Versions

12.0.104.000	20.59%
11.0.768.000	8.82%
11.0.000.504	20.59%
11.0.000.057	2.94%
11.0.000.038	2.94%
11.0.000.020	20.59%
11.0.000.018	2.94%
10.2.078.000	2.94%
10.2.074.000	2.94%
10.2.064.000	2.94%
10.2.047.000	8.82%
10.1.065.000	2.94%

There are 12 versions of vsmon.exe in the wild, the latest version being 12.0.104.000. It is started as a Windows Service called 'TrueVector Internet Monitor' with the name 'vsmon' and described as “Monitors internet traffic and generates alerts for disallowed access.”. . In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). The average file size is about 2.33 MB. The file is a digitally signed and issued to Check Point Software Technologies Ltd. by VeriSign. The programs ZoneAlarm Free Antivirus + Firewall, ZoneAlarm Free Firewall and ZoneAlarm Free have been observed as installing specific variations of vsmon.exe. During the process's lifecycle, the typical CPU resource utilization is about 0.0078% including both foreground and background operations, the average private memory consumption is about 154.34 MB with the maximum memory reaching around 224.91 MB. Addionally, typically read and write I/O disk operations is about 2.61 MB per minute for reads and 1.28 MB per minute for writes.

True Vector Internet Monitor, also known as TrueVector Security Engine, is the core scanning engine of ZoneAlarm. It is a Windows service which runs as "vsmon.exe" in the processes list. TrueVector Service Monitors internet traffic and generates alerts for disallowed access.