Joe Sandbox Cloud Basic

Want to search on specific fields?


Try our:

Advanced Search

Want to search in depth on all Cloud Basic reports?

Try: Joe Sandbox View

Register Login
sloganpng
top title background image
flash

SureServoPROInstall_V4_1_0_5_DB2_0_8.exe

Status: finished
Submission Time: 2021-03-29 18:07:23 +02:00
Suspicious
Evader

Comments

Tags

Details

  • Analysis ID:
    377536
  • API (Web) ID:
    657215
  • Analysis Started:
    2021-03-29 18:07:26 +02:00
  • Analysis Finished:
    2021-03-29 18:18:48 +02:00
  • MD5:
    e1c700344a31aee275b86a0cc5fe707b
  • SHA1:
    e1ca62a65559a00eac9096f7b1e0de69d82fd0c8
  • SHA256:
    fa07eeabe6dc625c92894a62137f8c2cfb445b8e3daddd19ee3c44c00a84a708
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
Full Report Management Report IOC Report
suspicious
Score: 32
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

URLs

Name Detection
http://deviis4.installshield.com/NetNirvana/
http://deviis4.installshield.com/NetNirvana/data2.cabDisk1
http://=0x%04x.iniMS
Click to see the 8 hidden entries
http://support.automationdirect.com8
http://www.installshield.com/isetup/ProErrorCentral.asp?ErrorCode=%d
http://crl.thawte.com/ThawteTimestampingCA.crl0
http://support.automationdirect.com
http://www.flexerasoftware.com0
http://www.symauth.com/cps0(
http://www.symauth.com/rpa00
http://ocsp.thawte.com0

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str69BF.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is59F4.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is5994.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
Click to see the 94 hidden entries
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is58F6.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is5896.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is5827.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is57C7.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is5758.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is55FE.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is5560.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str6B1D.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str6A8E.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str6A1F.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is5B8C.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str6921.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str6892.tmp
 Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str6823.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str6765.tmp
 Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str66C7.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str6667.tmp
 Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str65C9.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str652B.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str64CB.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str646B.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str63FC.tmp
 Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is64CC.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is6ABE.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is6A20.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is69C0.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is6922.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is6893.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is6824.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is6766.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is66F7.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is6668.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is65CA.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is656A.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str636D.tmp
 Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is646C.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is63FD.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is636E.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is632E.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is6270.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is61D2.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is5DE8.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is5D4A.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is5CEA.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is5C8A.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\_is5C1B.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{13FF6051-2C7F-44D5-BA42-894B5CE410C5}\MsiStub\{1F57C7D2-0C2E-406D-90F1-7C57BC934AB8}\SureServo PRO.msi
 {96BB593B-34E7-4635-BEC7-ABBCC2C5C462}
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{62E0592E-B1C0-499B-83F6-829789BDBD51}\def5462.tmp
 RIFF (little-endian) data, palette, version 1028, 0 entries
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{62E0592E-B1C0-499B-83F6-829789BDBD51}\_is5463.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{62E0592E-B1C0-499B-83F6-829789BDBD51}\Str542F.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{62E0592E-B1C0-499B-83F6-829789BDBD51}\Fon53FA.tmp
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{62E0592E-B1C0-499B-83F6-829789BDBD51}\DIF542A.tmp
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\dot542D.tmp
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\dot542C.tmp
 PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\cor542B.tmp
 ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\ISB542E.tmp
 PE32+ executable (GUI) x86-64, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{13FF6051-2C7F-44D5-BA42-894B5CE410C5}\setup.ini
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{13FF6051-2C7F-44D5-BA42-894B5CE410C5}\setup.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{62E0592E-B1C0-499B-83F6-829789BDBD51}\isr5430.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
 #
C:\Users\user\AppData\Local\Temp\{13FF6051-2C7F-44D5-BA42-894B5CE410C5}\ISSetup.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
 #
C:\Users\user\AppData\Local\Temp\{13FF6051-2C7F-44D5-BA42-894B5CE410C5}\Disk1\setup.inx
 data
 #
C:\Users\user\AppData\Local\Temp\{13FF6051-2C7F-44D5-BA42-894B5CE410C5}\Disk1\setup.ini
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{13FF6051-2C7F-44D5-BA42-894B5CE410C5}\Disk1\setup.exe
 PE32 executable (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{13FF6051-2C7F-44D5-BA42-894B5CE410C5}\Disk1\setup.bmp
 PC bitmap, Windows 3.x format, 640 x 480 x 8
 #
C:\Users\user\AppData\Local\Temp\{13FF6051-2C7F-44D5-BA42-894B5CE410C5}\Disk1\layout.bin
 data
 #
C:\Users\user\AppData\Local\Temp\{13FF6051-2C7F-44D5-BA42-894B5CE410C5}\Disk1\data1.hdr
 InstallShield CAB
 #
C:\Users\user\AppData\Local\Temp\{13FF6051-2C7F-44D5-BA42-894B5CE410C5}\Disk1\data1.cab
 InstallShield CAB
 #
C:\Users\user\AppData\Local\Temp\{13FF6051-2C7F-44D5-BA42-894B5CE410C5}\Disk1\autorun.inf
 Microsoft Windows Autorun file, ASCII text, with CRLF line terminators
 #
C:\Users\user\AppData\Local\Temp\{13FF6051-2C7F-44D5-BA42-894B5CE410C5}\Disk1\ISSetup.dll
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
 #
C:\Users\user\AppData\Local\Temp\{13FF6051-2C7F-44D5-BA42-894B5CE410C5}\Disk1\0x0409.ini
 Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str58F5.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str62FE.tmp
 Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str626F.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str61D1.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str5DE7.tmp
 Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str5D49.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str5CE9.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str5C89.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str5C1A.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str5B8B.tmp
 Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str59F3.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str5993.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{13FF6051-2C7F-44D5-BA42-894B5CE410C5}\0x0409.ini
 Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str5895.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str5826.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str57C6.tmp
 Little-endian UTF-16 Unicode text, with very long lines, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str5757.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Str55CE.tmp
 Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Set5500.tmp
 data
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\MMO6B1E.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Isr5530.tmp
 PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{8DA8AB7C-68BD-40BE-B843-21CE4CD3DBA4}\Def5461.tmp
 RIFF (little-endian) data, palette, version 1028, 0 entries
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{62E0592E-B1C0-499B-83F6-829789BDBD51}\set53F8.tmp
 data
 #
C:\Users\user\AppData\Local\Temp\{5A5FC2C6-9262-4BBA-8AD9-F7AEF29201FF}\{62E0592E-B1C0-499B-83F6-829789BDBD51}\lic53F9.tmp
 ASCII text, with CRLF line terminators
 #