E_YARNHSA.EXE
by Epson
Driver/Hardware
Summary
Epson printer Status Agent helper
E_YARNHSA.EXE is the 1464th most commonly executed Windows program in EchoTrail's dataset, observed 777 times across enterprise environments. It typically runs from C:\Windows\System32\spool\drivers\x64\3 and it is most often launched by E_YARNHSA.EXE.
1464th
most commonly executed Windows program
777
observed executions
low
statistical confidence
Behavior
Top Paths
- C:\Windows\System32\spool\drivers\x64\3100%
Top Hashes (SHA256)
- 552c0a55e6db3a115c14637d6a79e7ceab3170da215c6e03a4ab734d20c6027487%
- 1c5e776a7ea4555f9ee0dc2188ff1d6894f747069a5a1fce2bab2655434b100413%
Process Ancestry
Top Grandparents
- explorer.exe34.34%
- splwow64.exe27.26%
- EXCEL.EXE9.31%
- chrome.exe8.39%
- WINWORD.EXE6.95%
- AcroRd32.exe5.64%
- OUTLOOK.EXE3.54%
- E_YARNHSA.EXE1.44%
- javaw.exe1.31%
- POWERPNT.EXE0.92%
Top Parents
- E_YARNHSA.EXE36.42%
- splwow64.exe28.19%
- E_YATIHSA.EXE27.28%
- chrome.exe7.98%
Top Children
- E_YARNHSA.EXE57.64%
- E_YATIHSA.EXE0.2%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Ask Rocky about E_YARNHSA.EXE
Rocky answers questions about E_YARNHSA.EXE grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.