TurtleUD_patched[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
TurtleUD_patched.exe
Size 12.4MB
Sample261113-qa82lsv15m
SHA256 fe7383404dcffcf312ece3449d59af658962d220f39179d6057d7cb0621d9556
MD5 fe270529b9f101006f448c275e1ec35a
SHA1 b603f1288763b5a5b860a7a872dca59c2b67de34
SHA512 29ba6a4b8f76f68e8119036567c7eb771adf05b9b1f4f447e0e9e17a4a4b3dcbbd2d4d3a1e53bf900ab7bbec19c5ae647bca7e32f3fdc7eabf7da033743b2a9c
SSDEEP 98304:58nIBnrGKXUaugu4eZbMxiuPeDOMGnbMxJ91ITVefNf9jH:5DBFkaulbMxlPIGbMxXaVen
TLSH
T1D6D69E6EF37241E9C836D6BCC2265322F5313C488731B39BA99903515F7B7A0E67A346
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TurtleUD_patched.exe

File Explorer

TurtleUD_patched.exe

.exe 12.4MB

TurtleUD_patched.exe

IMPHASH ebf30feefc570b3e94c0246d9d86452d
SHA256 fe7383404dcffcf312ece3449d59af658962d220f39179d6057d7cb0621d9556
MD5 fe270529b9f101006f448c275e1ec35a
SHA1 b603f1288763b5a5b860a7a872dca59c2b67de34
SHA512 29ba6a4b8f76f68e8119036567c7eb771adf05b9b1f4f447e0e9e17a4a4b3dcbbd2d4d3a1e53bf900ab7bbec19c5ae647bca7e32f3fdc7eabf7da033743b2a9c
SSDEEP 98304:58nIBnrGKXUaugu4eZbMxiuPeDOMGnbMxJ91ITVefNf9jH:5DBFkaulbMxlPIGbMxXaVen
TLSH
T1D6D69E6EF37241E9C836D6BCC2265322F5313C488731B39BA99903515F7B7A0E67A346
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4691980

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDevice D3D11CreateDeviceAndSwapChain

xinput1_4

ord2

shell32

ShellExecuteW SHGetFolderPathA SHGetFolderPathW

advapi32

GetUserNameW RegDeleteValueW RegSetKeyValueW RegCreateKeyW RegGetValueA RegCloseKey RegCreateKeyExW RegSetValueExW RegDeleteTreeW LookupAccountSidW RegOpenKeyExW RegQueryValueExW

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

d3dcompiler_47

D3DCompile

dbghelp

SymSetOptions SymInitialize SymCleanup SymGetModuleInfo64 SymGetModuleBase64 SymSetSearchPath SymLoadModuleEx SymFromName

winhttp

WinHttpQueryOption WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpOpenRequest WinHttpQueryHeaders WinHttpSendRequest WinHttpReceiveResponse

shlwapi

ord12

urlmon

URLDownloadToCacheFileW

kernel32

SetProcessWorkingSetSize SetFilePointerEx GetThreadContext ResetEvent K32GetModuleInformation GetCurrentThread SetEvent CreateEventW SetLastError GetFileSizeEx GetProcessWorkingSetSize InitializeSListHead GetSystemTimeAsFileTime IsDebuggerPresent CreateFileA DeleteFileA FlushFileBuffers ReadFile WriteFile CloseHandle GetModuleFileNameA GetLocalTime Sleep GetCurrentProcessId GetTickCount GetModuleFileNameW GetConsoleWindow WideCharToMultiByte GetModuleHandleA LocalFree MultiByteToWideChar GetCurrentProcess ExitProcess GetProcessHeap CreateFileW GetFileAttributesW GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW DeleteFileW GetTempPathW WaitForSingleObject FreeLibrary SetNamedPipeHandleState PeekNamedPipe LoadLibraryExW GetPrivateProfileIntA GetPrivateProfileStringA WritePrivateProfileStringA GetTickCount64 CreateToolhelp32Snapshot Process32FirstW Process32NextW QueryPerformanceCounter SwitchToThread VirtualAlloc GetCurrentThreadId VirtualFree QueryPerformanceFrequency GlobalMemoryStatusEx GetSystemInfo SetFileAttributesW GetLastError DeviceIoControl MoveFileExW GetFileAttributesA GetFileSize GetSystemDirectoryA K32EnumDeviceDrivers K32GetDeviceDriverBaseNameA SetUnhandledExceptionFilter GlobalAlloc GlobalUnlock GlobalLock GlobalFree VerSetConditionMask LoadLibraryA GetLocaleInfoA IsDBCSLeadByte RaiseException VirtualProtect VirtualQuery LoadLibraryExA AcquireSRWLockShared SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent UnhandledExceptionFilter GetFileInformationByHandleEx CopyFileW AreFileApisANSI SetFileInformationByHandle GetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA WaitNamedPipeW lstrlenW SetFilePointer IsProcessInJob SetConsoleCtrlHandler FindFirstFileA GetUserDefaultLocaleName FindNextFileA GetEnvironmentVariableA RemoveDirectoryA SetThreadPriority ReleaseSRWLockShared GetTimeZoneInformation CreateThread SetThreadpoolTimer CreateThreadpoolTimer MoveFileExA DecodePointer HeapAlloc GetProcAddress HeapFree InitOnceComplete InitOnceBeginInitialize TerminateProcess

user32

GetKeyState DefWindowProcW GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard FindWindowW SendInput GetMonitorInfoW GetCapture MonitorFromPoint GetKeyNameTextA RegisterRawInputDevices GetRawInputData LoadCursorW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW FindWindowExA SetWindowLongPtrA GetWindowLongPtrA ScreenToClient ClientToScreen MessageBoxA SetCursor ShowCursor SetCapture CreateWindowExA DestroyWindow SetWindowRgn DispatchMessageW PeekMessageW PostQuitMessage CallWindowProcA SetLayeredWindowAttributes SetWindowDisplayAffinity IsWindowVisible IsIconic SetFocus ReleaseCapture GetCursorPos GetDesktopWindow GetWindowRect UpdateWindow PeekMessageA DispatchMessageA TranslateMessage IsWindowUnicode GetForegroundWindow DefWindowProcA GetAsyncKeyState GetKeyboardState ToUnicode MapVirtualKeyA GetWindowTextA SetCursorPos SetProcessDPIAware UnregisterClassA SetForegroundWindow GetClientRect MessageBoxW SetWindowPos ShowWindow RegisterClassExA GetSystemMetrics

gdi32

CreateRoundRectRgn

comdlg32

GetOpenFileNameA

ole32

CoInitializeEx

msvcp140

_Cnd_broadcast _Cnd_timedwait _Cnd_wait _Cnd_destroy_in_situ _Cnd_init_in_situ _Cnd_destroy _Cnd_init _Mtx_current_owns _Mtx_destroy_in_situ _Mtx_init_in_situ _Mtx_destroy _Cnd_signal _Thrd_id _Thrd_join _Thrd_start _Query_perf_frequency _Mtx_init ?uncaught_exception@std@@YA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z _Thrd_hardware_concurrency ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ?_Throw_C_error@std@@YAXH@Z _Query_perf_counter ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z _Thrd_detach _Mtx_lock _Mtx_unlock _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??Bios_base@std@@QEBA_NXZ ?rdstate@ios_base@std@@QEBAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??7ios_base@std@@QEBA_NXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?setf@ios_base@std@@QEAAHHH@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?_Random_device@std@@YAIXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Xtime_get_ticks ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

crypt32

CertFreeCertificateChain CertCloseStore CertOpenStore CertVerifyCertificateChainPolicy CertEnumCertificatesInStore CryptEncodeObjectEx CryptUnprotectData CryptProtectData CertGetCertificateChain CertAddEncodedCertificateToStore CertFreeCertificateContext CertCreateCertificateContext

bcrypt

BCryptGenRandom

ws2_32

connect getaddrinfo closesocket WSAStartup recv socket shutdown freeaddrinfo inet_pton send setsockopt WSAGetLastError

gdiplus

GdipBitmapUnlockBits GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdiplusShutdown GdipFree GdiplusStartup GdipAlloc GdipBitmapLockBits GdipCreateBitmapFromStream

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind NtQueryInformationProcess RtlCaptureContext NtUnloadDriver NtLoadDriver RtlInitUnicodeString NtQuerySystemInformation

dinput8

DirectInput8Create

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

vcruntime140

strrchr __C_specific_handler_noexcept _set_se_translator __current_exception_context __current_exception __CxxFrameHandler3 strstr _purecall wcsstr wcsrchr __C_specific_handler memcmp __std_terminate __std_exception_copy __std_exception_destroy _CxxThrowException memcpy memmove memset memchr strchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_errno _beginthreadex _register_thread_local_exe_atexit_callback set_terminate _controlfp_s terminate _invoke_watson abort _c_exit _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argv __p___argc

api-ms-win-crt-string-l1-1-0

wcscpy_s isalnum _wcsicmp wcslen strcmp strncpy_s toupper _stricmp strncmp strlen strncpy tolower

api-ms-win-crt-stdio-l1-1-0

fopen_s __stdio_common_vswprintf fclose __stdio_common_vfprintf __p__commode feof __stdio_common_vswprintf_s __stdio_common_vsprintf __acrt_iob_func __stdio_common_vsnprintf_s fopen setbuf ferror ungetc setvbuf _set_fmode fwrite __stdio_common_vsnwprintf_s _fseeki64 fseek fsetpos fread fputc fgetpos fgetc fflush _get_stream_buffer_pointers __stdio_common_vsprintf_s ftell _wfopen __stdio_common_vsscanf

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc calloc free realloc

api-ms-win-crt-math-l1-1-0

sqrtf fmodf ceilf _dsign powf _fdclass __setusermatherr floorf cosf sinf _dclass ceil log2 pow logf hypot ldexp lroundf _hypotf asin atan2 atan2f fmod sqrt tan tanf log acosf expf

api-ms-win-crt-convert-l1-1-0

strtod strtoll strtol strtoull atof wcstombs strtoul

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s _gmtime64_s _mkgmtime64 strftime

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func localeconv

api-ms-win-crt-filesystem-l1-1-0

remove _lock_file _unlock_file

api-ms-win-crt-utility-l1-1-0

qsort

wintrust

WTHelperGetProvSignerFromChain WinVerifyTrust WTHelperProvDataFromStateData WTHelperGetProvCertFromChain

Name

.text

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.evr_ssc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.9MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.sscx1

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=261, version=33145,

count=1, id=262, version=33145,

count=1, id=263, version=33145,

count=10, id=261, version=35224,

count=49, id=265, version=35229,

count=2, id=259, version=35224,

count=79, id=260, version=35224,

count=9, id=260, version=35207,

count=4, id=259, version=35207,

count=6, id=257, version=35207,

count=5, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=2, id=259, version=33145,

count=2, id=260, version=33145,

count=53, id=261, version=35207,

count=53, id=257, version=33145,

count=753, id=1, productName=Unmarked objects,

count=2, id=260, version=35229,

count=45, id=261, version=35229,

count=1, id=255, version=35229,

count=1, id=151,

count=1, id=258, version=35229,