kelepe 2 Posted 3 hours ago Share Posted 3 hours ago Hello guys, please can you clarify how EI is computing hashes. From time to time, we can see in RAW event DLL, EXE hashes with (FAKE) - exported event file. When we investigate process in GUI we can see "unable to compute hash", but we can see that process was seen on XXX computer. How EI determines that it was seen on XXX computers without computed hash? And "Fake" hashes are computed on many processes. It is EI bug , or computing power? The processes are valid, because next time hash is computed with no problems. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.