There are 6 versions of rlservice.exe in the wild, the latest version being 1.1.21.125 (Build 21.125). It is started as a Windows Service called 'RelevantKnowledge'. In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). The average file size is about 117.13 KB. The file is a digitally signed and issued to TMRG by Thawte. Some variations of the file have been seen to be installed with the program RelevantKnowledge from TMRG, Inc.. During the process's lifecycle, the typical CPU resource utilization is about 0.0012% including both foreground and background operations, the average private memory consumption is about 870 KB.
Relevant-Knowledge maintains a group of users who have monitoring software (with brands including PermissionResearch, OpinionSquare and VoiceFive Networks) installed on their PCs in exchange for joining the Relevant-Knowledge research panels, users are presented with various benefits, including computer security software, Internet data storage, virus scanning and chances to win cash or prizes.
(Note, the behaviors below are for all versions of rlservice.exe, select a unique version for details.)
Runs under 'SYSTEM\CurrentControlSet\Services' by the Service Controller (services.exe)
Based on 40+ industry antivirus scanners, 62 of them detected the following malware.
United States installs about 42.86% of Relevant-Knowledge.