Versions

11.0.0.0	11.11%
10.2.0.0	22.22%
8.4.0.0	11.11%
6.1.0.0	11.11%
2.2.0.0	11.11%
1.0.0.0	33.33%

Warning 20 antivirus scanners has detected malware in various versions of Service_KMS.exe.

service_kms.exe has 6 known versions, the most recent one is 11.0.0.0. It is started as a Windows Service with the name 'Service KMSELDI'. In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). The average file size is about 492.05 KB. It is an authenticode code-signed executable issued to ByELDI Certificate by the certification authority ByELDI Certificate. Numerous variations of service_kms.exe have been installed with both KMSpico v9.1.3 and KMSpico. This is a .NET Common Language Runtime (CLR) assembly. During the process's lifecycle, the typical CPU resource utilization is about 0.0067% including both foreground and background operations, the average private memory consumption is about 17.3 MB with the maximum memory reaching around 18.38 MB. Addionally, typically read and write I/O disk operations is about 6.27 KB per minute for reads and 3.96 KB per minute for writes.

Based on 40+ industry antivirus scanners, 20 of them detected the following malware.