List of artifacts/Collected files

metadata.txt

Information on the date of the .zip archive creation, ESET Log Collector version, ESET application version and basic licensing information.

collector_log.txt

A copy of the log file from the GUI containing data up to the point when the .zip file was created.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

Running processes

(open handles and loaded DLLs)

✓

✓

Windows\Processes\Processes.txt

Text file containing a list of running processes on the machine. For each process, the following items are printed:

•PID

•Parent PID

•Number of threads

•Number of open handles grouped by type

•Loaded modules

•User account it is running under

•Memory usage

•Timestamp of start

•Kernel and user time

•I/O statistics

•Command line

Running processes

(open handles and loaded DLLs)

✓

✓

Windows\ProcessesTree.txt

Text file containing a tree of running processes on the machine. For each process following items are printed:

•PID

•User account it is running under

•Timestamp of start

•Command line

Relocated binaries of running processes

✓

✓

Windows\Processes\RelocatedBinaries.txt

Text file containing list of binaries of running processes that changed location during execution. The file may also include potential trace records.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

Application event log

✓

✓

Windows\Logs\LocaleMetaData\Application_1033.mta

Windows\Logs\Application.xml

Windows\Logs\Application.evtx

Windows Application event logs in a custom XML format. Only messages from the last 30 days are included.

System event log

✓

✓

Windows\Logs\LocaleMetaData\System_1033.mta

Windows\Logs\System.xml

Windows\Logs\System.evtx

Windows System event logs in a custom XML format. Only messages from the last 30 days are included.

Security event log

✗

✗

Windows\Logs\Security.evtx

Windows Security event log file. Only messages from the last 30 days are included.

Terminal services - LSM operational event log*

✗

✓

Windows\Logs\LocalSessionManager-Operational.evtx

Windows event log containing information about RDP sessions.

Terminal Services - RCM operational event log*

✗

✓

Windows\Logs\RemoteConnectionManager-Operational.evtx

Windows event log containing information about Windows Remote Desktop connections.

Drivers install logs

✓

✗

Windows\Logs\catroot2_dberr.txt

Information about catalogs that have been added to "catstore" during driver installation.

SetupAPI logs*

✓

✗

Windows\Logs\SetupAPI\setupapi*.log

Device and application installation text logs.

WMI Activity operational event log*

✗

✓

Windows\Logs\WMI-Activity.evtx

Windows event log containing WMI Activity tracing data. Only messages from the last 30 days are included.

Windows PowerShell event log

✗

✓

Windows\Logs\Windows-PowerShell.evtx

Windows Event Log file that contains records details of Windows PowerShell operations.

IIS Logs

✓

✗

Windows\Logs\IISLogs\w3svc*

IIS Logs are collected into corresponding folders.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

Drives info

✓

✓

Windows\drives.txt

Windows\volumes.txt

Text file containing information about disk drives and volumes.

Devices info

✓

✓

Windows\devices\*.txt

Windows\Devices\deviceTree.json

Multiple text files containing classes and interfaces information about devices.

Services Registry key content

✓

✗

Windows\Services.reg

A registry key content of KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. Collecting this key may be helpful for driver issues.

Network configuration

✓

✓

Config\network.txt

Text file containing network configuration (result of executing ipconfig /all).

Windows Updates

✗

✗

Windows Updates\WinUpdates.txt

Text file containing information about Windows Updates.

PowerShell history

✗

✓

Windows\PSHistory\{profileName}\*.*

Text files with PowerShell history in %appdata%\Microsoft\Windows\PowerShell\PSReadline\ under each profile. History is collected for PS version 5 and above, where PSReadLine should be available by default.

.NET Framework info

✓

✗

Windows\DotNET_info.txt

Text file containing information about installed .NET Framework and .NET CLR versions.

ESET SysInspector log

✓

✓

Config\SysInspector.esil

SysInspector log. It may contain SysInspector XML format instead, depending on the used SysInspector app's version.

Winsock LSP catalog

✓

✓

Config\WinsockLSP.txt

Output of netsh winsock show catalog command.

WFP filters*

✓

✓

Config\WFPFilters.xml

WFP filters configuration in the XML format.

Complete Windows Registry content

✗

✓

Windows\Registry\*

Multiple binary files containing Windows Registry data.

List of files in temporary directories

✓

✓

Windows\TmpDirs\*.txt

Collected multiple text files with content of system's user temp directories, %windir%/temp, %TEMP% and %TMP% directories.

Windows scheduled tasks

✗

✓

Windows\Scheduled Tasks\*.*

Multiple xml files containing all tasks from the Windows Task Scheduler to help detect malware that exploits the Task Scheduler. Because the files are located in subfolders, the whole structure is collected.

WMI repository

✗

✓

Windows\WMI Repository\*.*

Multiple binary files containing WMI database data (meta-information, definition and static data of WMI classes). Collecting these files may help identify malware that uses WMI for persistence (such as Turla). Because WMI files may be located in subfolders, the whole structure is collected.

Shim databases

✗

✓

Windows\Shim Databases\*.sdb

Shim database files located in %SystemRoot%\apppatch directory.

Prefetch files

✗

✓

Windows\Prefetch files\*.sdb

Prefetch files located in %SystemRoot%\Prefetch directory.

Group Policy settings

✗

✗

Windows\GP\gpresult.html

Windows\GP\gpresult_Computer.log

Windows\GP\gpresult_User.log

A report generated by the gpresult tool contains all information about the Resultant Set of Policy for remote users and computers.

Windows account rights

✗

✗

Windows\Account rights\rights.inf

Exported Windows account rights using the SecEdit utility.

Microsoft Defender status*

✗

✗

Windows\Defender\service.txt

Text file containing information about Microsoft Defender service.

Windows Server roles & features*

✓

✗

Windows\server_features.txt

Text file containing a tree of all Windows Server features. Each feature contains the following information:

•Installed state

•Localized name

•Code name

•State (available on Microsoft Windows Server 2012 and later)

Detected Windows Server applications

✓

✗

Windows\server_applications.txt

Text file containing information about installed server applications: SharePoint, Exchange, and SQL.

Windows Startup

✓

✗

Windows\Startup\*.*

All Windows startup shortcut entries.

Windows Amcache

✓

✗

Windows\Amcache.hve

Amcache registry hive demanded by IR team.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

ESET Installer logs

✓

✗

ESET\Installer\*.log

Installation logs that were created during ESET NOD32 Antivirus and ESET Smart Security 10 Premium applications installation.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

Server logs

✓

✗

ERA\Server\Logs\RemoteAdministratorServerDiagnostic<datetime>.zip

Create Server application logs in the ZIP archive. It contains trace, status and last-error logs.

Agent logs

✓

✗

ERA\Agent\Logs\RemoteAdministratorAgentDiagnostic<datetime>.zip

Create Agent application logs in the ZIP archive. It contains trace, status and last-error logs.

Agent database

✓

✗

ERA\Agent\Database\data.db

Agent database file.

Process information and dumps*

✗

✗

ERA\Server\Process and old dump\RemoteAdministratorServerDiagnostic<datetime>.zip

Server process dump(s).

Configuration

✓

✗

ERA\Server\Config\RemoteAdministratorServerDiagnostic<datetime>.zip

Server configuration and application information files in the ZIP archive.

Rogue Detection Sensor logs

✓

✗

ERA\RD Sensor\Rogue Detection SensorDiagnostic<datetime>.zip

A ZIP containing RD Sensor trace log, last-error log, status log, configuration, dump(s) and general information files.

MDMCore logs

✓

✗

ERA\MDMCore\RemoteAdministratorMDMCoreDiagnostic<datetime>.zip

A ZIP containing MDMCore trace log, last-error log, status log, dump(s) and general information files.

Proxy logs

✓

✗

ERA\Proxy\RemoteAdministratorProxyDiagnostic<datetime>.zip

A ZIP containing Proxy trace log, last-error log, status log, configuration, dump(s) and general information files.

Apache Tomcat configuration

✓

✗

ERA\Apache\Tomcat\conf\*.*

Apache Tomcat configuration files, it contains a copy of server.xml file without sensitive information.

Apache Tomcat logs

✓

✗

ERA\Apache\Tomcat\logs\*.log

ERA\Apache\Tomcat\EraAppData\logs\*.log

ERA\Apache\Tomcat\EraAppData\WebConsole\*.log

Apache Tomcat log(s) in text format located in Apache Tomcat install or application directory. It also contains WebConsole logs.

Apache HTTP Proxy configuration

✓

✗

ERA\Apache\Proxy\conf\httpd.conf

Apache HTTP Proxy configuration file.

Apache HTTP Proxy logs

✓

✗

ERA\Apache\Proxy\logs\*.log

Apache HTTP Proxy log(s) in text format located.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

Agent logs

✓

✗

ERA\Agent\Logs\RemoteAdministratorAgentDiagnostic<datetime>.zip

Create Agent application logs in the ZIP archive. It contains trace, status and last-error logs.

Agent database

✓

✗

ERA\Agent\Database\data.db

Agent database file.

Process information and dumps*

✗

✗

ERA\Agent\Process and old dump\RemoteAdministratorAgentDiagnostic<datetime>.zip

Agent process dump(s).

Configuration

✓

✗

ERA\Agent\Config\RemoteAdministratorAgentDiagnostic<datetime>.zip

Agent configuration and application information files in the ZIP archive.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

ESET Bridge configuration

✓

✗

ESET Bridge\pkgid

Configuration file located in ESET Bridge installation directory.

ESET Bridge logs

✓

✗

ESET Bridge\logs\*.*

Log files located in ESET Bridge application data directory.

ESET Bridge dumps

✓

✗

ESET Bridge\dumps\*.*

ESET Bridge dump files.

Nginx logs

✓

✗

ESET Bridge\Nginx\logs\*.log

ESET Bridge\Nginx\conf\*.*

Nginx log files (.key and .pfx are not collected).

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

eRMMI

✓

✗

ERMMI\data\*.*

App data files that are located in the ERMMI directory.

Endpoint Plugin for Connectwise Automate logs

✓

✗

ERMMI\EEPCA\Logs\*.*

Endpoint Plugin for Connectwise Automate logs files.

Endpoint Plugin for Connectwise Automate binaries

✓

✗

ERMMI\EEPCA\bin\*.*

Endpoint Plugin for Connectwise Automate in binary format (except .msi and .exe executables).

Ermmi logs

✓

✗

ERMMI\logs\*.*

Log files located in the ERMMI install directory.

Ermmi binaries

✓

✗

ERMMI\bin\*.*

Binary files located in the ERMMI install directory (except .msi and .exe executables).

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

ESET application configuration

✓

✓

info.xml

Informational XML that details the ESET application installed on a system. It contains basic system information, installed application information and a list of application modules.

ESET application configuration

✓

✓

versions.csv

Since version 4.0.3.0 the file is always included (without any dependencies). It contains installed application info. versions.csv must exist in ESET AppData directory to be included.

ESET application configuration

✓

✓

features_state.txt

Information about ESET application features and their states (Active, Inactive, Not integrated). The file is always collected and is not tied to any selectable artifact.

ESET application configuration

✓

✓

Configuration\application_conf.xml

XML with exported application configuration.

ESET data and install directory file list

✓

✓

ESET\Config\data_dir_list.txt

Text file containing list of files in ESET AppData directory and all their subdirectories.

ESET data and install directory file list

✓

✓

ESET\Config\install_dir_list.txt

Text file containing list of files in ESET Install directory and all their subdirectories.

ESET drivers

✓

✓

ESET\Config\drivers.txt

Information about installed ESET drivers.

ESET Personal firewall configuration

✓

✓

ESET\Config\EpfwUser.dat

Copy file with ESET Personal firewall configuration.

ESET firewall troubleshooting wizard

✓

✓

ESET\Config\epfw_troubleshooting_wizard.xml

XML file containing information about blocked local applications and remote devices.

ESET firewall temporary IP address blacklist

✓

✓

ESET\Config\epfw_temporary_ip_address_blacklist.xml

XML file containing information about temporarily blocked IP addresses.

ESET Registry key content

✓

✓

ESET\Config\ESET.reg

Registry key content of HKLM\SOFTWARE\ESET

Winsock LSP catalog

✓

✓

Config/WinsockLSP.txt

Netsh winsock show catalog command output.

Last applied policy

✓

✓

ESET\Config\lastPolicy.dat

The policy applied by <%REMOTE%>.

ESET components

✓

✓

ESET\Config\msi_features.txt

Collected information about available ESET application MSI installer components.

ESET subscription

✓

✓

ESET\Config\License\*.*

Subscription files of the installed ESET application.

HIPS configuration

✓

✓

ESET\Config\HipsRules.bin

HIPS rules data.

Network Inspector configuration

✓

✓

ESET\Config\epfwdata.bin

Network Inspector configuration data.

Connected Home configuration

✓

✓

ESET\Config\homenet.dat

Connected Home data.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

Info about quarantined files

✓

✓

ESET\Quarantine\quar_info.txt

Create text file with a list of quarantined objects.

Small quarantined files (< 250KB)

✓

✗

ESET\Quarantine\*.*(< 250KB)

Quarantine files smaller than 250 KB.

Big quarantined files (> 250KB)

✗

✓

ESET\Quarantine\*.*(> 250KB)

Quarantine files larger than 250 KB.

Suspicious file (collected with ESET Inspect On-Prem log artifact)

✗

✓

Config\SysInspector.esil

All files considered by ESET SysInspector as suspicious.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

ESET Events log

✓

✓

ESET\Logs\Common\warnlog.dat

ESET application event log in binary format.

ESET Detections log

✓

✓

ESET\Logs\Common\virlog.dat

ESET Detections log in binary format.

ESET Computer scan logs

✗

✓

ESET\Logs\Common\eScan\*.dat

ESET Computer scan log(s) in binary format.

ESET Update log

✓

✓

ESET\Logs\Common\updatelog.dat

ESET update log in binary format.

ESET HIPS log*

✓

✓

ESET\Logs\Common\hipslog.dat
ESET\Logs\Common\folderprot.dat
ESET\Logs\Common\ransomlog.dat

ESET HIPS log in binary format.

ESET Folder protection log file.

ESET Ransomware remediation log.

ESET Parental control logs*

✓

✓

ESET\Logs\Common\parentallog.dat

ESET Parental control log in binary format.

ESET Device control log*

✓

✓

ESET\Logs\Common\devctrllog.dat

ESET Device control log in binary format.

ESET Webcam protection log*

✓

✓

ESET\Logs\Common\webcamlog.dat

ESET Webcam protection log in binary format.

ESET Safe Banking & Browsing log

✓

✓

ESET\Logs\Common\bpplog.dat

ESET Banking & Payment protection log in binary format.

ESET Blocked files log

✓

✓

ESET\Logs\Common\blocked.dat

ESET Blocked files log(s) in binary format.

ESET Sent files log

✓

✓

ESET\Logs\Common\sent.dat

ESET Sent files log(s) in binary format.

ESET Audit log

✓

✓

ESET\Logs\Common\audit.dat

ESET\Logs\Common\audit\*.*

ESET Audit log(s) in binary format.
ESET Audit log(s) data located in the "Audit" subdirectory within the ESET application data directory.

ESET Vulnerability & Patch Management log

✓

✓

ESET\Logs\Common\vapmlog.dat

ESET Vulnerability & Patch Management log in binary format.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

ESET On-demand server database scan logs

✓

✓

ESET\Logs\Common\ServerOnDemand\*.dat

ESET server On-demand log(s) in binary format.

ESET Hyper-V server scan logs

✓

✓

ESET\Logs\Common\HyperVOnDemand\*.dat

ESET Hyper-V server scan log(s) in binary format.

ESET OneDrive scan logs

✓

✓

ESET\Logs\Common\O365OnDemand\*.dat

ESET OneDrive scan log(s) in binary format.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

ESET Network protection log*

✓

✓

ESET\Logs\Net\epfwlog.dat

ESET Network protection log in binary format.

ESET Filtered websites log*

✓

✓

ESET\Logs\Net\urllog.dat

ESET Websites filter log in binary format.

ESET Web control log*

✓

✓

ESET\Logs\Net\webctllog.dat

ESET Web control log in binary format.

ESET pcap logs

✓

✗

ESET\Logs\Net\Eset*.pcapng
ESET\Logs\Net\EsetKeyLog.bin

Files containing dumped network communication in binary format.
Keys used for QUIC and TLS network communication are in binary format.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

Local cache database

✗

✓

ESET\Diagnostics\local.db

ESET scanned files database.

General application diagnostics logs

✓

✗

ESET\Diagnostics\*.*

Files (mini-dumps) from ESET diagnostics folder.

ECP diagnostic logs

✓

✗

ESET\Diagnostics\ECP\*.*

ESET Communication Protocol diagnostic logs are generated if there are problems with application activation and communication with activation servers.

EPNS diagnostic logs

✓

✗

ESET\Diagnostics\*.*

ESET Push Notification Service diagnostic logs are generated if there are problems.

Vulnerability & Patch Management debug logs

✓

✗

ESET\Diagnostics\Vapm\*.*

ESET Vulnerability & Patch Management diagnostic log files.

ESET Cluster diagnostics logs

✓

✗

ESET\Diagnostics\Cluster\*.*

ESET Cluster diagnostic log files, including those located in the system temporary directory created during application installation/upgrade performed by the ESET Cluster feature.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

Application update logs

✓

✗

ESET\Update\MicroPcu\*.*

ESET application μ-PCU update files.

Update snapshot info

✓

✗

ESET\Config\db.xml

Backup update snapshot XML file containing information about modules to a specific date.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

ESA logs

✓

✗

ESA\*.log

ESA\logs\*.*

Exported log(s) from the ESET Secure Authentication.

ESA logs

✓

✗

ESA\logs\elastic\*.*

Additional ESET Secure Authentication log files.

ESA Synchronization Agent logs

✓

✗

ESA\Synchronization Agent\*.*

Exported log(s) from the ESET Secure Authentication Synchronization Agent. The files are collected since version 4.9.0.0.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

EI Server logs

✓

✗

EEI\Server\Logs\*.log

Inspect Server application text logs.

EI Connector logs

✓

✗

EEI\Agent\Logs\*.log

Inspect Connector application text logs.

EI Server configuration

✓

✗

EEI\Server\eiserver.ini

An .ini file containing Inspect Server application configuration.

EI Connector configuration

✓

✗

EEI\Agent\eiconnector.ini

An .ini file containing Inspect Connector application configuration.

EI Server policy

✓

✗

EEI\Server\eiserver.policy.ini

An .ini file containing Inspect Server application policy.

EI Connector policy

✓

✗

EEI\Agent\eiconnector.policy.ini

An .ini file containing Inspect Connector application policy.

EI Server certificates

✓

✗

EEI\Server\Certificates\*.*

Contains certification files used by Inspect Server application. Since the files are located in subfolders, the whole structure is collected.

EI Connector modules

✓

✗

ESET\Inspect Connector\Modules

Collected modules version.

EI Connector certificates

✓

✗

EEI\Agent\Certificates\*.*

Contains certification files used by Inspect Connector application. Since the files are located in subfolders, the whole structure is collected.

EI Connector persistent log

✓

✗

ESET\Inspect Connector\PersistentLog

Inspect Connector PersistentLog implemented from v2.3.

EI Server dumps

✓

✗

EEI\Server\Diagnostics\*.*

Inspect Server application dump files.

MySQL Server configuration

✓

✗

EI\My SQL\my.ini

An .ini file containing MySQL Server configuration used by ESET Inspect On-Prem Server application.

MySQL Server logs

✓

✗

EEI\My SQL\EEI.err

An error text log of MySQL Server used by ESET Inspect On-Prem Server application.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

EFDE logs

✓

✗

EFDE\AIS\Logs\*.*

EFDE\Core\*.log

Exported logs (AIS and Core) from the ESET Full Disk Encryption.

EFDE subscription data

✓

✗

EFDE\AIS\Licence\*.*

Subscription data files of ESET Full Disk Encryption.

EFDE configuration

✓

✗

EFDE\AIS\lastpolicy.dat

Contains configuration of ESET Full Disk Encryption.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

Client application logs

✓

✗

EVPN\ClientApp\*.tx

EVPN client application logs.

Service logs

✓

✗

EVPN\Service\*.log

EVPN service logs.

Network routing table

✓

✗

EVPN\routing_table.txt

Console output of route utility containing routing table.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

ESET Spam log

✓

✗

ESET\Logs\Email\spamlog.dat

ESET Spam log in binary format.

ESET Greylist log

✓

✗

ESET\Logs\Email\greylistlog.dat

ESET Greylist log in binary format.

ESET SMTP protection log

✓

✗

ESET\Logs\Email\smtpprot.dat

ESET SMTP protection log in binary format.

ESET mail server protection log

✓

✗

ESET\Logs\Email\mailserver.dat

ESET Mail server protection log in binary format.

ESET diagnostic e-mail processing logs

✓

✗

ESET\Logs\Email\MailServer\*.dat

ESET diagnostic e-mail processing logs in binary format, direct copy from disk.

ESET Spam log*

✓

✗

ESET\Logs\Email\spamlog.dat

ESET Spam log in binary format.

ESET Antispam configuration and diagnostic logs

✓

✗

ESET\Logs\Email\Antispam\antispam.*.log

ESET\Config\Antispam\*.*

Copy ESET Antispam configuration and diagnostic logs.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

ESET SHPIO.log

✓

✗

ESET\Log\ESHP\SHPIO.log

ESET Diagnostic log from the SHPIO.exe utility.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

Domino IBM_TECHNICAL_SUPPORT logs + notes.ini

✓

✗

LotusDomino\Log\notes.ini

IBM Domino configuration file.

Domino IBM_TECHNICAL_SUPPORT logs + notes.ini

✓

✗

LotusDomino\Log\IBM_TECHNICAL_SUPPORT\*.*

IBM Domino logs, not older than 30 days.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

MS SharePoint logs

✓

✗

SharePoint\Logs\*.log

MS SharePoint logs, not older than 30 days.

SharePoint Registry key content

✓

✗

SharePoint\WebServerExt.reg

Contains a registry key content of HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\Web Server Extensions. Available only when ESET Security for SharePoint is installed.

Artifact name

Collection profile

Location / Filename

Description

Default

Threat detection

MS Exchange transport agents registration

✓

✗

Exchange\agents.config

MS Exchange transport agents registration config file. For Microsoft Exchange Server 2007 and later.

MS Exchange transport agents registration

✓

✗

Exchange\sinks_list.txt

MS Exchange event sinks registration dump. For Microsoft Exchange Server 2000 and 2003.

MS Exchange EWS logs

✓

✗

Exchange\EWS\*.log

Collection of EWS Exchange Server logs.