File name:

vs_SSMS.exe

Full analysis: https://app.any.run/tasks/0a29d7af-2dd0-45d2-878e-05c2bef5ee36
Verdict: Malicious activity
Analysis date: July 02, 2025, 13:05:52
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
crypto-regex
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

4151928D5ECC8618B9EE9CD9297A6977

SHA1:

ED4E2476AE6C7191A401D2040CBBB47635DC1838

SHA256:

65C818B45C9E80B6BFA5156819EABC01E1340A92D1B8693949661F7AF1A46C6D

SSDEEP:

98304:4L2V3DFCfeIUmXPLB5hLuiyszYhPuAY5RcNjlwNF1NzkCqhxBCxFSYyKxAvPrgVC:9izglHN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • vs_SSMS.exe (PID: 5480)

    • Starts a Microsoft application from unusual location

      • vs_SSMS.exe (PID: 5480)

    • Executable content was dropped or overwritten

      • vs_SSMS.exe (PID: 5480)

    • Reads security settings of Internet Explorer

      • vs_SSMS.exe (PID: 5480)
      • vs_setup_bootstrapper.exe (PID: 2716)

    • Found regular expressions for crypto-addresses (YARA)

      • vs_setup_bootstrapper.exe (PID: 2716)

  • INFO

    • The sample compiled with chinese language support

      • vs_SSMS.exe (PID: 5480)

    • The sample compiled with spanish language support

      • vs_SSMS.exe (PID: 5480)

    • Reads the computer name

      • vs_SSMS.exe (PID: 5480)
      • vs_setup_bootstrapper.exe (PID: 2716)

    • The sample compiled with english language support

      • vs_SSMS.exe (PID: 5480)

    • The sample compiled with portuguese language support

      • vs_SSMS.exe (PID: 5480)

    • Reads the machine GUID from the registry

      • vs_SSMS.exe (PID: 5480)
      • vs_setup_bootstrapper.exe (PID: 2716)

    • The sample compiled with korean language support

      • vs_SSMS.exe (PID: 5480)

    • The sample compiled with german language support

      • vs_SSMS.exe (PID: 5480)

    • The sample compiled with czech language support

      • vs_SSMS.exe (PID: 5480)

    • The sample compiled with Italian language support

      • vs_SSMS.exe (PID: 5480)

    • Process checks computer location settings

      • vs_SSMS.exe (PID: 5480)

    • Checks supported languages

      • vs_SSMS.exe (PID: 5480)
      • vs_setup_bootstrapper.exe (PID: 2716)

    • Displays MAC addresses of computer network adapters

      • getmac.exe (PID: 4860)

    • Create files in a temporary directory

      • vs_setup_bootstrapper.exe (PID: 2716)
      • vs_SSMS.exe (PID: 5480)

    • Creates files in the program directory

      • vs_setup_bootstrapper.exe (PID: 2716)

    • Disables trace logs

      • vs_setup_bootstrapper.exe (PID: 2716)

    • The sample compiled with french language support

      • vs_SSMS.exe (PID: 5480)

    • The sample compiled with turkish language support

      • vs_SSMS.exe (PID: 5480)

    • The sample compiled with polish language support

      • vs_SSMS.exe (PID: 5480)

    • The sample compiled with japanese language support

      • vs_SSMS.exe (PID: 5480)

    • The sample compiled with russian language support

      • vs_SSMS.exe (PID: 5480)

    • Creates files or folders in the user directory

      • vs_setup_bootstrapper.exe (PID: 2716)

    • Checks proxy server information

      • vs_setup_bootstrapper.exe (PID: 2716)

    • Reads CPU info

      • vs_setup_bootstrapper.exe (PID: 2716)

    • Reads the software policy settings

      • vs_setup_bootstrapper.exe (PID: 2716)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:25 17:46:24+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 229376
InitializedDataSize: 199680
UninitializedDataSize: -
EntryPoint: 0x1e090
OSVersion: 5.1
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 17.14.36221.1
ProductVersionNumber: 17.14.36221.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: SSMS Installer
FileVersion: 17.14.36221.1
InternalName: vs_ssms.exe
OriginalFileName: vs_ssms.exe
ProductName: Microsoft SQL Server Management Studio
ProductVersion: 21.3.7
LegalCopyright: © Microsoft Corporation. All rights reserved.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start vs_ssms.exe vs_setup_bootstrapper.exe getmac.exe no specs conhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2716"C:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\vs_setup_bootstrapper.exe" --env "_SFX_CAB_EXE_PACKAGE:C:\Users\admin\AppData\Local\Temp\vs_SSMS.exe _SFX_CAB_EXE_ORIGINALWORKINGDIR:C:\Users\admin\AppData\Local\Temp"C:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
vs_SSMS.exe
User:
admin
Company:
Microsoft
Integrity Level:
HIGH
Description:
Visual Studio Installer
Version:
3.14.2075.50697
Modules
Images
c:\users\admin\appdata\local\temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4264\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—getmac.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4860"getmac"C:\Windows\SysWOW64\getmac.exe—vs_setup_bootstrapper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Displays NIC MAC information
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\getmac.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5060C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5480"C:\Users\admin\AppData\Local\Temp\vs_SSMS.exe" C:\Users\admin\AppData\Local\Temp\vs_SSMS.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
SSMS Installer
Version:
17.14.36221.1
Modules
Images
c:\users\admin\appdata\local\temp\vs_ssms.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
Total events
2 717
Read events
2 645
Write events
72
Delete events
0

Modification events

(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DevDiv
Operation:writeName:DevMachineId
Value:
dcc27a53-65f2-4913-8a7a-9619e7605962
(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DeveloperTools
Operation:writeName:deviceid
Value:
dcc27a53-65f2-4913-8a7a-9619e7605962
(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DeveloperTools\HardwareCache
Operation:writeName:Uuid
Value:
1d1fb0bb-21b9-4fc0-b017-a4dada231e17
(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DeveloperTools\HardwareCache
Operation:writeName:MachineGuid
Value:
bb926e54-e3ca-40fd-ae90-2764341e7792
(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\DeveloperTools\HardwareCache
Operation:writeName:HardDriveSerialNumber
Value:
qm00001
(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vs_setup_bootstrapper_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vs_setup_bootstrapper_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vs_setup_bootstrapper_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vs_setup_bootstrapper_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2716) vs_setup_bootstrapper.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\vs_setup_bootstrapper_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
Executable files
34
Suspicious files
7
Text files
20
Unknown types
0

Dropped files

PID
Process
Filename
Type
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\HelpFile\2052\help.htmlhtml
MD5:1BD86FBD65D005648103E050D9BEB9F1
SHA256:740117157B31BD5C634A232A0BA98A692B28ED2B4829EF52372200EB547D07CF
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\HelpFile\1029\help.htmlhtml
MD5:432E50F4764D69625E5143571F823B6A
SHA256:C877FE7CD9544369A42A61B5C51264D74BFCA5B4BC5D4DD1FA703428261D6ABC
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\HelpFile\1046\help.htmlhtml
MD5:C2BDEAA46B13E3CDE01E3DCAA734C0F2
SHA256:5A0802D6CA8D63D8476EEC79BDBD6079A17DC149D5D8C7DF13059D47BBB09F3A
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\HelpFile\1045\help.htmlhtml
MD5:9147BC24EACE34955B865DAA39DAD8AB
SHA256:322DB9FFDB987D0C824A4DE3B8DB40722BCAF95833DCF90E7B5F250A841E592B
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\HelpFile\1033\help.htmlhtml
MD5:4F7415E811ACBDDED478B40C3E7B287E
SHA256:55846D86DBE60B1B663018D72BEFA0F53A61D34A4EB093563B93A41B2FAA34A5
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\Microsoft.Identity.Client.Extensions.Msal.dllexecutable
MD5:247F0342AF3A1C54895AE73900C54E5E
SHA256:52B8071E17B8944D6C51B5388AA0BCBAB3D1330F99EC341818D709DA36F8A468
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\HelpFile\1055\help.htmlhtml
MD5:C7B60E697671394781260D5B2CD21810
SHA256:CCF766B55CB0CC623F2705206A2AF04F2C83801580BC40A5AC20F644B814AB8F
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\HelpFile\1041\help.htmlhtml
MD5:92E54A7DB253A0A47C03B44D9651DF3C
SHA256:36C917F205A9C9D5F37788CA45ECD57D0F8EEB498F8320849BBEDF49E012E9F9
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\HelpFile\1042\help.htmlhtml
MD5:8125E76142C8438863F35CE5B8E63E57
SHA256:929A97C8A9A4EA4F72E2F17DBB20E76E604B7F1255F20874AA1C44AEC0F456C1
5480vs_SSMS.exeC:\Users\admin\AppData\Local\Temp\ba2e3c6c74fd5cf4a3cab3\vs_bootstrapper_d15\HelpFile\1036\help.htmlhtml
MD5:F3F48126539E0BA3A98DD002FD224C3A
SHA256:7A13A7DA236E87310B88E620520C8DAB78F47210C57E1FABBD1AC3162215BAEB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
27
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2668
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7004
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7004
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3720
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2716
vs_setup_bootstrapper.exe
23.50.131.85:443
telemetry.visualstudio.microsoft.com
Akamai International B.V.
DE
whitelisted
2716
vs_setup_bootstrapper.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
2716
vs_setup_bootstrapper.exe
23.50.131.93:443
settings.visualstudio.microsoft.com
Akamai International B.V.
DE
whitelisted
2716
vs_setup_bootstrapper.exe
13.85.16.224:443
targetednotifications-tm.trafficmanager.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.238
whitelisted
telemetry.visualstudio.microsoft.com
  • 23.50.131.85
  • 23.50.131.81
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
settings.visualstudio.microsoft.com
  • 23.50.131.93
  • 23.50.131.70
whitelisted
targetednotifications-tm.trafficmanager.net
  • 13.85.16.224
whitelisted
crl.microsoft.com
  • 23.216.77.18
  • 23.216.77.22
  • 23.216.77.6
  • 23.216.77.19
  • 23.216.77.20
  • 23.216.77.41
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 20.190.159.128
  • 40.126.31.3
  • 40.126.31.69
  • 20.190.159.2
  • 20.190.159.130
  • 40.126.31.73
  • 20.190.159.0
  • 20.190.159.131
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
vs_SSMS.exe