Strange chinese character files on desktop

[Mastermnd]

Hi, I just registered and I'm a REW first time user.
I just installed REW_windows-x64_5_31.exe from this site. EDIT: From the official site.
Just after install I see some chinese character files on my desktop:

If I right click them and show their properties, they are 0 bytes in length.

If I hit F5, they are gone.
They come back with different "names" every time I rerun the installer.
I tried to run process monitor to see where they come from/where there point to, but I haven't seen any obvious info.
Google translate doesn't shine any light on this. It looks like random chars.

Should I be worried? What is this?
Is it expected behavior or has the binary been tampered with?
SHA256 hash is: 625d26d6cdc5df7554564d28252c53573eee388d532e04df56fcf824857c2fa7

 

[John Mulcahy]

The file hash is correct, the download site for it is www.roomeqwizard.com. I have no idea what those files are.

What folder is REW being installed in?
What is your temp folder location? To see it use Start -> Run -> CMD and enter echo %Temp% in the cmd.exe window. Normally it is C:\Users\<your username>\AppData\Local\Temp

 

[Mastermnd]

Yes, you're right. That's where I got the installer from, not this forum. It's the windows 64bit installer.
Installed to the default C:\Program Files\REW, and the TEMP variable is also default.
I just tried it in a VM with nothing on it, same result.
I used screentogif to record it in case you're interested.
EDIT: Seems the forum won't let me upload it for some reason, maybe because i'm a new user. I uploaded it to imgur:

https://imgur.com/5Hi3fJz

 

[John Mulcahy]

Thanks, I'll raise a case with the installer folk and see what they think.

 

[John Mulcahy]

The installer folk are as baffled as I am. I can't reproduce that behaviour, the closest is the files with long hex character names that appear temporarily in the TEMP folder during installation. There have been more than 17,000 downloads of that file, so whatever is going on doesn't seem to be a common occurrence.

 

[Mastermnd]

Well thank you for even taking the time to answer. This is probably not worth following up on, but my curiosity has been triggered.
The behavior definitely seems like temporary files, and if you're aware of temp files with hex character names, then this is probably the same; it's just that the values of those hex files is probably high enough that it coincides with chinese chars.
It's a bit interesting that you cannot reproduce this, given that I can do it both on my physical pc and an empty VM. I have unplugged all my USB devices and the behavior is still there. For a second I even suspected my topping DAC.
As i said before, the amount of files created, and the "names" differs from run to run, but it seems there's some repetition

Anyway, i'm just going to let it be. Thanks a lot.

 

[skid00]

Drag those files onto a web page of this: https://www.virustotal.com/gui/home/upload

 

[phofman]

Maybe the REW installer does create those temp hexa-name files and your system creates them in a way that they cannot be removed subsequently. Maybe the names mess with the path somehow, the windows file subsystem creates them somewhere else, and the subsequent delete call fails to locate them.

 

[John Mulcahy]

Drag those files onto a web page of this: https://www.virustotal.com/gui/home/upload

They are empty, there is nothing to scan.