Trojan.Siggen15.1368

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKLM>\Software\Microsoft\Windows\CurrentVersion\Run] 'egui' = '"%ProgramFiles%\ESET\ESET Security\ecmds.exe" /launch /hide'

Sets the following service settings

[<HKLM>\System\CurrentControlSet\Services\ekrn] 'Start' = '00000002'
[<HKLM>\System\CurrentControlSet\Services\ekrn] 'ImagePath' = '"%ProgramFiles%\ESET\ESET Security\ekrn.exe"'
[<HKLM>\System\CurrentControlSet\Services\ehdrv] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\ehdrv] 'ImagePath' = 'system32\DRIVERS\ehdrv.sys'
[<HKLM>\System\CurrentControlSet\Services\eamonm] 'ImagePath' = 'system32\DRIVERS\eamonm.sys'
[<HKLM>\SYSTEM\CurrentControlSet\Services\eamonm] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\epfwwfp] 'Start' = '00000001'
[<HKLM>\System\CurrentControlSet\Services\epfwwfp] 'ImagePath' = 'system32\DRIVERS\epfwwfp.sys'
[<HKLM>\System\CurrentControlSet\Services\ekrnEpfw] 'ImagePath' = '"%ProgramFiles%\ESET\ESET Security\ekrn.exe"'

Creates the following services

'ekrn' "%ProgramFiles%\ESET\ESET Security\ekrn.exe"
'ekrn' %ProgramFiles%\ESET\ESET Security\ekrn.exe
'ehdrv' system32\DRIVERS\ehdrv.sys
'eamonm' system32\DRIVERS\eamonm.sys
'epfwwfp' system32\DRIVERS\epfwwfp.sys
'ekrnEpfw' "%ProgramFiles%\ESET\ESET Security\ekrn.exe"

Malicious functions

Executes the following

'<SYSTEM32>\taskkill.exe' /F /T /IM ehttpsrv.exe

Registers file system filter

[<HKLM>\System\CurrentControlSet\Services\eamonm] 'Group' = 'FSFilter Anti-Virus'

Modifies file system

Creates the following files

%TEMP%\aut7944.tmp
%ProgramFiles%\eset\eset security\ekrnantitheft.dll
%ProgramFiles%\eset\eset security\ekrncerberus.dll
%ProgramFiles%\eset\eset security\ekrndemeter.dll
%ProgramFiles%\eset\eset security\ekrndevmon.dll
%ProgramFiles%\eset\eset security\ekrndmon.dll
%ProgramFiles%\eset\eset security\ekrnecp.dll
%ProgramFiles%\eset\eset security\ekrnemon.dll
%ProgramFiles%\eset\eset security\drivers\ekbdflt\ekbdflt.inf
%ProgramFiles%\eset\eset security\ekrnepfw.dll
%ProgramFiles%\eset\eset security\ekrnipm.dll
%ProgramFiles%\eset\eset security\ekrnlicensing.dll
%ProgramFiles%\eset\eset security\ekrnmailplugins.dll
%ProgramFiles%\eset\eset security\ekrnopp.dll
%ProgramFiles%\eset\eset security\ekrnparental.dll
%ProgramFiles%\eset\eset security\ekrnscan.dll
%ProgramFiles%\eset\eset security\ekrnscriptmon.dll
%ProgramFiles%\eset\eset security\ekrn.exe
%ProgramFiles%\eset\eset security\ekrnamon.dll
%ProgramFiles%\eset\eset security\drivers\ekbdflt\ekbdflt.sys
%ProgramFiles%\eset\eset security\drivers\ekbdflt\ekbdflt.cat
%ProgramFiles%\eset\eset security\ekrnupdate.dll
%ProgramFiles%\eset\eset security\eguidemeter.dll
%ProgramFiles%\eset\eset security\eguidevmon.dll
%ProgramFiles%\eset\eset security\eguidmon.dll
%ProgramFiles%\eset\eset security\eguiemon.dll
%ProgramFiles%\eset\eset security\eguiepfw.dll
%ProgramFiles%\eset\eset security\eguihips.dll
%ProgramFiles%\eset\eset security\ekrnsmon.dll
%ProgramFiles%\eset\eset security\eguiamon.dll
%ProgramFiles%\eset\eset security\ekrnhips.dll
%ProgramFiles%\eset\eset security\eguiipm.dll
%ProgramFiles%\eset\eset security\eguiscan.dll
%ProgramFiles%\eset\eset security\eguismon.dll
%ProgramFiles%\eset\eset security\eguiupdate.dll
%ProgramFiles%\eset\eset security\drivers\ehdrv\ehdrv.cat
%ProgramFiles%\eset\eset security\drivers\ehdrv\ehdrv.inf
%ProgramFiles%\eset\eset security\drivers\ehdrv\ehdrv.sys
%ProgramFiles%\eset\eset security\eguimailplugins.dll
%ProgramFiles%\eset\eset security\eguionlinehelp.dll
%ProgramFiles%\eset\eset security\eguiparental.dll
%ProgramFiles%\eset\eset security\x86\shellext.dll
%ProgramFiles%\eset\eset security\ekrnwebcontrol.dll
%ProgramFiles%\eset\eset security\x86\eplghooks.dll
%ProgramFiles%\eset\eset security\eplgoe.dll
%ProgramFiles%\eset\eset security\x86\eplgoe.dll
%ProgramFiles%\eset\eset security\eplgoeemon.dll
%ProgramFiles%\eset\eset security\x86\eplgoeemon.dll
%ProgramFiles%\eset\eset security\eplgoesmon.dll
%ProgramFiles%\eset\eset security\x86\eplgoesmon.dll
%ProgramFiles%\eset\eset security\eplgoutlook.dll
%ProgramFiles%\eset\eset security\eplghooks.dll
%ProgramFiles%\eset\eset security\eguiactivation.dll
%ProgramFiles%\eset\eset security\drivers\epfwwfp\epfwwfp.sys
%ProgramFiles%\eset\eset security\eplgoutlooksmon.dll
%ProgramFiles%\eset\eset security\x86\eplgoutlooksmon.dll
%ProgramFiles%\eset\eset security\instsuppex.dll
%ProgramFiles%\eset\eset security\msvcp140.dll
%ProgramFiles%\eset\eset security\notice
%ProgramFiles%\eset\eset security\sciter-x.dll
%ProgramFiles%\eset\eset security\securityproductinformation.ini
%ProgramFiles%\eset\eset security\eplgoutlookemon.dll
%ProgramFiles%\eset\eset security\x86\eplgoutlook.dll
%ProgramFiles%\eset\eset security\eguiantitheft.dll
%ProgramFiles%\eset\eset security\drivers\epfwwfp\epfwwfp.cat
%ProgramFiles%\eset\eset security\drivers\epfwndis\epfwndis.inf
%ProgramFiles%\eset\eset security\eoppframe.exe
%ProgramFiles%\eset\eset security\drivers\epfw\epfw.cat
%ProgramFiles%\eset\eset security\drivers\epfw\epfw.inf
%ProgramFiles%\eset\eset security\drivers\epfw\epfw.sys
%ProgramFiles%\eset\eset security\drivers\epfwlwf\epfwlwf.cat
%ProgramFiles%\eset\eset security\drivers\epfwlwf\epfwlwf.inf
%ProgramFiles%\eset\eset security\drivers\epfwlwf\epfwlwf.sys
%ProgramFiles%\eset\eset security\drivers\epfwwfp\epfwwfp.inf
%ProgramFiles%\eset\eset security\eoppbrowser.dll
%ProgramFiles%\eset\eset security\x86\eoppbrowser.dll
%ProgramFiles%\eset\eset security\drivers\epfwndis\epfwndis.sys
%ProgramFiles%\eset\eset security\drivers\epfwtdi\epfwtdi.cat
%ProgramFiles%\eset\eset security\drivers\epfwtdi\epfwtdi.inf
%ProgramFiles%\eset\eset security\drivers\epfwtdi\epfwtdi.sys
%ProgramFiles%\eset\eset security\drivers\epfwtdir\epfwtdir.cat
%ProgramFiles%\eset\eset security\drivers\epfwtdir\epfwtdir.inf
%ProgramFiles%\eset\eset security\drivers\epfwtdir\epfwtdir.sys
%ProgramFiles%\eset\eset security\drivers\epfwndis\epfwndis.cat
%ProgramFiles%\eset\eset security\drivers\epfwndis\epfwnd_m.inf
%ProgramFiles%\eset\eset security\x86\eplgoutlookemon.dll
%ProgramFiles%\eset\eset security\shellext.dll
%ProgramFiles%\eset\eset security\drivers\eelam\eelam.inf
%ProgramFiles%\eset\eset security\api-ms-win-core-debug-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-errorhandling-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-file-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-file-l1-2-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-file-l2-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-handle-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-profile-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-heap-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-libraryloader-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-localization-l1-2-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-memory-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-namedpipe-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-processenvironment-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\eset.temp\{02d83bbe-969b-c795-6e3e-1dcd95275afd}\cfg_updater_user.xml
%TEMP%\eset.temp\{02d83bbe-969b-c795-6e3e-1dcd95275afd}\cfg_ekrn_user.xml
%ProgramFiles%\eset\eset security\api-ms-win-core-interlocked-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-datetime-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-console-l1-1-0.dll
%TEMP%\eset.temp\{02d83bbe-969b-c795-6e3e-1dcd95275afd}\cfg_hips_sd.xml
%TEMP%\eset.temp\{02d83bbe-969b-c795-6e3e-1dcd95275afd}\cfg_ext_admin.xml
%TEMP%\eset\[productdir]\drivers\epfwndis\epfwndis.sys
%TEMP%\eset\64\[productdir]\drivers\epfwndis\epfwndis.sys
%TEMP%\eset\[productdir]\drivers\epfwtdi\epfwtdi.sys
%TEMP%\eset\64\[productdir]\drivers\epfwtdi\epfwtdi.sys
%TEMP%\eset\[productdir]\drivers\epfwtdir\epfwtdir.sys
%ProgramFiles%\eset\eset security\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\eset\64\[productdir]\drivers\epfwtdir\epfwtdir.sys
%TEMP%\eset\64\[productdir]\drivers\epfwwfp\epfwwfp.sys
%ProgramFiles%\eset\eset security\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\eset\appdatadir\installer\deslockinstaller.msi
%TEMP%\msiff102.log
%TEMP%\eset.temp\{02d83bbe-969b-c795-6e3e-1dcd95275afd}\_instdata.xml
%TEMP%\eset.temp\{02d83bbe-969b-c795-6e3e-1dcd95275afd}\insthelper.exe
%TEMP%\eset.temp\{02d83bbe-969b-c795-6e3e-1dcd95275afd}\cfg_presets.xml
%TEMP%\eset.temp\{02d83bbe-969b-c795-6e3e-1dcd95275afd}\cfg_cfg.xml
%TEMP%\eset\[productdir]\drivers\epfwwfp\epfwwfp.sys
%TEMP%\eset\[productdir]\drivers\epfwlwf\epfwlwf.sys
%TEMP%\eset\64\[productdir]\drivers\epfw\epfw.sys
%TEMP%\nslbb34.tmp\nsexec.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-string-l1-1-0.dll
%ProgramFiles%\eset\eset security\concrt140.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-synch-l1-2-0.dll
%ProgramFiles%\eset\eset security\x86\dmon.dll
%ProgramFiles%\eset\eset security\drivers\eamonm\eamonm.cat
%ProgramFiles%\eset\eset security\drivers\eamonm\eamonm.inf
%ProgramFiles%\eset\eset security\drivers\eamonm\eamonm.sys
%ProgramFiles%\eset\eset security\eamsi.dll
%ProgramFiles%\eset\eset security\x86\eamsi.dll
%ProgramFiles%\eset\eset security\cfgres.dll
%ProgramFiles%\eset\eset security\callmsi.exe
%ProgramFiles%\eset\eset security\dmon.dll
%ProgramFiles%\eset\eset security\ecapture.exe
%ProgramFiles%\eset\eset security\ecomserver.exe
%ProgramFiles%\eset\eset security\drivers\edevmon\edevmon.cat
%ProgramFiles%\eset\eset security\drivers\edevmon\edevmon.inf
%ProgramFiles%\eset\eset security\drivers\edevmon\edevmon.sys
%ProgramFiles%\eset\eset security\eeclnt.exe
%ProgramFiles%\eset\eset security\drivers\eelam\eelam.cat
%ProgramFiles%\eset\eset security\ecls.exe
%ProgramFiles%\eset\eset security\ecmd.exe
%ProgramFiles%\eset\eset security\ecmds.exe
%ProgramFiles%\eset\eset security\egui.exe
%ProgramFiles%\eset\eset security\drivers\eelam\eelam.sys
%TEMP%\eset.temp\{02d83bbe-969b-c795-6e3e-1dcd95275afd}\cfg_epfw_user.xml
%ProgramFiles%\eset\eset security\api-ms-win-core-sysinfo-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-timezone-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-util-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-crt-conio-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-crt-convert-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-crt-environment-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-crt-utility-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-core-synch-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-crt-time-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-crt-filesystem-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-crt-multibyte-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-crt-private-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-crt-process-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-crt-runtime-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-crt-stdio-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-crt-string-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-crt-heap-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-crt-locale-l1-1-0.dll
%ProgramFiles%\eset\eset security\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\eset\[productdir]\eguiupdatelang.dll
%ProgramFiles%\eset\eset security\sysinspector.exe
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\eset\eset security\eset sysinspector.lnk
%TEMP%\nsf42aa.tmp
%TEMP%\nsf4319.tmp
%TEMP%\nsf431a.tmp
%TEMP%\nsf432a.tmp
%TEMP%\nsf432b.tmp
%TEMP%\nsf434b.tmp
%TEMP%\nsf434c.tmp
%WINDIR%\installer\{0813f772-f554-4da9-9cea-abce6321bdfd}\icon_help
%TEMP%\nsf436d.tmp
%TEMP%\nsf4498.tmp
%TEMP%\nup4487.tmp
%TEMP%\nsf469d.tmp
%TEMP%\nup469c.tmp
%TEMP%\nsf46be.tmp
%TEMP%\nup46bd.tmp
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\eset\eset security\eset security.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\eset\eset security\uninstall.lnk
%ALLUSERSPROFILE%\microsoft\windows\start menu\programs\eset\eset security\eset sysrescue.lnk
%WINDIR%\installer\{0813f772-f554-4da9-9cea-abce6321bdfd}\icon_uninstall
%ProgramFiles%\eset\eset security\help\no_internet_connection.htm
%TEMP%\nup46e0.tmp
%ProgramFiles%\eset\eset security\help\opening_title.htm
%ProgramFiles%\eset\eset security\help\ping1.png
%ProgramFiles%\eset\eset security\help\ping2.png
%ProgramFiles%\eset\eset security\help\plus_small.png
%ProgramFiles%\eset\eset security\help\r_copyright.png
%TEMP%\nsf46d0.tmp
%ProgramFiles%\eset\eset security\help\settings.js
%ProgramFiles%\eset\eset security\help\no_internet_connection_malware.htm
%TEMP%\nsf437d.tmp
%ProgramFiles%\eset\eset security\help\update_advanced.htm
%ProgramFiles%\eset\eset security\help\zoom_index.js
%ProgramFiles%\eset\eset security\help\zoom_pageinfo.js
%ProgramFiles%\eset\eset security\help\zoom_search.js
%WINDIR%\installer\{0813f772-f554-4da9-9cea-abce6321bdfd}\icon_product
%WINDIR%\installer\{0813f772-f554-4da9-9cea-abce6321bdfd}\icon_license
%ProgramFiles%\eset\eset security\help\sitemap.xml
%TEMP%\nup46cf.tmp
%ProgramFiles%\eset\eset security\help\work_update_setup_profiles.htm
%ProgramFiles%\eset\eset security\help\work_update_tasks.htm
%ProgramFiles%\eset\eset security\toastnotify.dll
%TEMP%\nup46f1.tmp
%ALLUSERSPROFILE%\eset\eset security\logs\hipslog.dat
%WINDIR%\temp\epfwtrace.etl
%WINDIR%\temp\{0c64d446-c270-0390-457e-c74c8269e14e}\seta40e.tmp
%WINDIR%\temp\{0c64d446-c270-0390-457e-c74c8269e14e}\seta509.tmp
%WINDIR%\temp\{0c64d446-c270-0390-457e-c74c8269e14e}\seta5d5.tmp
%ALLUSERSPROFILE%\eset\eset security\epfwuser.dat
%ALLUSERSPROFILE%\eset\eset security\logs\urllog.dat
%ALLUSERSPROFILE%\eset\eset security\logs\virlog.dat
%WINDIR%\temp\{55498d4b-185d-43e4-c9ce-a954ce4f8409}\setae3f.tmp
<DRIVERS>\set9b26.tmp
%WINDIR%\temp\{372ce8a5-e12a-1679-5d18-e443e92f3246}\set71e6.tmp
%ALLUSERSPROFILE%\eset\eset security\versions.csv
%WINDIR%\temp\versions.csv
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat
<DRIVERS>\setd2aa.tmp
%WINDIR%\temp\udddb70.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem4.cat
%WINDIR%\temp\{55498d4b-185d-43e4-c9ce-a954ce4f8409}\setaf2a.tmp
%ProgramFiles%\eset\eset security\help\monitor_orange.png
%WINDIR%\temp\{55498d4b-185d-43e4-c9ce-a954ce4f8409}\setaff5.tmp
%ProgramFiles%\eset\eset security\help\offline_help_connectivity_problems.htm
%TEMP%\nsf4712.tmp
%TEMP%\nsf53ba.tmp
%TEMP%\nsf47ee.tmp
%TEMP%\nup47ed.tmp
%TEMP%\nsf4810.tmp
%TEMP%\nup47ff.tmp
%TEMP%\nup4820.tmp
%TEMP%\nup4a72.tmp
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
%TEMP%\nup4dbd.tmp
%ALLUSERSPROFILE%\eset\eset security\logs\warnlog.dat
%TEMP%\nup4711.tmp
%TEMP%\nup53b9.tmp
%TEMP%\nup53ea.tmp
%TEMP%\nup5458.tmp
%ALLUSERSPROFILE%\eset\eset security\registryfilestorage_globala.cfg
%WINDIR%\temp\{372ce8a5-e12a-1679-5d18-e443e92f3246}\set6f46.tmp
%WINDIR%\temp\{372ce8a5-e12a-1679-5d18-e443e92f3246}\set70ec.tmp
%TEMP%\nsf537a.tmp
%ProgramFiles%\eset\eset security\help\minus_small.png
%TEMP%\nup5369.tmp
%ProgramFiles%\eset\eset security\help\jquery.js
%ProgramFiles%\eset\eset security\help\infected_computer_by_malware.htm
%ProgramFiles%\eset\eset security\ekrnemonlang.dll
%ProgramFiles%\eset\eset security\ekrnlang.dll
%ProgramFiles%\eset\eset security\ekrnlicensinglang.dll
%ProgramFiles%\eset\eset security\ekrnmailpluginslang.dll
%ProgramFiles%\eset\eset security\ekrnopplang.dll
%ProgramFiles%\eset\eset security\ekrnparentallang.dll
%ProgramFiles%\eset\eset security\ekrndmonlang.dll
%ProgramFiles%\eset\eset security\ekrnscanlang.dll
%TEMP%\eset\[productdir]\drivers\epfw\epfw.sys
%ProgramFiles%\eset\eset security\ekrnhipslang.dll
%ProgramFiles%\eset\eset security\ekrnsmonlang.dll
%ProgramFiles%\eset\eset security\eplgoelang.dll
%ProgramFiles%\eset\eset security\eplgoesmonlang.dll
%ProgramFiles%\eset\eset security\eplgoutlookemonlang.dll
%ProgramFiles%\eset\eset security\eplgoutlooklang.dll
%ProgramFiles%\eset\eset security\eplgoutlooksmonlang.dll
%ProgramFiles%\eset\eset security\ekrnscriptmonlang.dll
%ProgramFiles%\eset\eset security\eula.cab
%ProgramFiles%\eset\eset security\ekrnupdatelang.dll
%ProgramFiles%\eset\eset security\ekrnwebcontrollang.dll
%ProgramFiles%\eset\eset security\help\help.cab
%ProgramFiles%\eset\eset security\ekrndevmonlang.dll
%ProgramFiles%\eset\eset security\ucrtbase.dll
%ProgramFiles%\eset\eset security\vcruntime140.dll
%ProgramFiles%\eset\eset security\windowsperformancerecordercontrol.dll
%ProgramFiles%\eset\eset security\eclslang.dll
%ProgramFiles%\eset\eset security\eguiactivationlang.dll
%ProgramFiles%\eset\eset security\eguiamonlang.dll
%ProgramFiles%\eset\eset security\eguiantitheftlang.dll
%ProgramFiles%\eset\eset security\ekrnantitheftlang.dll
%ProgramFiles%\eset\eset security\eguidemeterlang.dll
%ProgramFiles%\eset\eset security\ekrnamonlang.dll
%ProgramFiles%\eset\eset security\eguiepfwlang.dll
%ProgramFiles%\eset\eset security\eguilang.dll
%ProgramFiles%\eset\eset security\eguionlinehelplang.dll
%ProgramFiles%\eset\eset security\eguiparentallang.dll
%ProgramFiles%\eset\eset security\eguiscanlang.dll
%ProgramFiles%\eset\eset security\eguismonlang.dll
%ProgramFiles%\eset\eset security\eguiupdatelang.dll
%ProgramFiles%\eset\eset security\eguidevmonlang.dll
%ProgramFiles%\eset\eset security\updater.dll
%ProgramFiles%\eset\eset security\eguihipslang.dll
%TEMP%\eset\64\[productdir]\drivers\epfwlwf\epfwlwf.sys
%ProgramFiles%\eset\eset security\sysinspectorlang.dll
%ALLUSERSPROFILE%\eset\eset security\updfiles\em000_64_l0_.dll.nup
%ProgramFiles%\eset\eset security\help\helpman_settings.js
%ProgramFiles%\eset\eset security\help\helpman_topicinit.js
%ProgramFiles%\eset\eset security\help\highlight.js
%ProgramFiles%\eset\eset security\help\hmcontent.htm
%ProgramFiles%\eset\eset security\help\hmcontextids.js
%ProgramFiles%\eset\eset security\help\hmftsearch.htm
%ProgramFiles%\eset\eset security\help\copyright.png
%ProgramFiles%\eset\eset security\help\cicon_loadindex_ani.gif
%ProgramFiles%\eset\eset security\help\helpman_navigation.js
%ProgramFiles%\eset\eset security\help\hmkwindex.htm
%ProgramFiles%\eset\eset security\help\idh_config_update_connection.htm
%ProgramFiles%\eset\eset security\help\idh_config_update_mode.htm
%ProgramFiles%\eset\eset security\help\idh_config_update_source.htm
%ProgramFiles%\eset\eset security\help\idh_page_update.htm
%ProgramFiles%\eset\eset security\help\idh_wizard_activation_type.htm
%ProgramFiles%\eset\eset security\help\index.html
%ProgramFiles%\eset\eset security\help\icon_details_hover.png
%ProgramFiles%\eset\eset security\help\icon_section.png
%ProgramFiles%\eset\eset security\help\idh_config_update_advanced.htm
%ProgramFiles%\eset\eset security\help\default.css
%ProgramFiles%\eset\eset security\shellextlang.dll
%ProgramFiles%\eset\eset security\ekrnepfwlang.dll
%ALLUSERSPROFILE%\eset\eset security\updfiles\em000k_64_l0_.dll.nup
%ALLUSERSPROFILE%\eset\eset security\updfiles\em006_64_l0_.dll.nup
%ALLUSERSPROFILE%\eset\eset security\updfiles\em006_64_l1_.dll.nup
%ALLUSERSPROFILE%\eset\eset security\updfiles\em017_64_l0_.dll.nup
%ALLUSERSPROFILE%\eset\eset security\updfiles\em017_64_l1_.dll.nup
%ALLUSERSPROFILE%\eset\eset security\updfiles\em017_64_l2_.dll.nup
%ProgramFiles%\eset\eset security\help\ciconidx.gif
%ProgramFiles%\eset\eset security\sysrescue.url
%ProgramFiles%\eset\eset security\help\cicon9.png
%ALLUSERSPROFILE%\eset\eset security\updfiles\em033_64_l0_.dll.nup
%ProgramFiles%\eset\eset security\x86\etpcomm.dll
%ProgramFiles%\eset\eset security\eula.html
%ProgramFiles%\eset\eset security\eula.rtf
%ProgramFiles%\eset\eset security\help\blank.png
%ProgramFiles%\eset\eset security\help\cicon1.png
%ProgramFiles%\eset\eset security\help\cicon2.png
%ALLUSERSPROFILE%\eset\eset security\updfiles\em033_64_l1_.dll.nup
%ProgramFiles%\eset\eset security\eguiproduct.dll
%ProgramFiles%\eset\eset security\etpcomm.dll
%TEMP%\eset\64\[productdir]\drivers\ekbdflt\ekbdflt.sys
%TEMP%\eset\[productdir]\drivers\ekbdflt\ekbdflt.sys
%TEMP%\eset\64\[productdir]\drivers\ehdrv\ehdrv.sys
%TEMP%\eset\[productdir]\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\eset\[productdir]\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-file-l2-1-0.dll
%TEMP%\eset\64\[productdir]\sysinspector.exe
%TEMP%\eset\[productdir]\sysinspector.exe
%TEMP%\eset\[productdir]\api-ms-win-core-console-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-console-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-file-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-file-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-file-l1-2-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-file-l1-2-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-file-l2-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\eset\64\[productdir]\eoppframe.exe
%TEMP%\eset\[productdir]\ekrn.exe
%TEMP%\eset\64\[productdir]\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-string-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\eset\[productdir]\eoppframe.exe
%TEMP%\eset\64\[productdir]\ekrn.exe
%TEMP%\eset\64\[productdir]\egui.exe
%TEMP%\eset\[productdir]\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-string-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-util-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-util-l1-1-0.dll
%TEMP%\eset\[productdir]\egui.exe
%TEMP%\eset\[productdir]\eeclnt.exe
%TEMP%\eset\appdatadir\updfiles\em000_32_l0_.dll.nup
%TEMP%\eset\64\[productdir]\drivers\ehdrv\ehdrv.cat
%TEMP%\eset\[productdir]\drivers\ekbdflt\ekbdflt.cat
%TEMP%\eset\64\[productdir]\drivers\ekbdflt\ekbdflt.cat
%TEMP%\eset\[productdir]\drivers\epfw\epfw.cat
%TEMP%\eset\64\[productdir]\drivers\epfw\epfw.cat
%TEMP%\eset\[productdir]\drivers\epfwlwf\epfwlwf.cat
%TEMP%\eset\[productdir]\drivers\eelam\eelam.cat
%TEMP%\eset\[productdir]\notice
%TEMP%\eset\[productdir]\drivers\ehdrv\ehdrv.cat
%TEMP%\eset\64\[productdir]\drivers\epfwlwf\epfwlwf.cat
%TEMP%\eset\64\[productdir]\drivers\epfwtdi\epfwtdi.cat
%TEMP%\eset\[productdir]\drivers\epfwtdir\epfwtdir.cat
%TEMP%\eset\64\[productdir]\drivers\epfwtdir\epfwtdir.cat
%TEMP%\eset\[productdir]\drivers\epfwwfp\epfwwfp.cat
%TEMP%\eset\64\[productdir]\drivers\epfwwfp\epfwwfp.cat
%TEMP%\eset\[productdir]\drivers\eamonm\eamonm.inf
%TEMP%\eset\[productdir]\drivers\epfwndis\epfwndis.cat
%TEMP%\eset\64\[productdir]\drivers\epfwndis\epfwndis.cat
%TEMP%\eset\[productdir]\drivers\epfwtdi\epfwtdi.cat
%TEMP%\eset\[productdir]\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\eset\[productdir]\drivers\edevmon\edevmon.inf
%TEMP%\eset\64\[productdir]\drivers\eamonm\eamonm.cat
%TEMP%\aut7964.tmp
%WINDIR%\prefetch\test\install.cmd
%TEMP%\aut7975.tmp
%WINDIR%\prefetch\test\setup.exe
%TEMP%\nslbb34.tmp\eav.eis.essp.v11.2.63.0.pkg
%TEMP%\nslbb34.tmp\tnod.exe
%TEMP%\nslbb34.tmp\system.dll
%TEMP%\eset\[productdir]\drivers\edevmon\edevmon.cat
%TEMP%\eset\64\[productdir]\drivers\edevmon\edevmon.cat
%TEMP%\nslbb34.tmp\nsis7z.dll
%TEMP%\eset\[productdir]\help\help.cab
%TEMP%\eset\32.msi
%TEMP%\eset\64.msi
%TEMP%\eset\64\appdatadir\installer\deslockinstaller.msi
%TEMP%\eset\cfg.xml
%TEMP%\eset\[productdir]\securityproductinformation.ini
%TEMP%\eset\[productdir]\drivers\eamonm\eamonm.cat
%WINDIR%\prefetch\test\mystery.gif
%TEMP%\eset\[productdir]\eula.cab
<DRIVERS>\setdfb6.tmp
%TEMP%\eset\[productdir]\drivers\eelam\eelam.inf
%TEMP%\eset\[productdir]\drivers\epfw\epfw.inf
%TEMP%\eset\appdatadir\updfiles\em033_32_l1_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em033_64_l0_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em033_64_l1_.dll.nup
%TEMP%\eset\[productdir]\sysrescue.url
%TEMP%\eset\64\[productdir]\callmsi.exe
%TEMP%\eset\[productdir]\callmsi.exe
%TEMP%\eset\64\[productdir]\ecapture.exe
%TEMP%\eset\[productdir]\drivers\ehdrv\ehdrv.inf
%TEMP%\eset\appdatadir\updfiles\em033_32_l0_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em017_64_l2_.dll.nup
%TEMP%\eset\64\[productdir]\ecmd.exe
%TEMP%\eset\[productdir]\ecmd.exe
%TEMP%\eset\64\[productdir]\ecmds.exe
%TEMP%\eset\[productdir]\ecmds.exe
%TEMP%\eset\64\[productdir]\ecomserver.exe
%TEMP%\eset\[productdir]\ecomserver.exe
%TEMP%\eset\64\[productdir]\eeclnt.exe
%TEMP%\eset\[productdir]\ecapture.exe
%TEMP%\eset\[productdir]\ecls.exe
%TEMP%\eset\[productdir]\drivers\ekbdflt\ekbdflt.inf
%TEMP%\eset\64\[productdir]\ecls.exe
%TEMP%\eset\64\[productdir]\drivers\eelam\eelam.cat
%TEMP%\eset\[productdir]\drivers\epfwlwf\epfwlwf.inf
%TEMP%\eset\[productdir]\drivers\epfwndis\epfwndis.inf
%TEMP%\eset\[productdir]\drivers\epfwndis\epfwnd_m.inf
%TEMP%\eset\[productdir]\drivers\epfwtdi\epfwtdi.inf
%TEMP%\eset\[productdir]\drivers\epfwtdir\epfwtdir.inf
%TEMP%\eset\[productdir]\drivers\epfwwfp\epfwwfp.inf
%TEMP%\eset\appdatadir\updfiles\em000k_32_l0_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em017_32_l2_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em017_64_l1_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em017_64_l0_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em006_32_l0_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em006_32_l1_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em006_32_l2_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em006_64_l0_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em006_64_l1_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em017_32_l0_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em017_32_l1_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em000k_64_l0_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em000_64_l0_.dll.nup
%ALLUSERSPROFILE%\eset\eset security\logs\devctrllog.dat
%TEMP%\eset\64\[productdir]\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\eset\64\[productdir]\dmon.dll
%TEMP%\eset\[productdir]\eoppbrowser.dll
%TEMP%\eset\[productdir]\x86\eoppbrowser.dll
%TEMP%\eset\64\[productdir]\eplghooks.dll
%TEMP%\eset\[productdir]\eplghooks.dll
%TEMP%\eset\[productdir]\x86\eplghooks.dll
%TEMP%\eset\64\[productdir]\eplgoe.dll
%TEMP%\eset\[productdir]\ekrnupdatelang.dll
%TEMP%\eset\[productdir]\eplgoe.dll
%TEMP%\eset\64\[productdir]\eplgoeemon.dll
%TEMP%\eset\[productdir]\eplgoeemon.dll
%TEMP%\eset\[productdir]\x86\eplgoeemon.dll
%TEMP%\eset\[productdir]\eplgoelang.dll
%TEMP%\eset\64\[productdir]\eplgoesmon.dll
%TEMP%\eset\[productdir]\eplgoesmon.dll
%TEMP%\eset\[productdir]\x86\eplgoesmon.dll
%TEMP%\eset\[productdir]\ekrnwebcontrol.dll
%TEMP%\eset\[productdir]\x86\eplgoe.dll
%TEMP%\eset\64\[productdir]\eoppbrowser.dll
%TEMP%\eset\[productdir]\ekrnwebcontrollang.dll
%TEMP%\eset\64\[productdir]\ekrnwebcontrol.dll
%TEMP%\eset\[productdir]\ekrnupdate.dll
%TEMP%\eset\[productdir]\ekrnopp.dll
%TEMP%\eset\[productdir]\ekrnopplang.dll
%TEMP%\eset\64\[productdir]\ekrnparental.dll
%TEMP%\eset\[productdir]\ekrnparental.dll
%TEMP%\eset\[productdir]\ekrnparentallang.dll
%TEMP%\eset\[productdir]\eplgoesmonlang.dll
%TEMP%\eset\[productdir]\ekrnmailplugins.dll
%TEMP%\eset\64\[productdir]\ekrnscan.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\eset\64\[productdir]\ekrnscriptmon.dll
%TEMP%\eset\[productdir]\ekrnscriptmonlang.dll
%TEMP%\eset\64\[productdir]\ekrnsmon.dll
%TEMP%\eset\[productdir]\ekrnsmon.dll
%TEMP%\eset\[productdir]\ekrnsmonlang.dll
%TEMP%\eset\64\[productdir]\ekrnupdate.dll
%TEMP%\eset\[productdir]\ekrnscan.dll
%TEMP%\eset\[productdir]\ekrnscanlang.dll
%TEMP%\eset\64\[productdir]\eplgoutlook.dll
%TEMP%\eset\[productdir]\ekrnscriptmon.dll
%TEMP%\eset\[productdir]\eplgoutlook.dll
%TEMP%\eset\[productdir]\sysinspectorlang.dll
%TEMP%\eset\[productdir]\eplgoutlookemon.dll
%TEMP%\eset\[productdir]\toastnotify.dll
%TEMP%\eset\64\[productdir]\ucrtbase.dll
%TEMP%\eset\[productdir]\ucrtbase.dll
%TEMP%\eset\64\[productdir]\updater.dll
%TEMP%\eset\[productdir]\updater.dll
%TEMP%\eset\[productdir]\vcruntime140.dll
%TEMP%\eset\[productdir]\shellextlang.dll
%TEMP%\eset\[productdir]\x86\shellext.dll
%TEMP%\eset\64\[productdir]\toastnotify.dll
%TEMP%\eset\64\[productdir]\vcruntime140.dll
%TEMP%\eset\64\[productdir]\drivers\eamonm\eamonm.sys
%TEMP%\eset\[productdir]\drivers\edevmon\edevmon.sys
%TEMP%\eset\64\[productdir]\drivers\edevmon\edevmon.sys
%TEMP%\eset\[productdir]\drivers\eelam\eelam.sys
%TEMP%\eset\64\[productdir]\drivers\eelam\eelam.sys
%TEMP%\eset\[productdir]\drivers\ehdrv\ehdrv.sys
%TEMP%\eset\[productdir]\windowsperformancerecordercontrol.dll
%TEMP%\eset\64\[productdir]\windowsperformancerecordercontrol.dll
%TEMP%\eset\[productdir]\drivers\eamonm\eamonm.sys
%TEMP%\eset\64\[productdir]\ekrnopp.dll
%TEMP%\eset\64\[productdir]\ekrnmailplugins.dll
%TEMP%\eset\[productdir]\x86\eplgoutlook.dll
%TEMP%\eset\[productdir]\x86\eplgoutlookemon.dll
%TEMP%\eset\[productdir]\eplgoutlookemonlang.dll
%TEMP%\eset\[productdir]\eplgoutlooklang.dll
%TEMP%\eset\64\[productdir]\eplgoutlooksmon.dll
%TEMP%\eset\[productdir]\eplgoutlooksmon.dll
%TEMP%\eset\[productdir]\x86\eplgoutlooksmon.dll
%TEMP%\eset\[productdir]\shellext.dll
%TEMP%\eset\64\[productdir]\eplgoutlookemon.dll
%TEMP%\eset\64\[productdir]\shellext.dll
%TEMP%\eset\[productdir]\eplgoutlooksmonlang.dll
%TEMP%\eset\64\[productdir]\instsuppex.dll
%TEMP%\eset\[productdir]\instsuppex.dll
%TEMP%\eset\[productdir]\msvcp140.dll
%TEMP%\eset\64\[productdir]\msvcp140.dll
%TEMP%\eset\64\[productdir]\sciter-x.dll
%TEMP%\eset\[productdir]\sciter-x.dll
%TEMP%\eset\64\[productdir]\etpcomm.dll
%TEMP%\eset\[productdir]\etpcomm.dll
%TEMP%\eset\[productdir]\x86\etpcomm.dll
%TEMP%\eset\[productdir]\ekrnmailpluginslang.dll
%TEMP%\eset\[productdir]\ekrnlicensinglang.dll
%TEMP%\eset\[productdir]\ekrnlicensing.dll
%TEMP%\eset\64\[productdir]\eguiemon.dll
%TEMP%\eset\[productdir]\eguiemon.dll
%TEMP%\eset\64\[productdir]\eguiepfw.dll
%TEMP%\eset\[productdir]\eguiepfw.dll
%TEMP%\eset\[productdir]\eguiepfwlang.dll
%TEMP%\eset\[productdir]\eguidevmon.dll
%TEMP%\eset\[productdir]\eguiactivation.dll
%TEMP%\eset\64\[productdir]\eguihips.dll
%TEMP%\eset\[productdir]\eguidmon.dll
%TEMP%\eset\64\[productdir]\eguiipm.dll
%TEMP%\eset\[productdir]\eguilang.dll
%TEMP%\eset\64\[productdir]\eguimailplugins.dll
%TEMP%\eset\[productdir]\eguimailplugins.dll
%TEMP%\eset\64\[productdir]\eguionlinehelp.dll
%TEMP%\eset\[productdir]\eguionlinehelp.dll
%TEMP%\eset\[productdir]\eguihips.dll
%TEMP%\eset\[productdir]\eguihipslang.dll
%TEMP%\eset\[productdir]\cfgres.dll
%TEMP%\eset\[productdir]\eguiipm.dll
%TEMP%\eset\64\[productdir]\eguiparental.dll
%TEMP%\eset\64\[productdir]\eguidmon.dll
%TEMP%\eset\64\[productdir]\eguidevmon.dll
%TEMP%\eset\[productdir]\dmon.dll
%TEMP%\eset\[productdir]\x86\dmon.dll
%TEMP%\eset\64\[productdir]\eamsi.dll
%TEMP%\eset\[productdir]\eamsi.dll
%TEMP%\eset\[productdir]\x86\eamsi.dll
%TEMP%\eset\[productdir]\eclslang.dll
%TEMP%\eset\[productdir]\eguidemeterlang.dll
%TEMP%\eset\64\[productdir]\eguiactivation.dll
%TEMP%\eset\[productdir]\eguionlinehelplang.dll
%TEMP%\eset\[productdir]\eguiactivationlang.dll
%TEMP%\eset\[productdir]\eguiamon.dll
%TEMP%\eset\[productdir]\eguiamonlang.dll
%TEMP%\eset\64\[productdir]\eguiantitheft.dll
%TEMP%\eset\[productdir]\eguiantitheft.dll
%TEMP%\eset\[productdir]\eguiantitheftlang.dll
%TEMP%\eset\64\[productdir]\eguidemeter.dll
%TEMP%\eset\64\[productdir]\concrt140.dll
%TEMP%\eset\[productdir]\eguidemeter.dll
%TEMP%\eset\64\[productdir]\eguiamon.dll
%TEMP%\eset\[productdir]\concrt140.dll
%TEMP%\eset\[productdir]\eguiparentallang.dll
%TEMP%\eset\64\[productdir]\eguiscan.dll
%TEMP%\eset\[productdir]\ekrndmon.dll
%TEMP%\eset\[productdir]\ekrndmonlang.dll
%TEMP%\eset\64\[productdir]\ekrnecp.dll
%TEMP%\eset\[productdir]\ekrnecp.dll
%TEMP%\eset\64\[productdir]\ekrnemon.dll
%TEMP%\eset\[productdir]\ekrnemon.dll
%TEMP%\eset\[productdir]\eguiparental.dll
%TEMP%\eset\[productdir]\ekrndevmon.dll
%TEMP%\eset\64\[productdir]\ekrndmon.dll
%TEMP%\eset\[productdir]\ekrnepfw.dll
%TEMP%\eset\64\[productdir]\ekrnhips.dll
%TEMP%\eset\[productdir]\ekrnhips.dll
%TEMP%\eset\[productdir]\ekrnhipslang.dll
%TEMP%\eset\64\[productdir]\ekrnipm.dll
%TEMP%\eset\[productdir]\ekrnipm.dll
%TEMP%\eset\[productdir]\ekrnlang.dll
%TEMP%\eset\[productdir]\ekrnemonlang.dll
%TEMP%\eset\64\[productdir]\ekrnlicensing.dll
%TEMP%\eset\[productdir]\ekrnepfwlang.dll
%TEMP%\eset\[productdir]\eguiproduct.dll
%TEMP%\eset\[productdir]\ekrndevmonlang.dll
%TEMP%\eset\64\[productdir]\ekrndevmon.dll
%TEMP%\eset\[productdir]\eguiscan.dll
%TEMP%\eset\[productdir]\eguiscanlang.dll
%TEMP%\eset\64\[productdir]\eguismon.dll
%TEMP%\eset\[productdir]\eguismon.dll
%TEMP%\eset\[productdir]\eguismonlang.dll
%TEMP%\eset\64\[productdir]\eguiupdate.dll
%TEMP%\eset\64\[productdir]\ekrndemeter.dll
%TEMP%\eset\[productdir]\ekrndemeter.dll
%TEMP%\eset\64\[productdir]\ekrnepfw.dll
%TEMP%\eset\64\[productdir]\ekrnamon.dll
%TEMP%\eset\[productdir]\ekrnamonlang.dll
%TEMP%\eset\64\[productdir]\ekrnantitheft.dll
%TEMP%\eset\[productdir]\ekrnantitheft.dll
%TEMP%\eset\[productdir]\ekrnantitheftlang.dll
%TEMP%\eset\64\[productdir]\ekrncerberus.dll
%TEMP%\eset\[productdir]\ekrncerberus.dll
%TEMP%\eset\[productdir]\eguiupdate.dll
%TEMP%\eset\[productdir]\eguidevmonlang.dll
%TEMP%\eset\[productdir]\ekrnamon.dll
%TEMP%\tnod.exe

Sets the 'hidden' attribute to the following files

<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem2.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem3.cat
<SYSTEM32>\catroot\{f750e6c3-38ee-11d1-85e5-00c04fc295ee}\oem4.cat

Deletes the following files

%TEMP%\aut7944.tmp
%TEMP%\eset\[productdir]\ecapture.exe
%TEMP%\eset\[productdir]\eamsi.dll
%TEMP%\eset\[productdir]\drivers\epfwwfp\epfwwfp.sys
%TEMP%\eset\[productdir]\drivers\epfwwfp\epfwwfp.inf
%TEMP%\eset\[productdir]\drivers\epfwwfp\epfwwfp.cat
%TEMP%\eset\[productdir]\drivers\epfwtdir\epfwtdir.sys
%TEMP%\eset\[productdir]\drivers\epfwtdir\epfwtdir.inf
%TEMP%\eset\[productdir]\drivers\epfwtdir\epfwtdir.cat
%TEMP%\eset\[productdir]\drivers\epfwtdi\epfwtdi.sys
%TEMP%\eset\[productdir]\drivers\epfwtdi\epfwtdi.inf
%TEMP%\eset\[productdir]\drivers\epfwtdi\epfwtdi.cat
%TEMP%\eset\[productdir]\drivers\epfwndis\epfwnd_m.inf
%TEMP%\eset\[productdir]\drivers\epfwndis\epfwndis.sys
%TEMP%\eset\[productdir]\drivers\epfwndis\epfwndis.inf
%TEMP%\eset\[productdir]\drivers\epfwndis\epfwndis.cat
%TEMP%\eset\[productdir]\drivers\epfwlwf\epfwlwf.sys
%TEMP%\eset\[productdir]\drivers\epfwlwf\epfwlwf.inf
%TEMP%\eset\[productdir]\drivers\epfwlwf\epfwlwf.cat
%TEMP%\eset\[productdir]\drivers\epfw\epfw.sys
%TEMP%\eset\[productdir]\drivers\epfw\epfw.inf
%TEMP%\eset\[productdir]\drivers\epfw\epfw.cat
%TEMP%\eset\[productdir]\drivers\ekbdflt\ekbdflt.inf
%TEMP%\eset\[productdir]\drivers\ekbdflt\ekbdflt.sys
%TEMP%\eset\[productdir]\ecls.exe
%TEMP%\eset\[productdir]\eclslang.dll
%TEMP%\eset\[productdir]\eguiipm.dll
%TEMP%\eset\[productdir]\eguihipslang.dll
%TEMP%\eset\[productdir]\eguihips.dll
%TEMP%\eset\[productdir]\eguiepfwlang.dll
%TEMP%\eset\[productdir]\eguiepfw.dll
%TEMP%\eset\[productdir]\eguiemon.dll
%TEMP%\eset\[productdir]\eguidmon.dll
%TEMP%\eset\[productdir]\eguidevmonlang.dll
%TEMP%\eset\[productdir]\eguidevmon.dll
%TEMP%\eset\[productdir]\eguidemeterlang.dll
%TEMP%\eset\[productdir]\eguiantitheftlang.dll
%TEMP%\eset\[productdir]\concrt140.dll
%TEMP%\eset\[productdir]\eguiantitheft.dll
%TEMP%\eset\[productdir]\eguiamonlang.dll
%TEMP%\eset\[productdir]\eguiamon.dll
%TEMP%\eset\[productdir]\eguiactivationlang.dll
%TEMP%\eset\[productdir]\eguiactivation.dll
%TEMP%\eset\[productdir]\egui.exe
%TEMP%\eset\[productdir]\eeclnt.exe
%TEMP%\eset\[productdir]\ecomserver.exe
%TEMP%\eset\[productdir]\ecmds.exe
%TEMP%\eset\[productdir]\ecmd.exe
%TEMP%\eset\[productdir]\drivers\ekbdflt\ekbdflt.cat
%TEMP%\eset\[productdir]\drivers\ehdrv\ehdrv.sys
%TEMP%\eset\[productdir]\drivers\ehdrv\ehdrv.inf
%TEMP%\eset\[productdir]\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-util-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-string-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\eset\[productdir]\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\eset\[productdir]\drivers\ehdrv\ehdrv.cat
%TEMP%\eset\[productdir]\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\eset\[productdir]\drivers\eelam\eelam.sys
%TEMP%\eset\[productdir]\drivers\eelam\eelam.inf
%TEMP%\eset\[productdir]\drivers\eelam\eelam.cat
%TEMP%\eset\[productdir]\drivers\edevmon\edevmon.sys
%TEMP%\eset\[productdir]\drivers\edevmon\edevmon.inf
%TEMP%\eset\[productdir]\drivers\edevmon\edevmon.cat
%TEMP%\eset\[productdir]\drivers\eamonm\eamonm.sys
%TEMP%\eset\[productdir]\drivers\eamonm\eamonm.inf
%TEMP%\eset\[productdir]\drivers\eamonm\eamonm.cat
%TEMP%\eset\[productdir]\eguidemeter.dll
%TEMP%\eset\[productdir]\eguilang.dll
%TEMP%\eset\[productdir]\cfgres.dll
%TEMP%\eset\[productdir]\callmsi.exe
%TEMP%\eset\[productdir]\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\eset\[productdir]\dmon.dll
%TEMP%\eset\[productdir]\eguimailplugins.dll
%TEMP%\eset\[productdir]\eguionlinehelp.dll
%TEMP%\eset\[productdir]\eguionlinehelplang.dll
%TEMP%\eset\[productdir]\sysinspector.exe
%TEMP%\eset\[productdir]\shellextlang.dll
%TEMP%\eset\[productdir]\shellext.dll
%TEMP%\eset\[productdir]\securityproductinformation.ini
%TEMP%\eset\[productdir]\sciter-x.dll
%TEMP%\eset\[productdir]\notice
%TEMP%\eset\[productdir]\msvcp140.dll
%TEMP%\eset\[productdir]\instsuppex.dll
%TEMP%\eset\[productdir]\help\help.cab
%TEMP%\eset\[productdir]\eula.cab
%TEMP%\eset\[productdir]\etpcomm.dll
%TEMP%\eset\[productdir]\eplgoutlooksmonlang.dll
%TEMP%\eset\[productdir]\eplgoutlooksmon.dll
%TEMP%\eset\[productdir]\eplgoutlooklang.dll
%TEMP%\eset\[productdir]\eplgoutlookemonlang.dll
%TEMP%\eset\[productdir]\eplgoutlookemon.dll
%TEMP%\eset\[productdir]\eplgoutlook.dll
%TEMP%\eset\[productdir]\eplgoesmonlang.dll
%TEMP%\eset\[productdir]\eplgoesmon.dll
%TEMP%\eset\[productdir]\eplgoelang.dll
%TEMP%\eset\[productdir]\eplgoeemon.dll
%TEMP%\eset\[productdir]\sysinspectorlang.dll
%TEMP%\eset\[productdir]\sysrescue.url
%TEMP%\eset\[productdir]\toastnotify.dll
%TEMP%\eset\[productdir]\ucrtbase.dll
%WINDIR%\prefetch\test\install.cmd
%TEMP%\nslbb34.tmp\tnod.exe
%TEMP%\nslbb34.tmp\system.dll
%TEMP%\nslbb34.tmp\nsis7z.dll
%TEMP%\nslbb34.tmp\nsexec.dll
%TEMP%\nslbb34.tmp\eav.eis.essp.v11.2.63.0.pkg
%TEMP%\tnod.exe
%TEMP%\eset\[productdir]\x86\shellext.dll
%TEMP%\eset\[productdir]\x86\etpcomm.dll
%TEMP%\eset\[productdir]\x86\eplgoutlooksmon.dll
%TEMP%\eset\[productdir]\x86\eplgoutlook.dll
%TEMP%\eset\[productdir]\x86\eplgoutlookemon.dll
%TEMP%\eset\[productdir]\x86\eplgoesmon.dll
%TEMP%\eset\[productdir]\x86\eplgoeemon.dll
%TEMP%\eset\[productdir]\x86\eplgoe.dll
%TEMP%\eset\[productdir]\x86\eplghooks.dll
%TEMP%\eset\[productdir]\x86\eoppbrowser.dll
%TEMP%\eset\[productdir]\x86\eamsi.dll
%TEMP%\eset\[productdir]\x86\dmon.dll
%TEMP%\eset\[productdir]\windowsperformancerecordercontrol.dll
%TEMP%\eset\[productdir]\vcruntime140.dll
%TEMP%\eset\[productdir]\updater.dll
%TEMP%\eset\[productdir]\api-ms-win-core-file-l2-1-0.dll
%TEMP%\eset\[productdir]\ekrnparental.dll
%TEMP%\eset\[productdir]\eplghooks.dll
%TEMP%\eset\[productdir]\eoppframe.exe
%TEMP%\eset\[productdir]\ekrnecp.dll
%TEMP%\eset\[productdir]\ekrndmonlang.dll
%TEMP%\eset\[productdir]\ekrndmon.dll
%TEMP%\eset\[productdir]\ekrndevmonlang.dll
%TEMP%\eset\[productdir]\ekrndevmon.dll
%TEMP%\eset\[productdir]\ekrndemeter.dll
%TEMP%\eset\[productdir]\ekrncerberus.dll
%TEMP%\eset\[productdir]\ekrnantitheftlang.dll
%TEMP%\eset\[productdir]\ekrnantitheft.dll
%TEMP%\eset\[productdir]\ekrnamonlang.dll
%TEMP%\eset\[productdir]\ekrnamon.dll
%TEMP%\eset\[productdir]\ekrn.exe
%TEMP%\eset\[productdir]\eguiupdatelang.dll
%TEMP%\eset\[productdir]\eguiupdate.dll
%TEMP%\eset\[productdir]\eguismonlang.dll
%TEMP%\eset\[productdir]\eguismon.dll
%TEMP%\eset\[productdir]\eguiscanlang.dll
%TEMP%\eset\[productdir]\eguiscan.dll
%TEMP%\eset\[productdir]\eguiproduct.dll
%TEMP%\eset\[productdir]\eguiparentallang.dll
%TEMP%\eset\[productdir]\eguiparental.dll
%TEMP%\eset\[productdir]\ekrnemon.dll
%TEMP%\eset\[productdir]\ekrnemonlang.dll
%TEMP%\eset\[productdir]\ekrnepfw.dll
%TEMP%\eset\[productdir]\ekrnepfwlang.dll
%TEMP%\eset\[productdir]\ekrnwebcontrollang.dll
%TEMP%\eset\[productdir]\ekrnwebcontrol.dll
%TEMP%\eset\[productdir]\ekrnupdatelang.dll
%TEMP%\eset\[productdir]\ekrnupdate.dll
%TEMP%\eset\[productdir]\ekrnsmonlang.dll
%TEMP%\eset\[productdir]\ekrnsmon.dll
%TEMP%\eset\[productdir]\ekrnscriptmonlang.dll
%TEMP%\eset\[productdir]\ekrnscriptmon.dll
%TEMP%\eset\[productdir]\ekrnscanlang.dll
%TEMP%\eset\[productdir]\ekrnscan.dll
%WINDIR%\prefetch\test\mystery.gif
%TEMP%\eset\[productdir]\ekrnparentallang.dll
%TEMP%\eset\[productdir]\ekrnopplang.dll
%TEMP%\eset\[productdir]\ekrnopp.dll
%TEMP%\eset\[productdir]\ekrnmailpluginslang.dll
%TEMP%\eset\[productdir]\ekrnmailplugins.dll
%TEMP%\eset\[productdir]\ekrnlicensinglang.dll
%TEMP%\eset\[productdir]\ekrnlicensing.dll
%TEMP%\eset\[productdir]\ekrnlang.dll
%TEMP%\eset\[productdir]\ekrnipm.dll
%TEMP%\eset\[productdir]\ekrnhipslang.dll
%TEMP%\eset\[productdir]\ekrnhips.dll
%TEMP%\eset\[productdir]\eoppbrowser.dll
%TEMP%\eset\[productdir]\eplgoe.dll
%TEMP%\eset\[productdir]\api-ms-win-core-file-l1-2-0.dll
%TEMP%\eset\64\[productdir]\ekrnsmon.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-filesystem-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-environment-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-convert-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-conio-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-util-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-timezone-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-sysinfo-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-synch-l1-2-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-synch-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-string-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-rtlsupport-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-profile-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-processthreads-l1-1-1.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-processthreads-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-processenvironment-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-namedpipe-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-memory-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-localization-l1-2-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-libraryloader-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-interlocked-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-heap-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-file-l2-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-handle-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-heap-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-locale-l1-1-0.dll
%TEMP%\eset\64\[productdir]\drivers\ekbdflt\ekbdflt.sys
%TEMP%\eset\64\[productdir]\drivers\ekbdflt\ekbdflt.cat
%TEMP%\eset\64\[productdir]\drivers\ehdrv\ehdrv.sys
%TEMP%\eset\64\[productdir]\drivers\ehdrv\ehdrv.cat
%TEMP%\eset\64\[productdir]\drivers\eelam\eelam.sys
%TEMP%\eset\64\[productdir]\drivers\eelam\eelam.cat
%TEMP%\eset\64\[productdir]\drivers\edevmon\edevmon.sys
%TEMP%\eset\64\[productdir]\drivers\edevmon\edevmon.cat
%TEMP%\eset\64\[productdir]\drivers\eamonm\eamonm.sys
%TEMP%\eset\64\[productdir]\drivers\eamonm\eamonm.cat
%TEMP%\eset\64\[productdir]\concrt140.dll
%WINDIR%\temp\{0c64d446-c270-0390-457e-c74c8269e14e}\eamonm.inf
%TEMP%\eset\64\[productdir]\callmsi.exe
%TEMP%\eset\64\[productdir]\api-ms-win-crt-utility-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-time-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-string-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-stdio-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-runtime-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-process-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-private-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-multibyte-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-crt-math-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-file-l1-2-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-file-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\nup4820.tmp
%TEMP%\nup4711.tmp
%TEMP%\nsf46d0.tmp
%TEMP%\nup46cf.tmp
%TEMP%\nsf46be.tmp
%TEMP%\nup46e0.tmp
%TEMP%\nup46bd.tmp
%TEMP%\nsf469d.tmp
%TEMP%\nsf4498.tmp
%TEMP%\nsf437d.tmp
%TEMP%\nsf436d.tmp
%TEMP%\nsf434c.tmp
%TEMP%\nsf434b.tmp
%TEMP%\nsf432b.tmp
%TEMP%\nsf432a.tmp
%TEMP%\nsf431a.tmp
%TEMP%\nsf4319.tmp
%TEMP%\nsf42aa.tmp
%TEMP%\aut7975.tmp
%TEMP%\aut7964.tmp
%TEMP%\nsf4712.tmp
%TEMP%\nup47ed.tmp
%TEMP%\nup4a72.tmp
%TEMP%\nsf47ee.tmp
%TEMP%\eset\64\[productdir]\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\nup47ff.tmp
%TEMP%\eset\64\[productdir]\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\eset\64\[productdir]\api-ms-win-core-console-l1-1-0.dll
%TEMP%\eset\64\appdatadir\installer\deslockinstaller.msi
%TEMP%\eset\32.msi
%WINDIR%\temp\epfwtrace.etl
%WINDIR%\temp\{55498d4b-185d-43e4-c9ce-a954ce4f8409}\epfwwfp.sys
%WINDIR%\temp\{55498d4b-185d-43e4-c9ce-a954ce4f8409}\epfwwfp.inf
%WINDIR%\temp\{55498d4b-185d-43e4-c9ce-a954ce4f8409}\epfwwfp.cat
%WINDIR%\temp\udddb70.tmp
%TEMP%\eset\64\[productdir]\dmon.dll
%TEMP%\eset\64\[productdir]\drivers\epfw\epfw.cat
%WINDIR%\temp\{0c64d446-c270-0390-457e-c74c8269e14e}\eamonm.cat
%WINDIR%\temp\{372ce8a5-e12a-1679-5d18-e443e92f3246}\ehdrv.sys
%WINDIR%\temp\{372ce8a5-e12a-1679-5d18-e443e92f3246}\ehdrv.inf
%WINDIR%\temp\{372ce8a5-e12a-1679-5d18-e443e92f3246}\ehdrv.cat
%TEMP%\nsf53ba.tmp
%TEMP%\nup53b9.tmp
%TEMP%\nsf537a.tmp
%TEMP%\nup53ea.tmp
%TEMP%\nup5369.tmp
%TEMP%\nsf4810.tmp
%WINDIR%\temp\{0c64d446-c270-0390-457e-c74c8269e14e}\eamonm.sys
%TEMP%\eset\64\[productdir]\drivers\epfw\epfw.sys
%TEMP%\eset\64\[productdir]\drivers\epfwlwf\epfwlwf.cat
%TEMP%\eset\64\[productdir]\drivers\epfwlwf\epfwlwf.sys
%TEMP%\eset\64\[productdir]\vcruntime140.dll
%TEMP%\eset\64\[productdir]\updater.dll
%TEMP%\eset\64\[productdir]\ucrtbase.dll
%TEMP%\eset\64\[productdir]\toastnotify.dll
%TEMP%\eset\64\[productdir]\sysinspector.exe
%TEMP%\eset\64\[productdir]\shellext.dll
%TEMP%\eset\64\[productdir]\sciter-x.dll
%TEMP%\eset\64\[productdir]\msvcp140.dll
%TEMP%\eset\64\[productdir]\instsuppex.dll
%TEMP%\eset\64\[productdir]\etpcomm.dll
%TEMP%\eset\64\[productdir]\eplgoutlooksmon.dll
%TEMP%\eset\64\[productdir]\eplgoutlookemon.dll
%TEMP%\eset\64\[productdir]\eplgoutlook.dll
%TEMP%\eset\64\[productdir]\eplgoesmon.dll
%TEMP%\eset\64\[productdir]\eplgoeemon.dll
%TEMP%\eset\64\[productdir]\eplgoe.dll
%TEMP%\eset\64\[productdir]\eplghooks.dll
%TEMP%\eset\64\[productdir]\eoppframe.exe
%TEMP%\eset\64\[productdir]\eoppbrowser.dll
%TEMP%\eset\64\[productdir]\ekrnwebcontrol.dll
%TEMP%\eset\64\[productdir]\ekrnupdate.dll
%TEMP%\eset\64\[productdir]\windowsperformancerecordercontrol.dll
%TEMP%\eset\64.msi
%TEMP%\eset\appdatadir\installer\deslockinstaller.msi
%TEMP%\eset\appdatadir\updfiles\em000k_32_l0_.dll.nup
%TEMP%\eset\[productdir]\api-ms-win-core-debug-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-datetime-l1-1-0.dll
%TEMP%\eset\[productdir]\api-ms-win-core-console-l1-1-0.dll
%TEMP%\eset\cfg.xml
%TEMP%\eset\appdatadir\updfiles\em033_64_l1_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em033_64_l0_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em033_32_l1_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em033_32_l0_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em017_64_l2_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em017_64_l1_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em017_32_l2_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em017_64_l0_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em017_32_l1_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em017_32_l0_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em006_64_l1_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em006_64_l0_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em006_32_l2_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em006_32_l1_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em006_32_l0_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em000_64_l0_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em000_32_l0_.dll.nup
%TEMP%\eset\appdatadir\updfiles\em000k_64_l0_.dll.nup
%TEMP%\eset\[productdir]\api-ms-win-core-file-l1-1-0.dll
%TEMP%\eset\64\[productdir]\ekrncerberus.dll
%TEMP%\eset\64\[productdir]\ekrnscriptmon.dll
%TEMP%\eset\64\[productdir]\ekrnscan.dll
%TEMP%\eset\64\[productdir]\eguidevmon.dll
%TEMP%\eset\64\[productdir]\eguidemeter.dll
%TEMP%\eset\64\[productdir]\eguiantitheft.dll
%TEMP%\eset\64\[productdir]\eguiamon.dll
%TEMP%\eset\64\[productdir]\eguiactivation.dll
%TEMP%\eset\64\[productdir]\egui.exe
%TEMP%\eset\64\[productdir]\eeclnt.exe
%TEMP%\eset\64\[productdir]\ecomserver.exe
%TEMP%\eset\64\[productdir]\ecmds.exe
%TEMP%\eset\64\[productdir]\ecmd.exe
%TEMP%\eset\64\[productdir]\ecls.exe
%TEMP%\eset\64\[productdir]\ecapture.exe
%TEMP%\eset\64\[productdir]\eamsi.dll
%TEMP%\eset\64\[productdir]\drivers\epfwwfp\epfwwfp.sys
%TEMP%\eset\64\[productdir]\drivers\epfwwfp\epfwwfp.cat
%TEMP%\eset\64\[productdir]\drivers\epfwtdir\epfwtdir.sys
%TEMP%\eset\64\[productdir]\drivers\epfwtdir\epfwtdir.cat
%TEMP%\eset\64\[productdir]\drivers\epfwtdi\epfwtdi.sys
%TEMP%\eset\64\[productdir]\drivers\epfwtdi\epfwtdi.cat
%TEMP%\eset\64\[productdir]\drivers\epfwndis\epfwndis.sys
%TEMP%\eset\64\[productdir]\drivers\epfwndis\epfwndis.cat
%TEMP%\eset\64\[productdir]\eguidmon.dll
%TEMP%\eset\64\[productdir]\eguiemon.dll
%TEMP%\eset\64\[productdir]\eguiepfw.dll
%TEMP%\eset\64\[productdir]\eguihips.dll
%TEMP%\eset\64\[productdir]\ekrnopp.dll
%TEMP%\eset\64\[productdir]\ekrnmailplugins.dll
%TEMP%\eset\64\[productdir]\ekrnlicensing.dll
%TEMP%\eset\64\[productdir]\ekrnipm.dll
%TEMP%\eset\64\[productdir]\ekrnhips.dll
%TEMP%\eset\64\[productdir]\ekrnepfw.dll
%TEMP%\eset\64\[productdir]\ekrnemon.dll
%TEMP%\eset\64\[productdir]\ekrnecp.dll
%TEMP%\eset\64\[productdir]\ekrndmon.dll
%TEMP%\eset\64\[productdir]\ekrndevmon.dll
%TEMP%\eset\[productdir]\api-ms-win-core-errorhandling-l1-1-0.dll
%TEMP%\eset\64\[productdir]\ekrndemeter.dll
%TEMP%\eset\64\[productdir]\ekrnantitheft.dll
%TEMP%\eset\64\[productdir]\ekrnamon.dll
%TEMP%\eset\64\[productdir]\ekrn.exe
%TEMP%\eset\64\[productdir]\eguiupdate.dll
%TEMP%\eset\64\[productdir]\eguismon.dll
%TEMP%\eset\64\[productdir]\eguiscan.dll
%TEMP%\eset\64\[productdir]\eguiparental.dll
%TEMP%\eset\64\[productdir]\eguionlinehelp.dll
%TEMP%\eset\64\[productdir]\eguimailplugins.dll
%TEMP%\eset\64\[productdir]\eguiipm.dll
%TEMP%\eset\64\[productdir]\ekrnparental.dll
%WINDIR%\prefetch\test\setup.exe

Moves the following files

from %ALLUSERSPROFILE%\eset\eset security\updfiles\em000k_64_l0_.dll.nup to %ALLUSERSPROFILE%\eset\eset security\updfiles\em000k_64_l0_20210829165311.dll.nup
from %WINDIR%\temp\{55498d4b-185d-43e4-c9ce-a954ce4f8409}\setaff5.tmp to %WINDIR%\temp\{55498d4b-185d-43e4-c9ce-a954ce4f8409}\epfwwfp.sys
from %WINDIR%\temp\{55498d4b-185d-43e4-c9ce-a954ce4f8409}\setaf2a.tmp to %WINDIR%\temp\{55498d4b-185d-43e4-c9ce-a954ce4f8409}\epfwwfp.inf
from %WINDIR%\temp\{55498d4b-185d-43e4-c9ce-a954ce4f8409}\setae3f.tmp to %WINDIR%\temp\{55498d4b-185d-43e4-c9ce-a954ce4f8409}\epfwwfp.cat
from %WINDIR%\temp\{0c64d446-c270-0390-457e-c74c8269e14e}\seta5d5.tmp to %WINDIR%\temp\{0c64d446-c270-0390-457e-c74c8269e14e}\eamonm.inf
from %WINDIR%\temp\{0c64d446-c270-0390-457e-c74c8269e14e}\seta509.tmp to %WINDIR%\temp\{0c64d446-c270-0390-457e-c74c8269e14e}\eamonm.cat
from %WINDIR%\temp\{0c64d446-c270-0390-457e-c74c8269e14e}\seta40e.tmp to %WINDIR%\temp\{0c64d446-c270-0390-457e-c74c8269e14e}\eamonm.sys
from <DRIVERS>\set9b26.tmp to <DRIVERS>\ehdrv.sys
from %WINDIR%\temp\{372ce8a5-e12a-1679-5d18-e443e92f3246}\set71e6.tmp to %WINDIR%\temp\{372ce8a5-e12a-1679-5d18-e443e92f3246}\ehdrv.sys
from %WINDIR%\temp\{372ce8a5-e12a-1679-5d18-e443e92f3246}\set70ec.tmp to %WINDIR%\temp\{372ce8a5-e12a-1679-5d18-e443e92f3246}\ehdrv.inf
from %WINDIR%\temp\{372ce8a5-e12a-1679-5d18-e443e92f3246}\set6f46.tmp to %WINDIR%\temp\{372ce8a5-e12a-1679-5d18-e443e92f3246}\ehdrv.cat
from %TEMP%\nup5458.tmp to %ProgramFiles%\eset\eset security\modules\em033_64\1415\em033_64.dll
from %TEMP%\nup4dbd.tmp to %ProgramFiles%\eset\eset security\modules\em017_64\1776\em017_64.dll
from %TEMP%\nup46f1.tmp to %ProgramFiles%\eset\eset security\modules\em006_64\1192\em006_64.dll
from %TEMP%\nup469c.tmp to %ProgramFiles%\eset\eset security\modules\em000k_64\1012\em000k_64.dll
from %TEMP%\nup4487.tmp to %ProgramFiles%\eset\eset security\modules\em000_64\1029\em000_64.dll
from %ALLUSERSPROFILE%\eset\eset security\updfiles\em017_64_l2_.dll.nup to %ALLUSERSPROFILE%\eset\eset security\updfiles\em017_64_l2_20210829165311.dll.nup
from %ALLUSERSPROFILE%\eset\eset security\updfiles\em033_64_l1_.dll.nup to %ALLUSERSPROFILE%\eset\eset security\updfiles\em033_64_l1_20210829165311.dll.nup
from %ALLUSERSPROFILE%\eset\eset security\updfiles\em017_64_l1_.dll.nup to %ALLUSERSPROFILE%\eset\eset security\updfiles\em017_64_l1_20210829165311.dll.nup
from %ALLUSERSPROFILE%\eset\eset security\updfiles\em006_64_l1_.dll.nup to %ALLUSERSPROFILE%\eset\eset security\updfiles\em006_64_l1_20210829165311.dll.nup
from %ALLUSERSPROFILE%\eset\eset security\updfiles\em033_64_l0_.dll.nup to %ALLUSERSPROFILE%\eset\eset security\updfiles\em033_64_l0_20210829165311.dll.nup
from %ALLUSERSPROFILE%\eset\eset security\updfiles\em017_64_l0_.dll.nup to %ALLUSERSPROFILE%\eset\eset security\updfiles\em017_64_l0_20210829165311.dll.nup
from %ALLUSERSPROFILE%\eset\eset security\updfiles\em006_64_l0_.dll.nup to %ALLUSERSPROFILE%\eset\eset security\updfiles\em006_64_l0_20210829165311.dll.nup
from %ALLUSERSPROFILE%\eset\eset security\updfiles\em000_64_l0_.dll.nup to %ALLUSERSPROFILE%\eset\eset security\updfiles\em000_64_l0_20210829165311.dll.nup
from <DRIVERS>\setd2aa.tmp to <DRIVERS>\eamonm.sys
from <DRIVERS>\setdfb6.tmp to <DRIVERS>\epfwwfp.sys

Modifies the following files

Network activity

UDP

DNS ASK ip###.eset.com

Miscellaneous

Searches for the following windows

ClassName: 'BUTTON' WindowName: ''
ClassName: '#32770' WindowName: ''
ClassName: 'ESET Main Frame' WindowName: ''
ClassName: 'ESET Client Frame' WindowName: ''
ClassName: '' WindowName: ''
ClassName: 'EDIT' WindowName: ''

Creates and executes the following

'%WINDIR%\prefetch\test\setup.exe' /S /EAV /L=1033
'%TEMP%\eset.temp\{02d83bbe-969b-c795-6e3e-1dcd95275afd}\insthelper.exe' -ci "%TEMP%\eset.temp\{02D83BBE-969B-C795-6E3E-1DCD95275AFD}\_InstData.xml"
'%ProgramFiles%\eset\eset security\ekrn.exe'
'%ProgramFiles%\eset\eset security\egui.exe' /hide
'%TEMP%\nslbb34.tmp\tnod.exe' -ptnod -sp"/S /D=%ProgramFiles%\ESET\TNOD"
'%TEMP%\tnod.exe' /S /D=%ProgramFiles%\ESET\TNOD
'%WINDIR%\syswow64\cmd.exe' /C install.cmd' (with hidden window)
'%WINDIR%\syswow64\msiexec.exe' /I "%TEMP%\ESET\64.msi" /qn PRODUCTTYPE=106 PRODUCT_LANG=1033 ADMINCFG="%TEMP%\ESET\cfg.xml" APPDIR="%ProgramFiles%\ESET\ESET Security"' (with hidden window)
'<SYSTEM32>\taskkill.exe' /F /T /IM ehttpsrv.exe' (with hidden window)
'%TEMP%\eset.temp\{02d83bbe-969b-c795-6e3e-1dcd95275afd}\insthelper.exe' -ci "%TEMP%\eset.temp\{02D83BBE-969B-C795-6E3E-1DCD95275AFD}\_InstData.xml"' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C install.cmd
'%WINDIR%\syswow64\msiexec.exe' /I "%TEMP%\ESET\64.msi" /qn PRODUCTTYPE=106 PRODUCT_LANG=1033 ADMINCFG="%TEMP%\ESET\cfg.xml" APPDIR="%ProgramFiles%\ESET\ESET Security"

Tecnologie

Termini

Formazione ed informazione

Falsi miti

Technical Information

Curing recommendations

Free trial