FÜR NUTZER

Schließen

Meine Bibliothek
Meine Bibliothek

+ Zur Bibliothek hinzufügen

Suche
Suche

Support
Support 24/7 | Regeln zur Anfragenübermittlung

Schreiben Sie uns

Online-Formular

Telefon

+49 (0) 170 488 40 28

Forum

Ihre Anfragen

Neue Anfrage

Rufen Sie uns an

+7 (495) 789-45-86

Profil

DE

RU CN DE EN ES FR IT JP KZ UZ PL BY
Schließen
Services
Scanner
Dr.Web vxCube
Testversion
Analyse von virenabhängigen Vorfällen
Virenbibliothek
Wissensdatenbank

Technologies

Begriffe

Schulung und Training

Mythen

News

Trojan.MulDrop7.53483

Added to the Dr.Web virus database: 2017-12-12

Virus description added:

Technical Information

To ensure autorun and distribution:
Modifies the following registry keys:
  • [<HKCU>\Software\Microsoft\Windows\CurrentVersion\Run] '跨平台網頁元件' = '"%ProgramFiles%\HiPKILocalSignServer\CheckServer.exe" /start'
  • [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] '{0c9c6593-b11c-4b1c-a621-aeaa1f0220ea}' = '"%ALLUSERSPROFILE%\Application Data\Package Cache\{0c9c6593-b11c-4b1c-a621-aeaa1f0220ea}\HiCOS...
Creates the following services:
  • [<HKLM>\SYSTEM\ControlSet001\Services\SCardSvr] 'Start' = '00000002'
Malicious functions:
Executes the following:
  • '<SYSTEM32>\taskkill.exe' /f /im CheckServer.exe
  • '<SYSTEM32>\taskkill.exe' /f /im chtnode.exe
Modifies file system:
Creates the following files:
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\stack-trace\is-EDC3C.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\stack-trace\is-U3FT0.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\test\is-NCL2N.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\stack-trace\is-R0SM9.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\stack-trace\lib\is-S56V0.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-VBTA5.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\stack-trace\is-98SMF.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\stack-trace\is-NN5K0.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\is-QF7OJ.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\is-6UBH5.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\is-K28B3.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\is-JU2Q4.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\subdir\is-FH0QQ.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\lib\is-R22V8.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\is-FGTD6.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\is-1PPVI.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-510FR.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-7NH7D.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-ORKUD.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-93UCP.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\fixtures\scripts\is-LL6EG.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\fixtures\scripts\is-JOU34.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-RIC6F.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\fixtures\scripts\is-LGEVK.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-HTNEE.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-FE1AE.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-OC375.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-HJNIG.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-OOI6F.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-GUR5J.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-DFF7I.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-PVBFG.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\cycle\is-SFNU5.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\eyes\is-NNCAU.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\cycle\is-22QL2.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\cycle\is-E1BQ1.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\eyes\is-THU65.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\eyes\lib\is-NBULV.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\eyes\is-ISH46.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\eyes\is-5IB0L.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\maps\is-RVKOK.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\system\is-S5LPB.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\maps\is-NK5KM.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\maps\is-68GI4.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\tests\is-D3FJ7.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\themes\is-SO21A.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\screenshots\is-F7UU5.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\tests\is-2H8SF.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\is-HETO4.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\is-G2KOR.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\is-HAKQ9.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\is-SQ101.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\docs\is-0O63U.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\is-POBMU.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\is-HDK5M.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\docs\is-AVMK6.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\is-9EBC0.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\is-F3U64.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\eyes\test\is-QMCA8.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\is-R1GA0.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\is-JG74D.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\is-84935.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\is-VITQ1.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\is-T6BJT.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-4VJI0.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-DDPDO.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-K18SP.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-75TC4.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-AS17V.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-PLN6G.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-HVHFL.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-IDNDG.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-N9127.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-I0TOQ.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-MO17G.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-BEOBO.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-TLH51.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-TH2HP.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-HDB90.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-VRCM4.tmp
  • %ALLUSERSPROFILE%\Start Menu\Programs\跨平台網頁元件\IC卡元件自我檢測.url
  • %ALLUSERSPROFILE%\Start Menu\Programs\跨平台網頁元件\啟動元件服務.lnk
  • %ProgramFiles%\HiPKILocalSignServer\is-78SE9.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-K2QFH.tmp
  • %ALLUSERSPROFILE%\Start Menu\Programs\跨平台網頁元件\進行元件偵錯.lnk
  • %ProgramFiles%\HiPKILocalSignServer\unins000.dat
  • %ALLUSERSPROFILE%\Start Menu\Programs\跨平台網頁元件\停止元件服務.lnk
  • %ALLUSERSPROFILE%\Start Menu\Programs\跨平台網頁元件\解除安裝元件.lnk
  • %ProgramFiles%\HiPKILocalSignServer\is-1LAPK.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-D86PO.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-DJ52C.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-Q2IU1.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-COEDN.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-A4N99.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-2EI9L.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-NDH5F.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-3B45O.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-56BOC.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-D4ODI.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-HLC82.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-PBRH2.tmp
  • %ProgramFiles%\HiPKILocalSignServer\CardManagement\is-N55S0.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-FT9CQ.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-FOS7A.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\stress\is-EP4P6.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-HRNJM.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\fixtures\scripts\is-DQ7TI.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\fixtures\scripts\is-S531U.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-MNDTC.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-LI5JH.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-JEGND.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-4GT66.tmp
  • %ProgramFiles%\HiPKILocalSignServer\digits\is-RH648.tmp
  • %ProgramFiles%\HiPKILocalSignServer\digits\is-MPHSU.tmp
  • %ProgramFiles%\HiPKILocalSignServer\digits\is-QOHCI.tmp
  • %ProgramFiles%\HiPKILocalSignServer\digits\is-DCKEV.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-MBBUS.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-JGUD4.tmp
  • %ProgramFiles%\HiPKILocalSignServer\digits\is-BHLVK.tmp
  • %ProgramFiles%\HiPKILocalSignServer\digits\is-M10H9.tmp
  • %ProgramFiles%\HiPKILocalSignServer\CardManagement\is-LLFI3.tmp
  • %ProgramFiles%\HiPKILocalSignServer\CardManagement\is-M4LS4.tmp
  • %ProgramFiles%\HiPKILocalSignServer\CardManagement\is-TA6LT.tmp
  • %ProgramFiles%\HiPKILocalSignServer\CardManagement\is-MEK7N.tmp
  • %ProgramFiles%\HiPKILocalSignServer\digits\is-KCPFI.tmp
  • %ProgramFiles%\HiPKILocalSignServer\digits\is-QRHQH.tmp
  • %ProgramFiles%\HiPKILocalSignServer\digits\is-6FHTI.tmp
  • %ProgramFiles%\HiPKILocalSignServer\digits\is-TNKH1.tmp
  • %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\HiPKILocalSignServer.exe
  • %WINDIR%\Installer\49f2a.msi
  • %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\HiCOS_Client_x86.msi
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.MAP
  • C:\Config.Msi\49f2d.rbs
  • %ProgramFiles%\Chunghwa Telecom\HiCOS PKI Smart Card\BfiveUcs.dll
  • %WINDIR%\Installer\49f2c.ipi
  • %WINDIR%\Installer\MSI1.tmp
  • %ALLUSERSPROFILE%\Application Data\Package Cache\{0c9c6593-b11c-4b1c-a621-aeaa1f0220ea}\state.rsm
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.MAP
  • %ALLUSERSPROFILE%\Application Data\Package Cache\{0c9c6593-b11c-4b1c-a621-aeaa1f0220ea}\HiCOS_Client.exe
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\INDEX.BTR
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING2.MAP
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\OBJECTS.DATA
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING.VER
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\FS\MAPPING1.MAP
  • <SYSTEM32>\selectcardv2.dll
  • <SYSTEM32>\starp15v2.dll
  • <SYSTEM32>\HiCOSPKCS11.dll
  • <SYSTEM32>\MSVCRTD.dll
  • <SYSTEM32>\UCSBFive.dll
  • %ALLUSERSPROFILE%\Start Menu\Programs\HiCOS PKI Smart Card\HiCOS Token Utility.lnk
  • %ProgramFiles%\Chunghwa Telecom\HiCOS PKI Smart Card\TokenUtility.exe
  • %ProgramFiles%\Chunghwa Telecom\HiCOS PKI Smart Card\UCSBFive.dll
  • %ProgramFiles%\Chunghwa Telecom\HiCOS PKI Smart Card\CHTTokenUtilityzh.dll
  • %ProgramFiles%\Chunghwa Telecom\HiCOS PKI Smart Card\cmsdll.dll
  • <SYSTEM32>\BfiveUcs.dll
  • <SYSTEM32>\chtp15v2.dll
  • <SYSTEM32>\HiCOSCSPv32.dll
  • <SYSTEM32>\HiCOSCSPv32.sig
  • %ProgramFiles%\Chunghwa Telecom\HiCOS PKI Smart Card\HiCOS_Inspector.exe
  • %ProgramFiles%\Chunghwa Telecom\HiCOS PKI Smart Card\HiCOS_InspectorEn.dll
  • %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\.ba\1033\thm.wxl
  • %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\.ba\1028\thm.wxl
  • %TEMP%\{28412C54-95EA-48DC-8DCB-D668701C0F5B}\.cr\HiCOS_Client.exe
  • %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\.ba\wixstdba.dll
  • %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\.ba\logo.png
  • %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\.ba\BootstrapperApplicationData.xml
  • %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\.ba\thm.xml
  • %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\.ba\thm.wxl
  • %TEMP%\RarSFX0\SetUpRule.xml
  • %TEMP%\RarSFX0\Common.exe
  • %TEMP%\RarSFX0\HiCOS_Client.exe
  • %TEMP%\RarSFX0\GssSetup.exe
  • %TEMP%\RarSFX1\set_sl.bat
  • %TEMP%\RarSFX1\HiCOSPKCS11.dll
  • %TEMP%\RarSFX0\SetUpRule.xml_121220170659251509246
  • %TEMP%\RarSFX0\GSSSetup.log
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SOFTWARE
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SYSTEM
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_.DEFAULT
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SECURITY
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\domain.txt
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\Repository\$WinMgmt.CFG
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_MACHINE_SAM
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\ComDb.Dat
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-19
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-19
  • %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\.be\HiCOS_Client.exe
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-18
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-21-2052111302-484763869-725345543-1003
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-2052111302-484763869-725345543-1003
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_NTUSER_S-1-5-20
  • C:\System Volume Information\_restore{E7F0F64C-F7E5-4319-8757-E9A20C1C4E14}\RP16\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-20
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\is-UGFTU.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\is-M85HT.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\is-VNIKE.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\is-F7MUQ.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\is-LE32A.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\is-IE4AP.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\is-QPLET.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\is-7PVU9.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\is-442TL.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\is-8M5QH.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\config\is-SSIB9.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\is-DGBB5.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\is-U4H0L.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\is-NBUCD.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\is-I5TC4.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\is-T88AB.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\is-DUT5E.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\is-VT33A.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\examples\is-RFD34.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\is-U9TKA.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\custom\is-P29LK.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\maps\is-35QN8.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\is-0EI1U.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\custom\is-JRR9B.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\is-KCMEH.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\is-S3EQQ.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\lib\is-9KAQC.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\support\is-LUK2H.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\is-RD4NA.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\examples\is-EP29O.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\is-GVF9H.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\is-CNQ99.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\is-U482N.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\is-TSVHR.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\is-VOH0P.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\is-VO24I.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-VK9JF.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-FNI8J.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\docs\is-Q3TML.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-G08CT.tmp
  • %TEMP%\is-V8KO4.tmp\HiPKILocalSignServer.tmp
  • %TEMP%\is-LQVKN.tmp\_isetup\_shfoldr.dll
  • %ALLUSERSPROFILE%\Start Menu\Programs\HiCOS PKI Smart Card\HiCOS Client Inspector.lnk
  • %WINDIR%\Installer\49f2e.msi
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\is-V2P32.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\is-D6S0F.tmp
  • %ProgramFiles%\HiPKILocalSignServer\is-B2CN3.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\is-3KS97.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\is-ATINN.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\is-T606O.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\is-RFHOV.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\is-MFO9I.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\config\is-QF4S9.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\config\is-MM00I.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\is-AGPR5.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\is-QRHFF.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-LPCM2.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-PFN8G.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-4VINF.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-LB6S1.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-VLUV7.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\is-4UAPA.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-L4NM0.tmp
  • %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-U1RFL.tmp
Deletes the following files:
  • %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\.ba\1033\thm.wxl
  • %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\.ba\BootstrapperApplicationData.xml
  • %ALLUSERSPROFILE%\Application Data\Package Cache\FD69B5AA60C43B950B3F55F312430CEEE1AE816A\HiPKILocalSignServer.exe
  • %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\.ba\1028\thm.wxl
  • %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\.ba\logo.png
  • %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\.ba\wixstdba.dll
  • %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\.be\HiCOS_Client.exe
  • %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\.ba\thm.wxl
  • %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\.ba\thm.xml
  • %ALLUSERSPROFILE%\Application Data\Package Cache\{C9BD427F-EF5C-4361-BEA1-201709083022}v3.0.2.2\HiCOS_Client_x86.msi
  • %WINDIR%\Installer\MSI1.tmp
  • C:\Config.Msi\49f2d.rbs
  • %TEMP%\RarSFX0\SetUpRule.xml_121220170659251509246
  • %TEMP%\RarSFX0\Common.exe
  • %WINDIR%\Installer\49f2a.msi
  • %TEMP%\is-LQVKN.tmp\_isetup\_shfoldr.dll
  • %TEMP%\is-V8KO4.tmp\HiPKILocalSignServer.tmp
  • %WINDIR%\Installer\49f2c.ipi
  • %TEMP%\RarSFX1\set_sl.bat
Moves the following files:
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-7NH7D.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\logger-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-510FR.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\logger-levels-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-RIC6F.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\winston-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\fixtures\scripts\is-LL6EG.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\fixtures\scripts\exit-on-error.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\fixtures\scripts\is-LGEVK.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\fixtures\scripts\default-exceptions.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-93UCP.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\log-rewriter-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-PVBFG.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\helpers.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-DFF7I.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\exception-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-OOI6F.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\humanReadableUnhandledException-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-ORKUD.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\log-filter-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-GUR5J.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\log-exception-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\fixtures\scripts\is-JOU34.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\fixtures\scripts\log-exceptions.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-LI5JH.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\file-maxsize-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-MNDTC.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\file-maxfiles-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-D4ODI.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\file-open-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-3B45O.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\file-tailrolling-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-HLC82.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\file-stress-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-4GT66.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\file-archive-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\fixtures\scripts\is-S531U.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\fixtures\scripts\unhandle-exceptions.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\fixtures\scripts\is-DQ7TI.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\fixtures\scripts\log-string-exception.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\stress\is-EP4P6.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\stress\http-server.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-JEGND.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\daily-rotate-file-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-HRNJM.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\console-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\is-FGTD6.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\single-property.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\is-6UBH5.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\package.json
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\is-1PPVI.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\target-dir.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\lib\is-R22V8.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\lib\pkginfo.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\subdir\is-FH0QQ.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\subdir\package.json
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\is-QF7OJ.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\object-argument.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\docs\is-0O63U.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\docs\pkginfo.html
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\docs\is-AVMK6.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\docs\docco.css
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\is-POBMU.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\all-properties.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\is-JU2Q4.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\multiple-properties.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\is-K28B3.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\examples\array-argument.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\test\is-NCL2N.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\test\pkginfo-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-OC375.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\container-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-VBTA5.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\cli-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-HJNIG.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\custom-formatter-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-FE1AE.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\custom-timestamp-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\is-HTNEE.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\custom-pretty-print-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\stack-trace\lib\is-S56V0.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\stack-trace\lib\stack-trace.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\stack-trace\is-EDC3C.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\stack-trace\License
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\stack-trace\is-R0SM9.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\stack-trace\.npmignore
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\stack-trace\is-U3FT0.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\stack-trace\Makefile
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\stack-trace\is-NN5K0.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\stack-trace\Readme.md
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\stack-trace\is-98SMF.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\stack-trace\package.json
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-56BOC.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\file-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\is-4VJI0.tmp to %ProgramFiles%\HiPKILocalSignServer\ChtPopupForm.htm
  • from %ProgramFiles%\HiPKILocalSignServer\is-75TC4.tmp to %ProgramFiles%\HiPKILocalSignServer\popupForm.htm
  • from %ProgramFiles%\HiPKILocalSignServer\is-DDPDO.tmp to %ProgramFiles%\HiPKILocalSignServer\selfTest.htm
  • from %ProgramFiles%\HiPKILocalSignServer\is-IDNDG.tmp to %ProgramFiles%\HiPKILocalSignServer\update.bat
  • from %ProgramFiles%\HiPKILocalSignServer\is-HVHFL.tmp to %ProgramFiles%\HiPKILocalSignServer\HiPKIUpdate.exe
  • from %ProgramFiles%\HiPKILocalSignServer\is-K18SP.tmp to %ProgramFiles%\HiPKILocalSignServer\addDomain.htm
  • from %ProgramFiles%\HiPKILocalSignServer\is-HDB90.tmp to %ProgramFiles%\HiPKILocalSignServer\invisible.vbs
  • from %ProgramFiles%\HiPKILocalSignServer\is-I0TOQ.tmp to %ProgramFiles%\HiPKILocalSignServer\chtnode.exe
  • from %ProgramFiles%\HiPKILocalSignServer\is-VRCM4.tmp to %ProgramFiles%\HiPKILocalSignServer\version.vbs
  • from %ProgramFiles%\HiPKILocalSignServer\is-TH2HP.tmp to %ProgramFiles%\HiPKILocalSignServer\hipkilog.js
  • from %ProgramFiles%\HiPKILocalSignServer\is-TLH51.tmp to %ProgramFiles%\HiPKILocalSignServer\hipkiFuncs.js
  • from %ProgramFiles%\HiPKILocalSignServer\is-AS17V.tmp to %ProgramFiles%\HiPKILocalSignServer\Module_HiPKILocalSignServer.txt
  • from %ProgramFiles%\HiPKILocalSignServer\is-COEDN.tmp to %ProgramFiles%\HiPKILocalSignServer\HiPKIWriteCert.exe
  • from %ProgramFiles%\HiPKILocalSignServer\is-NDH5F.tmp to %ProgramFiles%\HiPKILocalSignServer\ICCDFC_Crsbr.exe
  • from %ProgramFiles%\HiPKILocalSignServer\is-A4N99.tmp to %ProgramFiles%\HiPKILocalSignServer\HiPKICSR.exe
  • from %ProgramFiles%\HiPKILocalSignServer\is-K2QFH.tmp to %ProgramFiles%\HiPKILocalSignServer\ReleaseNote.txt
  • from %ProgramFiles%\HiPKILocalSignServer\is-78SE9.tmp to %ProgramFiles%\HiPKILocalSignServer\CheckServer.exe
  • from %ProgramFiles%\HiPKILocalSignServer\is-2EI9L.tmp to %ProgramFiles%\HiPKILocalSignServer\ICCDFCDLL.dll
  • from %ProgramFiles%\HiPKILocalSignServer\is-DJ52C.tmp to %ProgramFiles%\HiPKILocalSignServer\whiteList.txt
  • from %ProgramFiles%\HiPKILocalSignServer\is-PLN6G.tmp to %ProgramFiles%\HiPKILocalSignServer\Module_CardManagement.txt
  • from %ProgramFiles%\HiPKILocalSignServer\is-Q2IU1.tmp to %ProgramFiles%\HiPKILocalSignServer\npHttpComponent.dll
  • from %ProgramFiles%\HiPKILocalSignServer\is-D86PO.tmp to %ProgramFiles%\HiPKILocalSignServer\CHT.ico
  • from %ProgramFiles%\HiPKILocalSignServer\is-1LAPK.tmp to %ProgramFiles%\HiPKILocalSignServer\HiCOSPKCS11.dll
  • from %ProgramFiles%\HiPKILocalSignServer\CardManagement\is-M4LS4.tmp to %ProgramFiles%\HiPKILocalSignServer\CardManagement\xOUC.exe
  • from %ProgramFiles%\HiPKILocalSignServer\CardManagement\is-LLFI3.tmp to %ProgramFiles%\HiPKILocalSignServer\CardManagement\whiteListCM.txt
  • from %ProgramFiles%\HiPKILocalSignServer\digits\is-6FHTI.tmp to %ProgramFiles%\HiPKILocalSignServer\digits\0.png
  • from %ProgramFiles%\HiPKILocalSignServer\digits\is-KCPFI.tmp to %ProgramFiles%\HiPKILocalSignServer\digits\2.png
  • from %ProgramFiles%\HiPKILocalSignServer\digits\is-TNKH1.tmp to %ProgramFiles%\HiPKILocalSignServer\digits\1.png
  • from %ProgramFiles%\HiPKILocalSignServer\CardManagement\is-MEK7N.tmp to %ProgramFiles%\HiPKILocalSignServer\CardManagement\popupFormCM.htm
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-FOS7A.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\memory-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-FT9CQ.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\http-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\is-PBRH2.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\test\transports\transport.js
  • from %ProgramFiles%\HiPKILocalSignServer\CardManagement\is-TA6LT.tmp to %ProgramFiles%\HiPKILocalSignServer\CardManagement\CMCPopForm.htm
  • from %ProgramFiles%\HiPKILocalSignServer\CardManagement\is-N55S0.tmp to %ProgramFiles%\HiPKILocalSignServer\CardManagement\CardManagement.js
  • from %ProgramFiles%\HiPKILocalSignServer\digits\is-QRHQH.tmp to %ProgramFiles%\HiPKILocalSignServer\digits\3.png
  • from %ProgramFiles%\HiPKILocalSignServer\is-JGUD4.tmp to %ProgramFiles%\HiPKILocalSignServer\HiPKISign.exe
  • from %ProgramFiles%\HiPKILocalSignServer\is-MBBUS.tmp to %ProgramFiles%\HiPKILocalSignServer\errorcode.js
  • from %ProgramFiles%\HiPKILocalSignServer\is-MO17G.tmp to %ProgramFiles%\HiPKILocalSignServer\HiPKIDecrypt.exe
  • from %ProgramFiles%\HiPKILocalSignServer\is-N9127.tmp to %ProgramFiles%\HiPKILocalSignServer\hipkiLocalServer.js
  • from %ProgramFiles%\HiPKILocalSignServer\is-BEOBO.tmp to %ProgramFiles%\HiPKILocalSignServer\ListInfo.exe
  • from %ProgramFiles%\HiPKILocalSignServer\digits\is-M10H9.tmp to %ProgramFiles%\HiPKILocalSignServer\digits\9.png
  • from %ProgramFiles%\HiPKILocalSignServer\digits\is-DCKEV.tmp to %ProgramFiles%\HiPKILocalSignServer\digits\5.png
  • from %ProgramFiles%\HiPKILocalSignServer\digits\is-QOHCI.tmp to %ProgramFiles%\HiPKILocalSignServer\digits\4.png
  • from %ProgramFiles%\HiPKILocalSignServer\digits\is-RH648.tmp to %ProgramFiles%\HiPKILocalSignServer\digits\6.png
  • from %ProgramFiles%\HiPKILocalSignServer\digits\is-BHLVK.tmp to %ProgramFiles%\HiPKILocalSignServer\digits\8.png
  • from %ProgramFiles%\HiPKILocalSignServer\digits\is-MPHSU.tmp to %ProgramFiles%\HiPKILocalSignServer\digits\7.png
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\is-HDK5M.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\README.md
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\is-QRHFF.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\is-AGPR5.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\logger.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\config\is-QF4S9.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\config\cli-config.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\config\is-SSIB9.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\config\syslog-config.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\config\is-MM00I.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\config\npm-config.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\is-T606O.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\exception.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\is-4UAPA.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-VLUV7.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\webhook-post.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\is-RFHOV.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\common.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\is-ATINN.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\container.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\is-MFO9I.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\config.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\is-DGBB5.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\console.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\is-F7MUQ.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\.travis.yml
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\is-VNIKE.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\.jshintrc
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\is-UGFTU.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\bower.json
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\is-QPLET.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\component.json
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\is-M85HT.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\CHANGELOG.md
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\is-NBUCD.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\webhook.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\is-8M5QH.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\file.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\is-442TL.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\daily-rotate-file.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\is-I5TC4.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\http.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\is-U4H0L.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\transport.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\is-T88AB.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\lib\winston\transports\memory.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\is-V2P32.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\.npmignore
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\is-3KS97.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\.jshintrc
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\is-D6S0F.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\.travis.yml
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\is-VO24I.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\LICENSE
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\is-VOH0P.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\CHANGELOG.md
  • from %ProgramFiles%\HiPKILocalSignServer\is-B2CN3.tmp to %ProgramFiles%\HiPKILocalSignServer\unins000.exe
  • from %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\HiCOS_Client_x86.msi to %ALLUSERSPROFILE%\Application Data\Package Cache\{C9BD427F-EF5C-4361-BEA1-201709083022}v3.0.2.2\HiCOS_Client_x86.msi
  • from %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\HiCOS_Client_x86.msi to %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\HiCOS_Client_x86.msi
  • from %TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\HiPKILocalSignServer.exe to %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\HiPKILocalSignServer.exe
  • from %TEMP%\RarSFX1\HiCOSPKCS11.dll to %WINDIR%\HiCOSPKCS11.dll
  • from %ALLUSERSPROFILE%\Application Data\Package Cache\.unverified\HiPKILocalSignServer.exe to %ALLUSERSPROFILE%\Application Data\Package Cache\FD69B5AA60C43B950B3F55F312430CEEE1AE816A\HiPKILocalSignServer.exe
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\is-U482N.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\package.json
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-LPCM2.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\exception.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-LB6S1.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\custom-pretty-print.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-PFN8G.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\raw-mode.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-U1RFL.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\silly-levels.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-L4NM0.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\regular-expressions.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-4VINF.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\custom-levels.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\docs\is-Q3TML.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\docs\transports.md
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\is-TSVHR.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\README.md
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-G08CT.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\color-message.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-FNI8J.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\create-file.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\is-VK9JF.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\examples\couchdb.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\is-7PVU9.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\LICENSE
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\eyes\is-ISH46.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\eyes\Makefile
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\eyes\is-NNCAU.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\eyes\LICENSE
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\eyes\is-5IB0L.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\eyes\package.json
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\eyes\lib\is-NBULV.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\eyes\lib\eyes.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\eyes\is-THU65.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\eyes\README.md
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\cycle\is-SFNU5.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\cycle\README.md
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\tests\is-D3FJ7.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\tests\safe-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\tests\is-2H8SF.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\tests\basic-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\themes\is-SO21A.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\themes\generic-logging.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\cycle\is-E1BQ1.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\cycle\package.json
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\cycle\is-22QL2.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\cycle\cycle.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\eyes\test\is-QMCA8.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\eyes\test\eyes-test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\is-HAKQ9.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\test.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\is-84935.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\README.md
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\is-SQ101.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\.npmignore
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\is-G2KOR.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\package.json
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\is-HETO4.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\pkginfo\LICENSE
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\is-JG74D.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\package.json
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\is-9EBC0.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\.npmignore
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\is-R1GA0.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\.jshintrc
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\is-F3U64.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\.travis.yml
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\is-T6BJT.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\LICENSE.md
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\is-VITQ1.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\isstream\isstream.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\is-CNQ99.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\ReadMe.md
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\is-GVF9H.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\package.json
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\is-RD4NA.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\safe.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\examples\is-RFD34.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\examples\safe-string.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\examples\is-EP29O.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\examples\normal-usage.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\is-S3EQQ.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\MIT-LICENSE.txt
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\is-IE4AP.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\README.md
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\is-LE32A.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\package.json
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\lib\is-9KAQC.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\lib\async.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\is-KCMEH.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\.travis.yml
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\support\is-LUK2H.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\async\support\sync-package-managers.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\is-U9TKA.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\colors.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\maps\is-68GI4.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\maps\random.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\maps\is-NK5KM.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\maps\rainbow.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\maps\is-RVKOK.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\maps\zebra.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\screenshots\is-F7UU5.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\screenshots\colors.png
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\system\is-S5LPB.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\system\supports-colors.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\maps\is-35QN8.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\maps\america.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\is-VT33A.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\index.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\is-DUT5E.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\extendStringPrototype.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\is-0EI1U.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\styles.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\custom\is-P29LK.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\custom\zalgo.js
  • from %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\custom\is-JRR9B.tmp to %ProgramFiles%\HiPKILocalSignServer\node_modules\winston\node_modules\colors\lib\custom\trap.js
Miscellaneous:
Searches for the following windows:
  • ClassName: '' WindowName: ''
  • ClassName: '' WindowName: 'HiCOS Token Utility (3.0.2 build 55242)'
  • ClassName: 'EDIT' WindowName: ''
Creates and executes the following:
  • '%ALLUSERSPROFILE%\Application Data\Package Cache\FD69B5AA60C43B950B3F55F312430CEEE1AE816A\HiPKILocalSignServer.exe' /VERYSILENT
  • '%ProgramFiles%\Chunghwa Telecom\HiCOS PKI Smart Card\TokenUtility.exe' -AutoHide
  • '%TEMP%\is-V8KO4.tmp\HiPKILocalSignServer.tmp' /SL5="$200F4,6528134,484864,%ALLUSERSPROFILE%\Application Data\Package Cache\FD69B5AA60C43B950B3F55F312430CEEE1AE816A\HiPKILocalSignServer.exe" /VERYSILENT
  • '%ProgramFiles%\HiPKILocalSignServer\chtnode.exe' hipkiLocalServer.js
  • '%ProgramFiles%\HiPKILocalSignServer\CheckServer.exe' /start
  • '%TEMP%\RarSFX0\Common.exe' /repair /quiet /norestart
  • '%TEMP%\RarSFX0\GssSetup.exe'
  • '%TEMP%\RarSFX0\HiCOS_Client.exe' /repair /quiet /norestart
  • '%TEMP%\{9D8667EB-E8E7-471C-B97F-D5AADF86E513}\.be\HiCOS_Client.exe' -q -burn.elevated BurnPipe.{38D8481B-BA8A-46B2-8EAB-0F5EE5465670} {E597BC63-37BF-4722-A675-6979EA2AEB2E} 2980
  • '%TEMP%\{28412C54-95EA-48DC-8DCB-D668701C0F5B}\.cr\HiCOS_Client.exe' -burn.clean.room="%TEMP%\RarSFX0\HiCOS_Client.exe" -burn.filehandle.attached=348 -burn.filehandle.self=344 /repair /quiet /norestart
Executes the following:
  • '<SYSTEM32>\msiexec.exe' /V
  • '<SYSTEM32>\scardsvr.exe'
  • '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles%\HiPKILocalSignServer\npHttpComponent.dll"
  • '<SYSTEM32>\cmd.exe' /c ""%TEMP%\RarSFX1\set_sl.bat" "
  • '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\6C46B8823BB9712AB6BB74E6557D7ED1D5B5AF7D /v Blob /t REG_BINARY /d 0300000001000000140000006c46b8823bb9712ab6bb74e655...
  • '<SYSTEM32>\reg.exe' add HKLM\SOFTWARE\Microsoft\Silverlight /v AllowElevatedTrustAppsInBrowser /t REG_DWORD /d 1 /f

Curing recommendations

  1. If the operating system (OS) can be loaded (either normally or in safe mode), download Dr.Web Security Space and run a full scan of your computer and removable media you use. More about Dr.Web Security Space.
  2. If you cannot boot the OS, change the BIOS settings to boot your system from a CD or USB drive. Download the image of the emergency system repair disk Dr.Web® LiveDisk , mount it on a USB drive or burn it to a CD/DVD. After booting up with this media, run a full scan and cure all the detected threats.
Free trial

 

Download Dr.Web

Download by serial number

Use Dr.Web Anti-virus for macOS to run a full scan of your Mac.

Free trial

 

Download Dr.Web

Download by serial number

Download on App Store

After booting up, run a full scan of all disk partitions with Dr.Web Anti-virus for Linux.

Free trial

 

Download Dr.Web

Download by serial number

  1. If the mobile device is operating normally, download and install Dr.Web for Android. Run a full system scan and follow recommendations to neutralize the detected threats.
  2. If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
    • Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
    • Once you have activated safe mode, install the Dr.Web for Android onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
    • Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android

Free trial

14 days

Download now
Get it on Google Play