0, 3, 1	9.09%
1, 0, 3, 1	4.55%

Warning 15 antivirus scanners has detected malware in various versions of ExpressFiles.exe.

There are 9 versions of expressfiles.exe in the wild, the latest version being 2, 0, 0, 38. expressfiles.exe is run as a standard windows process with the logged in user's account privileges. During installation, a run registry key for all users is added that will cause the program to run each time any user logs on to Windows. The average file size is about 696.75 KB. The file is a digitally signed and issued to Faglaro Enterprises Limited by COMODO CA Limited. Some variations of the file have been seen to be installed with the program ExpressFiles from Express Solutions. During the process's lifecycle, the typical CPU resource utilization is about 0.0050% including both foreground and background operations, the average private memory consumption is about 20.28 MB with the maximum memory reaching around 27.43 MB. Addionally, typically read and write I/O disk operations is about 23.01 MB per minute for reads and 1.87 MB per minute for writes.

Based on 40+ industry antivirus scanners, 15 of them detected the following malware.