kelepe 2 Posted October 2, 2024 Posted October 2, 2024 Hello guys, please can you clarify how EI is computing hashes. From time to time, we can see in RAW event DLL, EXE hashes with (FAKE) - exported event file. When we investigate process in GUI we can see "unable to compute hash", but we can see that process was seen on XXX computer. How EI determines that it was seen on XXX computers without computed hash? And "Fake" hashes are computed on many processes. It is EI bug , or computing power? The processes are valid, because next time hash is computed with no problems.
Recommended Posts