File name:

vs_SSMS.exe

Full analysis: https://app.any.run/tasks/0a29d7af-2dd0-45d2-878e-05c2bef5ee36
Verdict: Malicious activity
Analysis date: July 02, 2025, 13:05:52
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
crypto-regex
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

4151928D5ECC8618B9EE9CD9297A6977

SHA1:

ED4E2476AE6C7191A401D2040CBBB47635DC1838

SHA256:

65C818B45C9E80B6BFA5156819EABC01E1340A92D1B8693949661F7AF1A46C6D

SSDEEP:

98304:4L2V3DFCfeIUmXPLB5hLuiyszYhPuAY5RcNjlwNF1NzkCqhxBCxFSYyKxAvPrgVC:9izglHN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • vs_SSMS.exe (PID: 5480)

    • Process drops legitimate windows executable

      • vs_SSMS.exe (PID: 5480)

    • Executable content was dropped or overwritten

      • vs_SSMS.exe (PID: 5480)

    • Reads security settings of Internet Explorer

      • vs_SSMS.exe (PID: 5480)
      • vs_setup_bootstrapper.exe (PID: 2716)

    • Found regular expressions for crypto-addresses (YARA)

      • vs_setup_bootstrapper.exe (PID: 2716)

  • INFO

    • Reads the machine GUID from the registry

      • vs_SSMS.exe (PID: 5480)
      • vs_setup_bootstrapper.exe (PID: 2716)

    • The sample compiled with english language support

      • vs_SSMS.exe (PID: 5480)

    • The sample compiled with portuguese language support

      • vs_SSMS.exe (PID: 5480)

    • The sample compiled with chinese language support

      • vs_SSMS.exe (PID: 5480)

    • Reads the computer name

      • vs_SSMS.exe (PID: 5480)
      • vs_setup_bootstrapper.exe (PID: 2716)

    • The sample compiled with spanish language support

      • vs_SSMS.exe (PID: 5480)

    • The sample compiled with french language support

      • vs_SSMS.exe (PID: 5480)

    • The sample compiled with korean language support

      • vs_SSMS.exe (PID: 5480)

    • The sample compiled with czech language support

      • vs_SSMS.exe (PID: 5480)

    • The sample compiled with german language support

      • vs_SSMS.exe (PID: 5480)

    • The sample compiled with Italian language support

      • vs_SSMS.exe (PID: 5480)

    • Create files in a temporary directory

      • vs_SSMS.exe (PID: 5480)
      • vs_setup_bootstrapper.exe (PID: 2716)

    • The sample compiled with turkish language support

      • vs_SSMS.exe (PID: 5480)

    • The sample compiled with polish language support

      • vs_SSMS.exe (PID: 5480)

    • Checks supported languages

      • vs_SSMS.exe (PID: 5480)
      • vs_setup_bootstrapper.exe (PID: 2716)

    • The sample compiled with japanese language support

      • vs_SSMS.exe (PID: 5480)

    • The sample compiled with russian language support

      • vs_SSMS.exe (PID: 5480)

    • Process checks computer location settings

      • vs_SSMS.exe (PID: 5480)

    • Creates files in the program directory

      • vs_setup_bootstrapper.exe (PID: 2716)

    • Checks proxy server information

      • vs_setup_bootstrapper.exe (PID: 2716)

    • Reads the software policy settings

      • vs_setup_bootstrapper.exe (PID: 2716)

    • Displays MAC addresses of computer network adapters

      • getmac.exe (PID: 4860)

    • Disables trace logs

      • vs_setup_bootstrapper.exe (PID: 2716)

    • Creates files or folders in the user directory

      • vs_setup_bootstrapper.exe (PID: 2716)

    • Reads CPU info

      • vs_setup_bootstrapper.exe (PID: 2716)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:25 17:46:24+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 229376
InitializedDataSize: 199680
UninitializedDataSize: -
EntryPoint: 0x1e090
OSVersion: 5.1
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 17.14.36221.1
ProductVersionNumber: 17.14.36221.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: SSMS Installer
FileVersion: 17.14.36221.1
InternalName: vs_ssms.exe
OriginalFileName: vs_ssms.exe
ProductName: Microsoft SQL Server Management Studio
ProductVersion: 21.3.7
LegalCopyright: © Microsoft Corporation. All rights reserved.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start vs_ssms.exe vs_setup_bootstrapper.exe getmac.exe no specs conhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2716"C:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\vs_setup_bootstrapper.exe" --env "_SFX_CAB_EXE_PACKAGE:C:\Users\admin\AppData\Local\Temp\vs_SSMS.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:C:\Users\admin\AppData\Local\Temp"C:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
vs_SSMS.exe
User:
admin
Company:
Microsoft
Integrity Level:
HIGH
Description:
Visual Studio Installer
Version:
3.14.2075.50697
Modules
Images
c:\users\admin\appdata\local\temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4264\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—getmac.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4860"getmac"C:\Windows\SysWOW64\getmac.exe—vs_setup_bootstrapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Displays NIC MAC information
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\getmac.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5060C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5480"C:\Users\admin\AppData\Local\Temp\vs_SSMS.exe" C:\Users\admin\AppData\Local\Temp\vs_SSMS.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
SSMS Installer
Version:
17.14.36221.1
Modules
Images
c:\users\admin\appdata\local\temp\vs_ssms.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
Total events
2 717
Read events
2 645
Write events
72
Delete events
0

Modification events

(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DevDiv
Operation:writeName:DevMachineId
Value:
dcc27a53-65f2-4913-8a7a-9619e7605962
(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DeveloperTools
Operation:writeName:deviceid
Value:
dcc27a53-65f2-4913-8a7a-9619e7605962
(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DeveloperTools\HardwareCache
Operation:writeName:Uuid
Value:
1d1fb0bb-21b9-4fc0-b017-a4dada231e17
(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DeveloperTools\HardwareCache
Operation:writeName:MachineGuid
Value:
bb926e54-e3ca-40fd-ae90-2764341e7792
(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DeveloperTools\HardwareCache
Operation:writeName:HardDriveSerialNumber
Value:
qm00001
(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vs_setup_bootstrapper_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vs_setup_bootstrapper_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vs_setup_bootstrapper_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vs_setup_bootstrapper_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vs_setup_bootstrapper_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
Executable files
34
Suspicious files
7
Text files
20
Unknown types
0

Dropped files

PID
Process
Filename
Type
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\HelpFile\1055\help.htmlhtml
MD5:C7B60E697671394781260D5B2CD21810
SHA256:CCF766B55CB0CC623F2705206A2AF04F2C83801580BC40A5AC20F644B814AB8F
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\HelpFile\3082\help.htmlhtml
MD5:0474106AC825B4F7727FF94576FC15C2
SHA256:A597AA82F35641455E12BD78662A05142F64BC221FF91D4EC4F2A8FA2983297F
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\Microsoft.Identity.Client.Extensions.Msal.dllexecutable
MD5:247F0342AF3A1C54895AE73900C54E5E
SHA256:52B8071E17B8944D6C51B5388AA0BCBAB3D1330F99EC341818D709DA36F8A468
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\HelpFile\2052\help.htmlhtml
MD5:1BD86FBD65D005648103E050D9BEB9F1
SHA256:740117157B31BD5C634A232A0BA98A692B28ED2B4829EF52372200EB547D07CF
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\HelpFile\1042\help.htmlhtml
MD5:8125E76142C8438863F35CE5B8E63E57
SHA256:929A97C8A9A4EA4F72E2F17DBB20E76E604B7F1255F20874AA1C44AEC0F456C1
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\vs_setup_bootstrapper.exeexecutable
MD5:74DD072F6E323C91AAFDD0F48F0D09A4
SHA256:09DE373135CF94E0773517BEC0E6E48002034E55E381567EBE362AAAB4A281F8
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\HelpFile\1045\help.htmlhtml
MD5:9147BC24EACE34955B865DAA39DAD8AB
SHA256:322DB9FFDB987D0C824A4DE3B8DB40722BCAF95833DCF90E7B5F250A841E592B
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\HelpFile\1028\help.htmlhtml
MD5:EEAF8CBF54B4E891FF6BE38CF44E3814
SHA256:AAD5B2ACF30EB9C2DD35FF3B5C6C1A76CC4F1AE0AB6F382A635F5C329439F3AF
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\HelpFile\1046\help.htmlhtml
MD5:C2BDEAA46B13E3CDE01E3DCAA734C0F2
SHA256:5A0802D6CA8D63D8476EEC79BDBD6079A17DC149D5D8C7DF13059D47BBB09F3A
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\HelpFile\1049\help.htmlhtml
MD5:66D963430209555CDCB8A5C0219BC60C
SHA256:D9AB0A8DB5A8409C5849AA4E1512576225E5B320EA79B0CDC83C2B4848401611
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
27
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2668
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7004
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7004
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3720
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2716
vs_setup_bootstrapper.exe
23.50.131.85:443
telemetry.visualstudio.microsoft.com
Akamai International B.V.
DE
whitelisted
2716
vs_setup_bootstrapper.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
2716
vs_setup_bootstrapper.exe
23.50.131.93:443
settings.visualstudio.microsoft.com
Akamai International B.V.
DE
whitelisted
2716
vs_setup_bootstrapper.exe
13.85.16.224:443
targetednotifications-tm.trafficmanager.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.238
whitelisted
telemetry.visualstudio.microsoft.com
  • 23.50.131.85
  • 23.50.131.81
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
settings.visualstudio.microsoft.com
  • 23.50.131.93
  • 23.50.131.70
whitelisted
targetednotifications-tm.trafficmanager.net
  • 13.85.16.224
whitelisted
crl.microsoft.com
  • 23.216.77.18
  • 23.216.77.22
  • 23.216.77.6
  • 23.216.77.19
  • 23.216.77.20
  • 23.216.77.41
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 20.190.159.128
  • 40.126.31.3
  • 40.126.31.69
  • 20.190.159.2
  • 20.190.159.130
  • 40.126.31.73
  • 20.190.159.0
  • 20.190.159.131
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
vs_SSMS.exe