Versions

17.28.0.1186 104613	41.67%
17.22.0.975 102614	8.33%
17.21.0.908 102416	8.33%
17.20.0.873 102352	8.33%
17.18.0.799 102139	8.33%
17.13.0.537 101386	25.00%

There are 6 versions of vsserv.exe in the wild, the latest version being 17.28.0.1186 104613. It is started as a Windows Service called 'Bitdefender Virus Shield' with the name 'VSSERV'. In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). The average file size is about 1.4 MB. The file is a digitally signed and issued to Bitdefender SRL by VeriSign. The executable is a .NET framework assembly utilizing the CLR. During the process's lifecycle, the typical CPU resource utilization is about 0.0008% including both foreground and background operations, the average private memory consumption is about 209.15 MB with the maximum memory reaching around 210.41 MB. Addionally, typically read and write I/O disk operations is about 1.01 MB per minute for reads and 530.61 KB per minute for writes.