Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

eRSSetup.exe

Status: finished
Submission Time: 2020-08-07 17:56:18 +02:00
Suspicious
Trojan
Evader

Comments

Tags

Details

  • Analysis ID:
    259969
  • API (Web) ID:
    415440
  • Analysis Started:
    2020-08-07 17:56:19 +02:00
  • Analysis Finished:
    2020-08-07 18:25:10 +02:00
  • MD5:
    45e1bf45a601cf1264d7306110a41291
  • SHA1:
    19e7132f9359b5cc2fdfc488e2cdd443c2ec0ff3
  • SHA256:
    5dde5c472d25f299d3442340348db5b08fbc611a9a9e50e3dec33e888f1ff5c6
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
Full Report Management Report IOC Report
suspicious
Score: 30
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Full Report Management Report IOC Report
suspicious
Score: 30
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run Condition: Cmdline fuzzy

Domains

Name IP Detection
24.107.12.0.in-addr.arpa
 0.0.0.0
asf-ris-prod-neurope.northeurope.cloudapp.azure.com
 168.63.67.155
ers.eclinicalweb.com
 0.0.0.0

URLs

Name Detection
https://ers.eclinicalweb.com/oneclicksupport/register
https://dev.ditu.live.com/mapcontrol/logging.ashx
http://www.realvnc.com/
Click to see the 97 hidden entries
https://ers.eclinicalweb.com:443/oneclicksupport/ftpDetails.do
https://ers.eclinicalweb.com/oneclicksupport/ClientInfo.do?requestType=
https://ers.eclinicalweb.com/oneclicksupport/ClientInfo.do?requestType=version
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
http://s3.amazonaws.com/S3_ListBucketsS3_DownloadBytesnumCharsnumContentBytesS3_DownloadStringPARAMS
http://eclinicalworks.com/ers
http://www.cknotes.com/?p=282
http://www.horizonlive.com/
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
https://dev.virtualearth.net/REST/v1/Routes/Driving
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
https://ers.eclinicalweb.com/oneclicksupport/ssorequest
https://ers.eclinicalweb.com/oneclicksupport/jsp/portal/preinstallcheck.jsp?version=3.0.0.2Sa
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
https://ers.eclinicalweb.com/oneclicksupport/practicejobservice
http://www.cknotes.com/?p=370
https://dev.virtualearth.net/REST/v1/Routes/Transit
https://ers.eclinicalweb.com:443/oneclicksupport/ersticketurl
http://www.cknotes.com/?p=411
https://erstest.eclinicalweb.com/oneclicksupport/DownloadFileServlet.do
https://ers.eclinicalweb.com:443/oneclicksupport/singlesignon
http://10.211.38.34:8080d
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
http://us.rd.yahoo.com/http://us.ard.yahoo.com/No
http://us.rd.yahoo.com/
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
http://BUCKET.s3.amazonaws.com/OBJECTContent-MD5Authorization.s3.amazonaws.comAWS
http://ocsp.thawte.com0
http://eclinicalworks.com/ersT
https://dev.ditu.live.com/REST/v1/Transit/Stops/
http://spamarrest.com/a
http://BUCKET.s3.amazonaws.com/
http://www.eclinicalworks.com
http://spamarrest.com/ahttp://www.mailpass.com/verify.cgiYour
http://172.25.11.205:8080/eManager/jsp/integrations/createNewTicketFromERS.jsp
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
https://ers.eclinicalweb.com:443/oneclicksupport/directConnect.do
http://www.chilkatsoft.com/ChilkatHttpUA.asp)
https://ers.eclinicalweb.com:443/oneclicksupport/register
https://ers.eclinicalweb.com/oneclicksupport/jsp/portal/preinstallcheck.jsp?version=3.0.0.2o9
https://ers.eclinicalweb.com/oneclicksupport/ersfetchjobs
http://cs-g2-crl.thawte.com/ThawteCSG2.crl0
http://10.211.38.34:8080--
https://ers.eclinicalweb.com/oneclicksupport/systemsnapshot
http://crl.thawte.com/ThawtePremiumServerCA.crl0
https://appexmapsappupdate.blob.core.windows.net
https://ers.eclinicalweb.com:443/oneclicksupport/ClientInfo.do?requestType=
http://BUCKET.s3.amazonaws.com/S3_CreateBucketS3_DeleteBucketSetRequestHeaderRemoveRequestHeaderDown
http://www.bitvise.com/
https://ers.eclinicalweb.com/oneclicksupport/ersjobstatus
http://www.chilkatsoft.com/p/p_463.asp)
https://dev.virtualearth.net/REST/v1/Transit/Schedules/
https://ers.eclinicalweb.com:443/oneclicksupport/jsp/portal/preinstallcheck.jsp
http://www.chilkatsoft.com/p/p_463.asp)ConvertedToNumBytesCharsetNumCharsInCharacter
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
http://www.chilkatsoft.com/p/p_172.asp
https://ers.eclinicalweb.com/oneclicksupport/ftpDetails.do
http://www.cknotes.com/?p=91
https://ers.eclinicalweb.com:443/oneclicksupport/ersfetchjobs
http://www.eclinicalworks.com/.
https://ers.eclinicalweb.com:443/oneclicksupport/systemsnapshot
http://www.chilkatsoft.com/)
https://dev.virtualearth.net/REST/v1/Routes/Walking
http://s3.amazonaws.com/
https://t0.tiles.ditu.live.com/tiles/gen
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
http://www.tightvnc.com/
https://dev.ditu.live.com/REST/v1/Routes/
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
http://www.chilkatsoft.com/p/p_172.aspWSAEWOULDBLOCK
https://ers.eclinicalweb.com/oneclicksupport/directConnect.do
https://dynamic.t
http://www.eclinicalworks.com/
https://ers.eclinicalweb.com:443/oneclicksupport/jsp/portal/preinstallcheck.jsp?version=3.0.0.2(
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
https://www.thawte.com/cps0
https://dev.virtualearth.net/REST/v1/Locations
https://BUCKET.s3.amazonaws.com/PARAMS
http://us.ard.yahoo.com/
https://ersapp.eclinicalweb.com
http://www.chilkatsoft.com/rssComponent.html
https://ers.eclinicalweb.com:443/oneclicksupport/ersjobstatus
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
https://ers.eclinicalweb.com:443/oneclicksupport/jsp/portal/preinstallcheck.jsp?version=3.0.0.2
https://dev.virtualearth.net/REST/v1/Routes/
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
https://ers.eclinicalweb.com:443/oneclicksupport/practicejobse
http://www.innosetup.com/
https://ers.eclinicalweb.com/oneclicksupport/XmppDetailsRequest
http://www.bingmapsportal.com
https://ers.eclinicalweb.com:443/oneclicksupport/practicejobservice

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\eRSService.exe.log
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\is-SQCSE.tmp
 PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\logs\Client\is-6CP8E.tmp
 HTML document, ASCII text, with CRLF, CR line terminators
 #
Click to see the 97 hidden entries
C:\Program Files (x86)\eRS\logs\Client\is-0DKRQ.tmp
 HTML document, ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\is-VAPHH.tmp
 PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\is-V8K3T.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Program Files (x86)\eRS\is-US3JO.tmp
 PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\is-UKP0N.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\is-TP4HA.tmp
 XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\is-TI7I6.tmp
 PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\is-TI62U.tmp
 PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\is-T2N38.tmp
 current ar archive
 #
C:\Program Files (x86)\eRS\is-STU2D.tmp
 XML 1.0 document, ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\logs\Client\is-PN4LI.tmp
 HTML document, ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\is-SNGJU.tmp
 XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\is-SE2IL.tmp
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\is-S865R.tmp
 PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\is-REUUH.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\is-RBHN5.tmp
 PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\is-Q96GV.tmp
 PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\is-Q3973.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\is-PGLQH.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\is-P7F0I.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\is-O7ELL.tmp
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\is-NT4JK.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\is-NPN71.tmp
 data
 #
C:\Users\user\AppData\Local\Temp\IXP000.TMP\vcredist.msi
 2
 #
C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
 ASCII text, with no line terminators
 #
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\security.config.cch.new
 data
 #
C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\enterprisesec.config.cch.new
 data
 #
C:\Users\user\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.cch.new
 data
 #
C:\Users\user\AppData\Local\Temp\is-LHHB8.tmp\isxdl.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\is-LHHB8.tmp\is-QKJ5F.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\is-LHHB8.tmp\_isetup\_shfoldr.dll
 PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
 #
C:\Users\user\AppData\Local\Temp\is-LHHB8.tmp\_isetup\_setup64.tmp
 PE32+ executable (console) x86-64, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\is-LHHB8.tmp\_isetup\_RegDLL.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\is-JFNQJ.tmp\eRSSetup.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\MSI22e4.LOG
 Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
 #
C:\Program Files (x86)\eRS\is-NIQ5N.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\IXP000.TMP\vcredis1.cab
 Microsoft Cabinet archive data, 253512 bytes, 1 file
 #
C:\Users\Public\Desktop\eRS Client.lnk
 MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Fri Aug 7 23:57:32 2020, mtime=Fri Aug 7 23:57:32 2020, atime=Tue Dec 17 18:18:22 2013, length=672768, window=hide
 #
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eRS\eRS Client.lnk
 MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Fri Aug 7 23:57:32 2020, mtime=Fri Aug 7 23:57:32 2020, atime=Tue Dec 17 18:18:22 2013, length=672768, window=hide
 #
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\eRSService.lnk
 MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Fri Aug 7 23:57:32 2020, mtime=Fri Aug 7 23:57:32 2020, atime=Tue Dec 17 18:18:22 2013, length=672768, window=hide
 #
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm
 data
 #
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
 Extensible storage engine DataBase, version 0x620, checksum 0x1dc43789, page size 16384, DirtyShutdown, Windows version 10.0
 #
C:\ProgramData\Microsoft\Network\Downloader\edb.log
 data
 #
C:\Program Files (x86)\eRS\unins000.dat
 data
 #
C:\Program Files (x86)\eRS\logs\eRSUtilManager\is-8I425.tmp
 HTML document, ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\logs\eRSService_20200807_175811243.htm
 HTML document, ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\logs\eRSService_20200807_175807742.htm
 HTML document, ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\TightVNC\is-2I41F.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\is-1IG9F.tmp
 PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\is-106DV.tmp
 XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\is-0T2DI.tmp
 PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\is-0CHVM.tmp
 PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\is-0BKMD.tmp
 PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\TightVNC\is-SBS0F.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\TightVNC\is-PRUDC.tmp
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\TightVNC\is-MOIAJ.tmp
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\TightVNC\is-L29HK.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Program Files (x86)\eRS\TightVNC\is-KDLB0.tmp
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\TightVNC\is-GQMQ3.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\TightVNC\is-DPQ5H.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Program Files (x86)\eRS\is-28F5M.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\TightVNC20\is-UIPDT.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\TightVNC20\is-TO3OF.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\TightVNC20\is-QHJUV.tmp
 ASCII text, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\TightVNC20\is-OJQC0.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\TightVNC20\is-N7LEA.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\TightVNC20\is-CEENB.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\DownloadManager\is-O7LVT.tmp
 XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\DownloadManager\is-KNABD.tmp
 PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\DownloadManager\is-BRQV8.tmp
 XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\DownloadManager\is-4E855.tmp
 PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\DownloadManager\is-4704M.tmp
 PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\is-G0R56.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\is-MKOQV.tmp
 PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\is-M5BLV.tmp
 XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\is-L1OJQ.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\is-JQ5L7.tmp
 XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\is-JMHPR.tmp
 XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\is-JL4SE.tmp
 PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\is-IKN3V.tmp
 data
 #
C:\Program Files (x86)\eRS\is-HPP2B.tmp
 PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\is-H7FTQ.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Program Files (x86)\eRS\is-GQOAG.tmp
 XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\is-GMJUT.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\is-GCAA6.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\ConfigSettings.xml
 XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\is-E8QD9.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\is-ASVJF.tmp
 PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\is-AARGN.tmp
 PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\is-A9MFD.tmp
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\is-9TQ9C.tmp
 XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\is-9NN22.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Program Files (x86)\eRS\is-8GJRU.tmp
 PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\is-7V232.tmp
 PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Program Files (x86)\eRS\is-7PV6Q.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Program Files (x86)\eRS\is-68TG6.tmp
 XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
 #
C:\Program Files (x86)\eRS\is-480NE.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #