pruiz

This is what I have understood, so please correct me if I'm wrong. There is a bug that makesit that when there is a Ramsomware shield detection it doesn't get registered in either the local client or the esmc but it gets registered in the EEI. The records I marked in the red rectangle are the times when there should have been a record about a ramsomware according to the registry in the EEI

Ok, we will try the suggestions but I find it hard to believe that this bug happens once a week, everyweek. Regards

Hello Marcos, Yes, the computer belongs to one of the members of our technical support and we sometimes receive encrypted files to send them to the lab to check if they can be decripted. We don't know how knowing what that folder is used for will help, but that folder is used to store information that he has to send to ESET Bratislava. Regards

Hello team, We have realized that we have a computer from our technical support team that shows a threat alarm about what it looks like a filecoder.crysis sample (eei filecoder.png) the problem is that when we look at the registry in the computer or in the esmc (esmc threat.png) this sample doesn't show up, so we are worried that the eei is making information up. I have added the logs from the afected computer and the eei server from that day, the day before and the day after to this file in our ftp: link: https://cloud.protegerse.com/s/id75SJPaKYZ3DJL password: name of the file:"eei 22-05-19.zip" password: "clean" Best regards