Trojan.Inject7.3310

Technical Information

Modifies file system

Creates the following files

%TEMP%\dd_<File name>_decompression_log.txt
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\helpfile\1036\help.html
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\helpfile\2052\help.html
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\helpfile\1029\help.html
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\helpfile\1055\help.html
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\helpfile\1045\help.html
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\helpfile\1041\help.html
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\helpfile\1049\help.html
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\helpfile\1040\help.html
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\helpfile\1031\help.html
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\helpfile\1046\help.html
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\helpfile\1033\help.html
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\helpfile\3082\help.html
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\helpfile\1028\help.html
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\helpfile\1042\help.html
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\vs_setup_bootstrapper.exe
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\microsoft.c2rsignaturereader.interop.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\microsoft.c2rsignaturereader.native.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\microsoft.identity.client.broker.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\microsoft.identity.client.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\microsoft.identity.client.extensions.msal.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\microsoft.identity.client.nativeinterop.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\microsoft.identitymodel.abstractions.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\microsoft.visualstudio.remotecontrol.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\microsoft.visualstudio.setup.common.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\microsoft.visualstudio.setup.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\microsoft.visualstudio.setup.download.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\microsoft.visualstudio.telemetry.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\microsoft.visualstudio.utilities.internal.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\runtimes\win-x64\native\msalruntime.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\runtimes\win-arm64\native\msalruntime_arm64.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\runtimes\win-x86\native\msalruntime_x86.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\newtonsoft.json.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\system.memory.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\system.runtime.compilerservices.unsafe.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\vsinstallerelevationservice.contracts.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\zh-hant\vs_setup_bootstrapper.resources.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\it\vs_setup_bootstrapper.resources.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\zh-hans\vs_setup_bootstrapper.resources.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\pt-br\vs_setup_bootstrapper.resources.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\pl\vs_setup_bootstrapper.resources.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\ja\vs_setup_bootstrapper.resources.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\tr\vs_setup_bootstrapper.resources.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\cs\vs_setup_bootstrapper.resources.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\de\vs_setup_bootstrapper.resources.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\ru\vs_setup_bootstrapper.resources.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\es\vs_setup_bootstrapper.resources.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\ko\vs_setup_bootstrapper.resources.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\fr\vs_setup_bootstrapper.resources.dll
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\vs_setup_bootstrapper.config
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\vs_setup_bootstrapper.exe.config
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\detection.json
%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\vs_setup_bootstrapper.json
%TEMP%\dd_bootstrapper_20260915142650.log
%ALLUSERSPROFILE%\microsoft\visualstudio\packages\_bootstrapper\vs_setup_bootstrapper_202609151426540117.json
%ALLUSERSPROFILE%\microsoft devdiv\installation\installationid.txt\
%LOCALAPPDATA%\microsoft\vsapplicationinsights\vstelf3e86b4023cc43f0be495508d51f588a\20260915212733_b71b5e14fcc244aba9ccfa7cfb6f2471.tmp\

Deletes following files that it created itself

%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\c830f1zk\dyntelconfig[2].cache
%LOCALAPPDATA%\microsoft\windows\<INETFILES>\ie\kwz5cx4x\remotesettings_installer[1].cache

Network activity

Connects to

'telemetry.visualstudio.microsoft.com':443
'go.microsoft.com':443
'settings.visualstudio.microsoft.com':443
'ta##########fications-tm.trafficmanager.net':443
'mobile.events.data.microsoft.com':443

TCP

Other

'telemetry.visualstudio.microsoft.com':443
'go.microsoft.com':443
'settings.visualstudio.microsoft.com':443
'ta##########fications-tm.trafficmanager.net':443
'mobile.events.data.microsoft.com':443

UDP

DNS ASK telemetry.visualstudio.microsoft.com
DNS ASK go.microsoft.com
DNS ASK settings.visualstudio.microsoft.com
DNS ASK ta##########fications-tm.trafficmanager.net
DNS ASK mobile.events.data.microsoft.com

Miscellaneous

Creates and executes the following

'%TEMP%\9978598e27304be663b1\vs_bootstrapper_d15\vs_setup_bootstrapper.exe' --env "_SFX_CAB_EXE_PACKAGE:<Full path to file> _SFX_CAB_EXE_ORIGINALWORKINGDIR:<Current directory>"

Executes the following