vs_installershell.exe
Sources: 300M+ executions observed in the wild.
Summary
Microsoft Visual Studio Installer
vs_installershell.exe is the 3037th most commonly executed Windows program in EchoTrail's dataset, observed 91 times across enterprise environments. It typically runs from C:\Program Files (x86)\Microsoft Visual Studio\Installer and it is most often launched by cmd.exe.
Get this in your tools
The same record for vs_installershell.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/vs_installershell.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
3037th
most commonly executed Windows program
91
observed endpoint executions
Behavior
Top Paths
- C:\Program Files (x86)\Microsoft Visual Studio\Installer100%
Top Hashes (SHA256)
- fc493682e19820992ca359f59f4306ec4f25da576ade9eff4fffa70dc5faac3c57.81%
- 908a525991d09042ea0ee0adb59dfbda1b24d264ec3a1bade0b5cbb4939d732428.12%
- b4361410f88d2e8a053c7aff4cb180c7c017674def4e38100e7dfe44fe49781e14.06%
Process Ancestry
Top Grandparents
- vs_installershell.exe58.14%
- vs_installer.exe23.26%
- runonce.exe4.65%
- devenv.exe2.33%
- explorer.exe2.33%
Top Parents
- cmd.exe48.35%
- vs_installershell.exe36.26%
- vs_installer.exe14.29%
- runonce.exe1.1%
Top Children
- cmd.exe27.85%
- fsutil.exe26.48%
- WMIC.exe21.92%
- vs_installershell.exe15.07%
Ask Rocky about vs_installershell.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for vs_installershell.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.