13112026_0349_12112026_点击安装简体中文语言包n-rywulq-Wav64.exe.zip
- SHA256 e81f0e867fcfc1281a4ffcda4be8e28d11545bd79e9bbb3b13a3c53873174ab3
Password
infected
Overview
overview
7Static
static
3点击安�...��.msi
windows10-2004-x64
7点击安�...��.msi
windows11-ltsc_2024-x64
7点击安�...4c.lnk
windows10-2004-x64
7点击安�...4c.lnk
windows11-ltsc_2024-x64
3点击安�...64.dll
windows10-2004-x64
1点击安�...64.dll
windows11-ltsc_2024-x64
1点击安�...64.exe
windows10-2004-x64
1点击安�...64.exe
windows11-ltsc_2024-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
点击安装简体中文包.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
300 seconds
Behavioral task
behavioral2
Sample
点击安装简体中文包.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
17 signatures
300 seconds
Behavioral task
behavioral3
Sample
点击安装简体中文语言包n/X64c.lnk
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
300 seconds
Behavioral task
behavioral4
Sample
点击安装简体中文语言包n/X64c.lnk
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
300 seconds
Behavioral task
behavioral5
Sample
点击安装简体中文语言包n/rywulq/MaxxAudioAPOShell64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral6
Sample
点击安装简体中文语言包n/rywulq/MaxxAudioAPOShell64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
Behavioral task
behavioral7
Sample
点击安装简体中文语言包n/rywulq/Wav64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral8
Sample
点击安装简体中文语言包n/rywulq/Wav64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
General
- Target 13112026_0349_12112026_点击安装简体中文语言包n-rywulq-Wav64.exe.zip
- Size 3.3MB
- Sample261113-edd5vsft3t
- SHA256 e81f0e867fcfc1281a4ffcda4be8e28d11545bd79e9bbb3b13a3c53873174ab3
- MD5 6c3734616a4d8844c709cb26979a2130
- SHA1 2901a88d43e55b7ed1f242bb6cde223217fda408
- SHA512 b6a3f201a0d5b7fadedef708fc1624e45c180ed5553cce2afc1c6240504c01886868809054c7970d9f93050471927bc8fe183259470c9b0c6882cb9980d541e1
- SSDEEP 49152:oE4E3CDGEGxwf+vURq/MoJXZ5+xeLQjJW7RJkoNHQntL+U4WKeF1IEAJG46:oIwGVmRq/ZJJUx0QjJqRJkoNwB+Krp
- TLSH T136F5335A7B4C432848888AB3E59ED50C5731AFE56CC8CD1E7A780FA63DC6465C878C7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned MSI 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/点击安装简体中文包.msi - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/点击安装简体中文语言包n/rywulq/MaxxAudioAPOShell64.dll unpack001/点击安装简体中文语言包n/rywulq/Wav64.exe
File Explorer
-
13112026_0349_12112026_点击安装简体中文语言包n-rywulq-Wav64.exe.zip.zip 3.3MB
-
点击安装简体中文包.msi.msi 2.5MB
-
点击安装简体中文语言包n/X64c.lnk.lnk 2KB
-
点击安装简体中文语言包n/rywulq/0rz57ixm.cache487KB
-
点击安装简体中文语言包n/rywulq/MaxxAudioAPOShell64.dll.dll 115KB
-
点击安装简体中文语言包n/rywulq/Wav64.exe.exe 1.2MB
点击安装简体中文包.msi
- SHA256 8079500fc6eeefa5cbbaf5a4d1933605a8091faf56189b0836ec48ae9637d096
- MD5 1a348cccdbc465e32a1b573a15991014
- SHA1 e1fc52a224ddaaca24dd177109aff613639453ed
- SHA512 b13e8f265c4c0625a62e0f9a344686adf19dc53302b2db3b9e0f926075a1d7fcec1a577c977382ef4f0b9ae0f72e3f9c403de38cb09cbded9117eec96a6ab816
- SSDEEP 49152:V4wKi/qIG0TYbBOpjjuoDgZ1gPcj3Z77lSK7Fbm:uaqRipjjHDk16cj317lSKZa
- TLSH T1A2C5336BFCC9CB15C58E5EB2848AD72D9234ADC0AD48CD0A377C7A723D2723545E899C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned MSI
Checks for missing Authenticode signature.
点击安装简体中文语言包n/X64c.lnk
- SHA256 653fc69d7d8cee458479e4e083e59c022d45d3ccfde817be07f9e93ac48cde2a
- MD5 3ed399c3105749d8c2fb3df5a23335ac
- SHA1 13c94844301ffb91537530749cb812234530b01f
- SHA512 82abcd1d6bb89bcc2eac2dc169731301b92c41f81773d40e4eeaaa0f782fb5caee402571f28f28fc7f4bf9ab2b3b5ed38693910ed8db03e4fcbf14fbfe538ae2
- TLSH T14151E0252AD74607E7FB5AF67FB5A010E277F48A2F04C94F4189440C6833528D964F1B
- MD5 SHA1 SHA512 TLSH
点击安装简体中文语言包n/rywulq/0rz57ixm.cache
- SHA256 d32b99bda436f010ae4a34f71402f64607b9d1fe3a8376db1a8dc143249c6a50
- MD5 50574b91bdeb88499d077aaaaa31d508
- SHA1 f859e4d93f1b9e06a5f2a589c7a6a42fd38772d8
- SHA512 29a61ae3861a6f9cfc16fa81d26fcf0c35acb407b3b88ae42d2f80aede4a12db9b14ce4a03cd65e8224a2b4d1ad4fcb107a2b618aecf4454742a7f5b6cee4332
- SSDEEP 12288:nq2eJzUe1DnsimLgWUwNYwju/+u103zbOCj0L7+SYMXw:nKtDnsi7W7U/4jW+yXw
- TLSH T18CB42315C76E04FD39414AE767BEE05A26F26F5011CCB7236DE12FEEBBC4A40EA52460
- MD5 SHA1 SHA512 SSDEEP TLSH
点击安装简体中文语言包n/rywulq/MaxxAudioAPOShell64.dll
- IMPHASH 27a4f7a39cad20a917cc244d138508d1
- SHA256 bc6e4bcabd7a8f933a010ddbf127ba6af980d28648597d374f882c5fa2b9ec55
- MD5 37155db635782c526bf25be7fce2f57c
- SHA1 ebdb233841bbc82d56b0e92157f93a9b0bfef4aa
- SHA512 ad279d353a876b445543208864d6960db1c69862c19b2341e0396ccf34569cb829dbd3ee057ba9e8bcd1d4080912407db72353c6b1259816387007c46a4ef476
- SSDEEP 3072:RFIu8EmrRYSBGyMW32lf/bw8Ad3tqWJAhOJm:LzeYMas2lfzu/BU
- TLSH T13BB35C5772EA00FBE5A38239C8635A06E776B85247619FEF03A4475A1F133D05D3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
14580
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetEnvironmentVariableA
SetEnvironmentVariableA
ExpandEnvironmentStringsA
CreateFileA
FindClose
FindFirstFileA
FindNextFileA
GetFileSize
ReadFile
GetVolumeInformationA
CloseHandle
GetLastError
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
CreateMutexA
CreateEventW
Sleep
GetCurrentProcess
GetCurrentProcessId
ExitProcess
CreateThread
FlushInstructionCache
GlobalMemoryStatusEx
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetSystemDirectoryA
GetWindowsDirectoryA
VirtualAlloc
VirtualProtect
VirtualFree
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleA
GetModuleHandleW
GetProcAddress
lstrcmpiA
lstrcpynA
GetCurrentThreadId
GetACP
GetOEMCP
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
WriteConsoleW
RtlUnwindEx
InterlockedFlushSList
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
TerminateProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW
WavesFX_GetParameter
WavesFX_GetProperty
WavesFX_GetRuntimeData_Value
WavesFX_Initialize
WavesFX_Preset_GetActive
WavesFX_Preset_GetCount
WavesFX_Preset_GetParameter
WavesFX_Preset_GetSoundMode
WavesFX_Preset_GetType
WavesFX_Preset_RevertToDefault
WavesFX_Preset_SetActive
WavesFX_Preset_SetActive2
WavesFX_Preset_SetParameter
WavesFX_Preset_SetSoundMode
WavesFX_Preset_SetType
WavesFX_Preset_SetTypeEx
WavesFX_RegisterChangeNotification
WavesFX_SetDoubleBufferingMode
WavesFX_SetParametersArray
WavesFX_SetRuntimeData_Value
WavesFX_Uninitialize
Name
.text
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
43KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=137, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=3, id=257, version=33145,
count=120, id=1, productName=Unmarked objects,
count=9, id=259, version=35207,
count=14, id=260, version=35207,
count=32, id=261, version=35207,
count=2, id=261, version=35222,
count=1, id=256, version=35222,
count=1, id=258, version=35222,
点击安装简体中文语言包n/rywulq/Wav64.exe
- IMPHASH 107665f6e84fb8b2c3cc44cd3818d544
- SHA256 165c979d3ef0ffdd9b4d03ee53fb97071c93db4e586c21a8371558307e940456
- MD5 79003b577d58661e9d81abc93046bed8
- SHA1 fd864d6e1350d8fbaf51e9d78a583dff7885c50e
- SHA512 1ff73310268012ba3ad95ac3d26be0ae2c2372d51ea4568a45b27e8ee0aa3bb492ab301ef5ecf0dc4fa29b467943438d2a44ded8c1bf732219a8b64510099c12
- SSDEEP 12288:Cg7NyYi+Q5Ai6iMxeAoRizJGJECJHlWRhuYku5IN9n47G5+wQ:tNtVi6nxea1kZJFWRcYxIlyG5tQ
- TLSH T110455B5A766080E0F166C33AC5728AA7F7727C211BE197DB15A0B35A5F376E40E39332
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
243424
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
s:\p4client\Consumer\MainRel3\Products\Release\x64\WavesSvc64.pdb
setupapi
SetupDiGetClassDevsA
CM_Get_DevNode_Status_Ex
SetupDiGetDeviceInstanceIdA
SetupDiEnumDeviceInfo
SetupDiEnumDeviceInterfaces
CM_Get_Device_IDA
SetupDiGetDeviceInterfaceDetailA
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
CM_Get_Parent
avrt
AvRevertMmThreadCharacteristics
AvSetMmThreadCharacteristicsA
powrprof
PowerGetActiveScheme
PowerReadDCValue
kernel32
SizeofResource
LockResource
FindResourceExW
LoadResource
FindResourceW
GetTempPathW
DeleteFileA
GetTempFileNameW
GetModuleHandleA
lstrlenA
QueryPerformanceFrequency
QueryPerformanceCounter
UnmapViewOfFile
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
LocalFree
FormatMessageA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
FreeLibrary
SetWaitableTimer
SetLastError
EnterCriticalSection
LeaveCriticalSection
CreateMutexA
GetCurrentThreadId
ReleaseMutex
ProcessIdToSessionId
Sleep
GetTickCount64
CreateWaitableTimerA
GetCurrentProcessId
CreateProcessA
GetCurrentProcess
DeviceIoControl
CreateFileA
WaitForSingleObjectEx
Process32First
TerminateProcess
CreateToolhelp32Snapshot
Process32Next
WTSGetActiveConsoleSessionId
GetExitCodeProcess
GetCurrentThread
GetThreadPriority
GetSystemPowerStatus
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
GetConsoleCP
ResetEvent
LCMapStringW
GetConsoleMode
SetFilePointerEx
GetStringTypeW
GetFileType
GetACP
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
GetCommandLineW
GetCommandLineA
RtlUnwindEx
RtlPcToFileHeader
LoadLibraryW
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
ReleaseSemaphore
DuplicateHandle
VirtualProtect
GetVersionExW
LoadLibraryExW
GetModuleFileNameW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SetThreadPriority
SwitchToThread
SignalObjectAndWait
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
GetTickCount
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
InitializeCriticalSectionAndSpinCount
WaitForMultipleObjects
CreateThread
SetEvent
WaitForSingleObject
CreateEventA
CloseHandle
QueryFullProcessImageNameA
K32GetModuleFileNameExA
OpenProcess
K32EnumProcessModulesEx
OutputDebugStringA
WideCharToMultiByte
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
MultiByteToWideChar
HeapSize
InitializeCriticalSectionEx
HeapFree
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
WriteConsoleW
CreateFileW
TryEnterCriticalSection
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
user32
LoadImageA
SetWindowPos
FillRect
ShowWindow
DrawTextA
SetWindowLongA
SetCursor
InvalidateRect
RegisterWindowMessageA
LoadCursorA
IsWindow
MsgWaitForMultipleObjectsEx
FindWindowExA
ChangeWindowMessageFilterEx
PeekMessageA
RegisterClassExA
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
GetMessageA
DispatchMessageA
CallNextHookEx
PostThreadMessageA
SetWindowsHookExA
UnhookWindowsHookEx
TranslateMessage
EndDialog
GetWindowTextA
GetWindowLongA
GetClassInfoA
SendMessageA
CreateDialogParamA
GetDlgItem
LoadMenuA
DestroyWindow
TrackPopupMenu
GetSubMenu
RegisterClassA
DestroyMenu
CreateWindowExA
LoadIconA
SetForegroundWindow
GetCursorPos
CharUpperA
SetTimer
CallWindowProcA
DefWindowProcA
GetWindowLongPtrA
KillTimer
SetWindowLongPtrA
PostMessageA
UnregisterClassA
GetClassInfoExA
gdi32
SelectObject
CreateCompatibleDC
StretchBlt
DeleteDC
SetTextColor
SetBkMode
DeleteObject
CreateSolidBrush
GetObjectA
GetDIBColorTable
advapi32
CreateProcessAsUserA
RegDeleteKeyA
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegNotifyChangeKeyValue
RegCloseKey
InitializeSecurityDescriptor
shell32
SHGetFolderPathA
ShellExecuteExA
SHGetSpecialFolderPathA
Shell_NotifyIconA
ole32
StringFromCLSID
PropVariantClear
CoTaskMemFree
CoCreateInstance
CoFreeUnusedLibrariesEx
CoUninitialize
CoInitialize
oleaut32
SysFreeString
maxxaudioaposhell64
WavesFX_RegisterChangeNotification
WavesFX_SetParametersArray
WavesFX_GetRuntimeData_Value
WavesFX_Preset_SetParameter
WavesFX_GetParameter
WavesFX_Preset_RevertToDefault
WavesFX_SetRuntimeData_Value
WavesFX_Preset_GetType
WavesFX_Preset_SetTypeEx
WavesFX_Preset_GetActive
WavesFX_Preset_GetCount
WavesFX_Preset_GetParameter
WavesFX_Preset_SetActive
WavesFX_SetDoubleBufferingMode
WavesFX_Initialize
WavesFX_Uninitialize
WavesFX_Preset_SetType
WavesFX_GetProperty
WavesFX_Preset_SetSoundMode
WavesFX_Preset_SetActive2
WavesFX_Preset_GetSoundMode
shlwapi
PathFileExistsA
wtsapi32
WTSQueryUserToken
gdiplus
GdiplusShutdown
msimg32
TransparentBlt
AlphaBlend
Name
.text
Size
464KB
Virtual Size
464KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
RT_CODE
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
161KB
Virtual Size
161KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
490KB
Virtual Size
490KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=241, version=40116,
count=153, id=243, version=40116,
count=18, id=242, version=40116,
count=2, id=209, version=65501,
count=1, id=208, version=65501,
count=1, id=199, version=41118,
count=8, id=259, version=24123,
count=22, id=260, version=24123,
count=3, id=261, version=23013,
count=2, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=207, version=65501,
count=4, id=206, version=65501,
count=29, id=203, version=65501,
count=350, id=1, productName=Unmarked objects,
count=108, id=261, version=24123,
count=44, id=265, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,