Rocky Raccoon

sqlservr.exe

by Microsoft
Database

Summary

Microsoft SQL Server - relational database management system engine.

sqlservr.exe is the 1191st most commonly executed Windows program in EchoTrail's dataset, observed 1,368 times across enterprise environments. It typically runs from C:\Program Files\Microsoft SQL Server\110\LocalDB\Binn and it is most often launched by Veeam.EndPoint.Service.exe.

1191st
most commonly executed Windows program
1,368
observed executions
low
statistical confidence

Behavior

Top Paths

  • C:\Program Files\Microsoft SQL Server\110\LocalDB\Binn55.26%
  • C:\Program Files\Microsoft SQL Server\MSSQL11.VEEAMSQL2012\MSSQL\Binn9.5%
  • C:\Program Files (x86)\Microsoft SQL Server\MSSQL12.AIMETIS\MSSQL\Binn8.04%
  • C:\Program Files (x86)\SolarWinds\Orion\SQLExpress\MSSQL10_50.SOLARWINDS_ORION\MSSQL\Binn5.92%
  • C:\Program Files\Microsoft SQL Server\MSSQL14.SQLEXPRESS\MSSQL\Binn5.04%
  • C:\Program Files\Microsoft SQL Server\150\LocalDB\Binn2.34%
  • C:\Program Files (x86)\Microsoft SQL Server\MSSQL12.KAV_CS_ADMIN_KIT\MSSQL\Binn2.27%
  • D:\Program Files\Microsoft SQL Server\MSSQL16.MSSQLSERVER\MSSQL\Binn2.05%
  • D:\Program Files\Microsoft SQL Server\MSSQL15.MSSQLSERVER\MSSQL\Binn1.9%
  • C:\Windows\WID\Binn1.46%

Top Hashes (SHA256)

  • ea6a70a48966537d8fb4e7b4d847786e309969c7e6e277d1568f086d3166776c37.42%
  • b6b396eb42c19a3c1980134d9b0246208eaca8935a24ef318719e93746aadf9c16.93%
  • ebe4bda8e39d7f59426e540190a78cfc054d0953943d27dd8764090d105bbacc10.62%
  • cec1a83f02d09775ba4fcd7c59677ccec7983185c0f3ff93c0841953bfa04e4d7.72%
  • e9a8a4c654e6bb35656b68b08e68c9972cc78b6b4e09851742702cf9820f880a5.2%
  • 2d513310a1d923d556dd90858f77123386257a99d9961283a6b020dddb518f513.19%
  • 6d228b21d55221b87c8e13e3c86e0c0c81a7c84637d9de10103498153775bf3c2.97%
  • fd35b5a5714265738df70e5f38bcb090d4400cb561ac3d224b2549cad2fe52c62.15%
  • 14bc9208de6af5110ecf710ea6d2731e3a71ff6229af8d8bd4dfe1339a21a5c82%
  • 7c1a5f47001745db6f8731677f6499d26b7af3b883cb7d0c9ed37a2e946fb85f1.93%

Process Ancestry

Top Grandparents

Top Parents

Top Children

Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.

Ask Rocky about sqlservr.exe

Rocky answers questions about sqlservr.exe grounded in this same dataset — free, no account needed.

Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.

Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.