Archive 2.zip
- SHA256 b3ac499b5e1ae1ff06007a3dfcc5c2f4fccabacb644a9f5e282cb47c42da16d4
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
agent.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
agent.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
pcyyb_sdk_dll.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
pcyyb_sdk_dll.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target Archive 2.zip
- Size 749KB
- Sample261107-r8fcmafb88
- SHA256 b3ac499b5e1ae1ff06007a3dfcc5c2f4fccabacb644a9f5e282cb47c42da16d4
- MD5 83deef300b02ff16586d01123667f810
- SHA1 26c0e037dff65ae7824d52dd1cb27c2d0d1f00a6
- SHA512 fc68df2080a45afa183310b3dc786712ffd4952af04b3558821f15135be278617feb080d4ae34499ed86972754fd461cd85f4fb4f50c1619cb0eb97b7d393c36
- SSDEEP 12288:ptW2xSynH2xnE2z/neMjRgL5ndk6P2vUzPqSDben7VLUCQN+afjeBMlvBMwYY1/6:LEbnFz/neMVI5+6+vMYVAFN7SBMHMwZg
- TLSH T1E4F423728206E7F2403D10FF736C931FB6526DF55FCA352561266B088EB69CF83A4A91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/pcyyb_sdk_dll.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/pcyyb_sdk_dll.dll
File Explorer
-
Archive 2.zip.zip 749KB
-
__MACOSX/._agent.exe505B
-
__MACOSX/._pcyyb_sdk_dll.dll503B
-
agent.exe.exe 1.3MB
-
pcyyb_sdk_dll.dll.dll 518KB
__MACOSX/._agent.exe
- SHA256 6d37c13c077a5c1318f2ab97918ee4318a39d87536948679895b5f4738fef910
- MD5 fa1429cd5e8a39fa36409ba51d08a374
- SHA1 983d17a96617c153ec6f1a3bb52e04e52b9cc090
- SHA512 408bf8a4ee90e323faa5ef781b17b112070b673ff779fe2933fb974b0cab16c6f9ae320b8e5dda2cbe59cc79804e302fb8b016f050b446da665fe8d3d55fd2d1
- TLSH T195F061AC57C06970C455C5FF14F3EB9257E5147EC5CA021379458D864E00E40AF763CE
- MD5 SHA1 SHA512 TLSH
__MACOSX/._pcyyb_sdk_dll.dll
- SHA256 bdf6c6b5996fdef73c6aee599cea3e003379a8341b9b0647f5e09373bd224ba6
- MD5 64ec1c0c6f12fd30c7d574a7763b7b4b
- SHA1 e86d51844db904fa60d058f8df4e1b34159b7768
- SHA512 5160764d1f31086348bf96cec7e790b62d79e297b410b3606a6bcec6f2ddf436d33da1aef68bee88d5adc8381daa8b8eee973353734ede8886f3a10ad7e4503d
- TLSH T1FAF02BA917D08A30E829C6BA44B3EB506795707DC14A010B7A158C450B049806F7278A
- MD5 SHA1 SHA512 TLSH
agent.exe
- IMPHASH 7f29df0debf84d21e535b27580063eb3
- SHA256 e4f583412f4e68f2c6491b6e3f23e5ddb4ea3e7c40afd6c52c78c47a39bd78ee
- MD5 dd34adbe7df9a34a1ae56f1bb846c34f
- SHA1 aba18d72812c539ee0ec02aadfe641482f8c8dc0
- SHA512 ae8090b95cd7e1f62de4385f58dae50d06a6235260741310b72592a7b30d3a8bbc371cf78e178e89c98b4afe942bd08556644c48afa70eb8727be2f91f77a33c
- SSDEEP 24576:LlUjo276h8RsyxhBe9UMiyv1dHf5Rbcz6QaLSS:Cjo276hByxDeWU1Vf5R4+jGS
- TLSH T174556D5AB3A402E4D5FE9278ED924942E731B0970B3497CB16D563261F236F19FBF220
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a7:b2:1f:c1:74:76:c8:07:50:18:04:cd:e6:6c:6c:62:5b:6d:f4:3f:c5:89:f2:d2:e2:73:62:27:e1:f3:82:d1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=9144030071526726XG,CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13124775616e67646f6e672050726f76696e6365,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Chains
Jan 6, 2026
SERIALNUMBER=9144030071526726XG,CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13124775616e67646f6e672050726f76696e6365,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=9144030071526726XG,CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13124775616e67646f6e672050726f76696e6365,1.3.6.1.4.1.311.60.2.1.3=#1302434e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=9144030071526726XG,CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13124775616e67646f6e672050726f76696e6365,1.3.6.1.4.1.311.60.2.1.3=#1302434e
Serial Number
08:f8:76:21:c4:e4:87:98:2a:1e:54:2c:9a:07:1c:30
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Nov 6, 2025 - Nov 4, 2028
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
437340
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\workplace\msstore_sdk\p-3fb245b66c3440bd8fdc8cd3ee4d50fa\164\obj\vs2022v142x64-release\bin\Release\Tencent.AndrowsExtensionForMSOW.pdb
pcyyb_sdk_dll
Initialize
Uninitialize
ReportFromUTF8KeyValueJson
Log
InitBugly
LaunchApplet
UpdateApp
RegisterAppLaunchStateHandler
GetAppsInstallState
GetInstalledAppInfos
OpenSettings
RequestWxAppletLogin
RequestWxAppletLogout
LaunchApp
Stop
Resume
Pause
UninstallApp
IsAppInstalled
OpenDeviceCheck
CheckEnvironmentDetail
GetVirtualEngineType
CheckPcyyb
CheckWxAppletLogin
CheckEnvironment
RegisterStateChangeHandler
CheckEngine
RegisterWxAppletLoginStateHandler
GenerateFromSourceForApplet
RegisterEventChangeHandler
QueryAppUpdate
GenerateFromSourceForApp
kernel32
RtlUnwind
WriteConsoleW
HeapSize
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FormatMessageW
GetCurrentThreadId
GetProcessHeap
HeapAlloc
GetModuleHandleW
TlsSetValue
HeapFree
GetModuleHandleExW
GetModuleFileNameA
DebugBreak
WideCharToMultiByte
IsDebuggerPresent
OutputDebugStringW
GetLastError
SetLastError
CloseHandle
ReleaseSemaphore
ReleaseMutex
WaitForSingleObjectEx
WaitForSingleObject
OpenSemaphoreW
TlsFree
FreeLibrary
LoadLibraryExW
FlushFileBuffers
GetCurrentProcessId
CreateMutexExW
CreateSemaphoreExW
SetEvent
GetFileSizeEx
HeapReAlloc
ExitProcess
LoadLibraryW
GetFileType
LocalFree
CreateEventExW
OutputDebugStringA
TrySubmitThreadpoolCallback
GetProcAddress
K32GetModuleFileNameExW
GetModuleFileNameW
TlsGetValue
WriteFile
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ResetEvent
CreateEventW
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
RtlPcToFileHeader
RaiseException
QueryPerformanceFrequency
Sleep
SwitchToThread
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
TryEnterCriticalSection
TlsAlloc
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
GetFileInformationByHandleEx
MultiByteToWideChar
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
LCMapStringEx
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer
GetStringTypeW
RtlUnwindEx
InterlockedPushEntrySList
GetStdHandle
advapi32
RegCreateKeyExW
MakeAbsoluteSD
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetKeyValueW
shell32
SHGetFolderPathW
ole32
CoTaskMemFree
CoTaskMemAlloc
CoRegisterClassObject
CoRevokeClassObject
CoInitializeSecurity
CoWaitForMultipleObjects
CoGetObjectContext
CoInitializeEx
CoGetApartmentType
CoCreateInstance
CoCreateFreeThreadedMarshaler
oleaut32
SysAllocString
GetErrorInfo
SysStringLen
SetErrorInfo
SysFreeString
Name
.text
Size
763KB
Virtual Size
763KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
283KB
Virtual Size
283KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
195KB
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=176, id=261, version=27412,
count=94, id=261, version=30034,
count=17, id=260, version=30034,
count=10, id=259, version=30034,
count=21, id=260, version=27412,
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=30154,
count=227, id=1, productName=Unmarked objects,
count=12, id=265, version=30154,
count=1, id=255, version=30154,
count=1, id=151,
count=1, id=258, version=30154,
pcyyb_sdk_dll.dll
- IMPHASH c93cdd041b977f8a90f261ed2aaeb53f
- SHA256 d943c65e9112f379f0158600f4ee25fa0a1538722d2bbd09fb60b92b2162956a
- MD5 b16ad5bbb3dcc0c66bff83ef4a1ad751
- SHA1 48e33cf1e2893b0a881541f1b73326a353c8ea82
- SHA512 164806faea3c81e73c25fdfd21c279ff425ed4cf9525e7112d4cb8d39e95b78771f6094dc52db7ee656cb695e744f13f35c39b0a2aca40e8493c65e9cc78abf6
- SSDEEP 6144:keAeA+IGNu5rVQbokTQmnwO7djgRhct6FGUZSM4bI0KGarTK4ssXJyx601ti0eUn:vLIGNSSsMQERAZS/TqHEi0Dsg+Njd+
- TLSH T135B46C13E75942B8E06AC07483579637AA72B8C94B31B9EF03D456322F19FE1673DB18
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
340016
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
pcyyb_sdk_dll.pdb
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WaitOnAddress
WakeByAddressSingle
bcryptprimitives
ProcessPrng
bcrypt
BCryptGenRandom
advapi32
SystemFunction036
kernel32
WriteFile
FlushFileBuffers
SetFilePointerEx
GetTempPathW
CloseHandle
GetProcessId
GetSystemTimePreciseAsFileTime
SetErrorMode
WriteFileEx
SleepEx
GetLastError
GetCurrentProcessId
SwitchToThread
GetProcessHeap
HeapFree
HeapReAlloc
GetCurrentThreadId
SetLastError
GetCurrentDirectoryW
RtlCaptureContext
GetCurrentProcess
RtlLookupFunctionEntry
WaitForSingleObjectEx
LoadLibraryA
GetProcAddress
lstrlenW
CreateMutexA
ReleaseMutex
WideCharToMultiByte
RtlVirtualUnwind
GetStdHandle
GetConsoleMode
GetConsoleOutputCP
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
HeapAlloc
GetEnvironmentVariableW
ReadFileEx
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
QueryPerformanceCounter
CreateThread
GetCurrentThread
SetThreadStackGuarantee
GetModuleHandleA
GetFullPathNameW
ExitProcess
TerminateProcess
GetExitCodeProcess
CompareStringOrdinal
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
GetModuleFileNameW
DuplicateHandle
CreateFileW
CreateWaitableTimerExW
SetWaitableTimer
Sleep
SetStdHandle
HeapSize
GetStringTypeW
GetFileType
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
RtlUnwindEx
InterlockedFlushSList
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EncodePointer
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
RtlPcToFileHeader
FreeLibrary
GetModuleHandleExW
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
VirtualProtect
LoadLibraryExW
LCMapStringW
ntdll
NtCreateNamedPipeFile
NtOpenFile
RtlNtStatusToDosError
NtWriteFile
CheckEngine
CheckEnvironment
CheckEnvironmentDetail
CheckPcyyb
CheckWxAppletLogin
DllMain
GenerateFromSourceForApp
GenerateFromSourceForApplet
GetAppsInstallState
GetInstalledAppInfos
GetVirtualEngineType
InitBugly
Initialize
IsAppInstalled
LaunchApp
LaunchApplet
Log
OpenDeviceCheck
OpenSettings
Pause
QueryAppUpdate
RegisterAppLaunchStateHandler
RegisterEventChangeHandler
RegisterStateChangeHandler
RegisterWxAppletLoginStateHandler
ReportFromUTF8KeyValueJson
RequestWxAppletLogin
RequestWxAppletLogout
Resume
Stop
Uninitialize
UninstallApp
UpdateApp
Name
.text
Size
386KB
Virtual Size
385KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
109KB
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=137, id=261, version=33145,
count=12, id=260, version=33145,
count=7, id=259, version=33145,
count=9, id=259, version=35721,
count=14, id=260, version=35721,
count=32, id=261, version=35721,
count=9, id=257, version=33145,
count=128, id=1, productName=Unmarked objects,
count=7, productName=Unmarked objects (old),
count=1, id=256, version=36252,
count=1, id=258, version=36252,