Should I block it?

45%

45% of PCs block this file from running.

Possible reason:

Performance resource utilization

Additional versions

2, 0, 0, 4	11.11%
2, 0, 0, 4	16.67%
2, 0, 0, 4	27.78%
2, 0, 0, 4	5.56%
2,0,0,0	5.56%
2,0,0,0	5.56%
2,0,0,0	22.22%
2,0,0,0	5.56%

Relationships

expressfiles.exe (ExpressFiles Application by Faglaro Enterprises Limited)

PE file structure

Show functions

Import table

advapi32.dll

RegisterEventSourceA, ReportEventA

htmlayout.dll

HTMLayoutLoadHtml, HTMLayoutSetElementInnerText16, HTMLayoutSetAttributeByName

kernel32.dll

GetVersionExA, GetVersion, GetVersionExW, InterlockedDecrement, GetModuleFileNameW, GetModuleHandleA, LoadLibraryA, LocalAlloc, LocalFree, GetModuleFileNameA, ExitProcess, CreateThread, RtlUnwind

mswsock.dll

GetAcceptExSockaddrs, AcceptEx

ole32.dll

OleInitialize

shell32.dll

ShellExecuteW, SHGetSpecialFolderPathA, SHGetMalloc

shlwapi.dll

PathFindFileNameW, SHSetValueA, StrStrIA

user32.dll

DefWindowProcW, CreateWindowExW, FindWindowExA

Export table

6?vë±²áìE1¦ÖUë«¬?ªmZ>4$@z?Þ ²ãz\?[½°Ã.Þ÷åféRÅ)W.qÚ?Åc*wQËÍÓÃmÌ]#é?x?ð={?p°Ñ5v¬k¬¦7Ä(?c?'??³F]x?GA?è?%?S?¯YY"?J?wWû?A(_Úîï?h=??Ö×l9ß3^ú?oOBb@ba"m#1?×aýjvèlæFº³¨·1àg>?·¨ëQ±ObaP?A+7??`ò?e?ßîô µA·¬)î²¦å%î*¦N?4¤gÊ

asio_signal_handler

õ?Ñl%ÝWwºÙü²â ×ÚK<Æû?ùo?!ò!¥=.Åc£?ââMMéw)»¼S?È¬ºÎy?ÕU5"5Cã°Æ?W.ê?ãêA??ý( E'?¸.lÝä5Høx# Z¢æyü?Í·5??½?à?«$|?æ>c?ª,?Z_hg'S´y.ÙOT{ä'{¤1½%âsb?ÒØ*Rõ)o?½Eêú«yú|CD+^?ÍÈÚü-D¶°,ê~i¾ q²v±î<,?|±ÍíÁ¸BUÜ¸7 ?-+4Lº?Ö=SXô7?ªaM"FHå¸Çz½Ú0k

ExpressDL.exe

ExpressDL Application by Faglaro Enterprises Limited (Signed)

Remove ExpressDL.exe

Version:	2, 0, 0, 4
MD5:	533b4d00ac7d7be7e3e8c8f1c2ec38b5
SHA1:	569382c7ec8cf26135055d5c7e931b8fb5c861a8
SHA256:	9ba055da74a0e4efbd8ec36b2aed1883f23e522d54f272dc6d70b8406d741bfb

Overview

expressdl.exe executes as a process with the local user's privileges typically within the context of its parent expressfiles.exe (ExpressFiles Application by Faglaro Enterprises Limited). It has been configured with a firewall exception which allows both inbound and outbound network communication without being blocked. It is installed with a couple of know programs including ExpressFiles published by Express Solutions, ExpressFiles from Express Solutions and ExpressFiles by Express Solutions. Note, some antivirus scanners have flagged this file, however it is not necessarily considered malware (see below for details).

Details

File name:	expressdl.exe
Publisher:	http://www.express-files.com/
Product name:	ExpressDL Application
Typical file path:	C:\Program Files\expressfiles\expressdl.exe
File version:	2, 0, 0, 4
Product version:	2,0,0,0
Size:	2.14 MB (2,242,048 bytes)
Build date:	7/15/2013 6:36 AM
Certificate
Issued to:	Faglaro Enterprises Limited
Authority (CA):	COMODO CA Limited
Digital DNA
PE subsystem:	Windows GUI
File packed:	No
.NET CLR:	No

More details

Programs

The following programs will install this file

ExpressFiles

Express Solutions

61% remove

“No settings, no complications, unimaginable speed, with minimum effort and maximum simplicity! User-friendly interface anyone can manage. Built-in instant search tool with an amazingly intelligent algorithm! It's absolutely free. And, we are con- stantly working to make our product better. Ask why? It's simple! We like to make the Internet better, and staying there pleasant. It's totally unique. Very simple inter- face is specifically d...”

Behaviors

Windows firewall allowed program

Exceptions allow programs to access to the Internet through an outbound connections

Firewall exception for 'C:\Program Files\ExpressFiles\expressdl.exe'

Network connections

Access through an approved Windows firewall exception

[TCP] 61.184.79.214:26399

[UDP] listens on port 56096

[UDP] listens on port 50317

[UDP] listens on port 51727

[UDP] listens on port 59887

[UDP] listens on port 63401

Resource utilization

(Note: statistics below are averages based on a minimum sample size of 200 unique participants)

Averages

CPU
Total CPU:	0.01380516%	0.028634%
Kernel CPU:	0.00542387%	0.013761%
User CPU:	0.00838130%	0.014873%
Kernel CPU time:	39,060 ms/min	100,923,805ms/min
CPU cycles:	3,803,492/sec	17,470,203/sec
Context switches:	1,253/sec	284/sec
Memory
Private memory:	25.04 MB	21.59 MB
Private (maximum):	30.29 MB
Private (minimum):	22.47 MB
Non-paged memory:	25.04 MB	21.59 MB
Virtual memory:	122 MB	140.96 MB
Virtual memory (peak):	193.16 MB	169.69 MB
Working set:	30.22 MB	18.61 MB
Working set (peak):	30.31 MB	37.95 MB
Page faults:	70,527/min	2,039/min
I/O
I/O read transfer:	2.65 MB/sec	1.02 MB/min
I/O read operations:	170/sec	343/min
I/O write transfer:	2.42 MB/sec	274.99 KB/min
I/O write operations:	206/sec	227/min
I/O other transfer:	2.17 MB/sec	448.09 KB/min
I/O other operations:	1,640/sec	1,671/min
Resource allocations
Threads:	8	12
Handles:	209	600
GUI GDI count:	49	103
GUI GDI peak:	58	142
GUI USER count:	12	49
GUI USER peak:	27	71

Process properties

Integrety level:	Medium
Platform:	64-bit
Command lines:	"C:\Program Files\expressfiles\expressdl.exe" 3905480266 0 magneC:?xt=urC:btiC:0f64c938aa483f778eac00e42e9a8451a1f00dc7&dn=atm 2012 hdrip nl subs horror thriller&tr=udC://tracker.istole.iC:80/announce&tr=udC://tracker.openbittorrent.coC:80/announce&tr=httC://www.h33t.coC:3310/announce&tr=httC://9.rarbg.coC:2710/announce&tr=httC://bt.rutor.orC:2710/announce "C:\Program Files\expressfiles\expressdl.exe" 3189367914 2 magneC:?xt=urC:btiC:87e5a0afe6865db2c087a324dfe6bc09419ca47d&dn=ucheniki 36 stupenei shaolinya 1985 x264 bdrip avc mediaclub mkv&tr=udC://tracker.istole.iC:80/announce&tr=udC://tracker.openbittorrent.coC:80/announce&tr=httC://www.h33t.coC:3310/announce&tr=httC://9.rarbg.coC:2710/announce&tr=httC://bt.rutor.orC:2710/announce "C:\Program Files\expressfiles\expressdl.exe" 965712781 1 magneC:?xt=urC:btiC:867761b79b7fae3fe436ae79010d7e04cbf0c181&dn=kung fu the 18 bronzemen 3 aka the 8 masters 1976 uncut&tr=udC://tracker.istole.iC:80/announce&tr=udC://tracker.openbittorrent.coC:80/announce&tr=httC://www.h33t.coC:3310/announce&tr=httC://9.rarbg.coC:2710/announce&tr=httC://bt.rutor.orC:2710/announce "C:\Program Files\expressfiles\expressdl.exe" 691233806 1 magneC:?xt=urC:btiC:7848014ba4fbbb0e3013676e3c4dd019bbf0b49d&dn=house of traps avi&tr=udC://tracker.istole.iC:80/announce&tr=udC://tracker.openbittorrent.coC:80/announce&tr=httC://www.h33t.coC:3310/announce&tr=httC://9.rarbg.coC:2710/announce&tr=httC://bt.rutor.orC:2710/announce "C:\Program Files\expressfiles\expressdl.exe" 967963163 0 magneC:?xt=urC:btiC:562d988226f378824be324cf2eda880996a5d0e4&dn=gabbar singh 2012 brrip 720p dual audio telugu hindi x264 ac3 sdr&tr=udC://tracker.istole.iC:80/announce&tr=udC://tracker.openbittorrent.coC:80/announce&tr=httC://www.h33t.coC:3310/announce&tr=httC://9.rarbg.coC:2710/announce&tr=httC://bt.rutor.orC:2710/announce
Owner:	User
Parent process:	expressfiles.exe (ExpressFiles Application by Faglaro Enterprises Limited)

Threads