SlowProcessor unable to calculate hash using handle

wagner.chagas — Mon, 03 Jan 2022 23:51:21 GMT

We're having trouble running Office 365, is there application blocking where files can't be opened, is there any fix or policy enforcement to get it back up and running?

Logs:

(22455125, +0 ms) Jan 03 14:46:13 [7440]: ERROR: Event::SlowProcessor unable to calculate hash using handle(\\?\C:\Users\LoginName\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\b8ab77100df80ab2.automaticDestinations-ms)
(22462453, +7328 ms) Jan 03 14:46:21 [7684]: ERROR: ProcessFileChecksum: File orignal: \\?\C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE, dup: (null) exceeded max filesize, aborting...
(22462968, +515 ms) Jan 03 14:46:21 [7244]: ERROR: ExPrevCallbackLogger::HandleExPrevLogCallback: version: 1, logType: 0, processId: 15812, processName: EXCEL, logString: XDetourAttach: Hooking function at address 0x00007FFA2AEAE4F0 failed

(22462968, +0 ms) Jan 03 14:46:21 [7244]: ERROR: ExPrevCallbackLogger::HandleExPrevLogCallback: version: 1, logType: 0, processId: 15812, processName: EXCEL, logString: Hooking ShellExecuteExW failed. Aborting. Error 7798786

(22462968, +0 ms) Jan 03 14:46:21 [7244]: ERROR: ExPrevCallbackLogger::HandleExPrevLogCallback: version: 1, logType: 0, processId: 15812, processName: EXCEL, logString: XDetourAttach: Hooking function at address 0x00007FFA2BDAD600 failed

(22462968, +0 ms) Jan 03 14:46:21 [16712]: ERROR: ExPrevCallbackLogger::HandleExPrevLogCallback: version: 1, logType: 0, processId: 15812, processName: EXCEL, logString: Hooking NtQueueApcThread failed. Aborting. Error 487

(22463593, +625 ms) Jan 03 14:46:22 [7460]: ERROR: Unknown Disposition: 1
(22463593, +0 ms) Jan 03 14:46:22 [7440]: ERROR: GetEthosHash 0, 0x47ac, 2810512, 0x185ffd30,

(22463593, +0 ms) Jan 03 14:46:22 [7440]: ERROR: GetEthosHash 0, 0x47ac, 2810512, 0x438847a0,

(22463593, +0 ms) Jan 03 14:46:22 [7440]: ERROR: Event::SlowProcessor unable to calculate hash using handle(\\?\C:\Users\LoginName\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\5f7b5f1e01b83767.automaticDestinations-ms)
(22464484, +891 ms) Jan 03 14:46:23 [7480]: ERROR: Unknown Disposition: 1
(22464484, +0 ms) Jan 03 14:46:23 [7440]: ERROR: GetEthosHash 0, 0x49e4, 610304, 0x185ffd30,

(22464484, +0 ms) Jan 03 14:46:23 [7440]: ERROR: GetEthosHash 0, 0x49e4, 610304, 0x43da9fb0,

(22464484, +0 ms) Jan 03 14:46:23 [7440]: ERROR: Event::SlowProcessor unable to calculate hash using handle(\\?\C:\Users\LoginName\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms)
(22473625, +9141 ms) Jan 03 14:46:32 [7452]: ERROR: Unknown Disposition: 1
(22473625, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x2d10, 57344, 0x185ffd30,

(22473625, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x2d10, 57344, 0x423f3990,

(22473625, +0 ms) Jan 03 14:46:32 [7440]: ERROR: Event::SlowProcessor unable to calculate hash using handle(\\?\C:\Users\LoginName\AppData\Local\Microsoft\MSIP\mip\EXCEL.EXE\mip\mip.policies.sqlite3)
(22473625, +0 ms) Jan 03 14:46:32 [7480]: ERROR: Unknown Disposition: 1
(22473625, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x216c, 57344, 0x185ffd30,

(22473625, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x216c, 57344, 0x423f3c30,

(22473625, +0 ms) Jan 03 14:46:32 [7440]: ERROR: Event::SlowProcessor unable to calculate hash using handle(\\?\C:\Users\LoginName\AppData\Local\Microsoft\MSIP\mip\EXCEL.EXE\mip\mip.policies.sqlite3)
(22473625, +0 ms) Jan 03 14:46:32 [7476]: ERROR: Unknown Disposition: 1
(22473625, +0 ms) Jan 03 14:46:32 [7472]: ERROR: Unknown Disposition: 1
(22473625, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x1f80, 57344, 0x185ffd30,

(22473625, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x1f80, 57344, 0x423f3b30,

(22473625, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x3b0c, 57344, 0x423f3900,

(22473625, +0 ms) Jan 03 14:46:32 [7440]: ERROR: Event::SlowProcessor unable to calculate hash using handle(\\?\C:\Users\LoginName\AppData\Local\Microsoft\MSIP\mip\EXCEL.EXE\mip\mip.policies.sqlite3)
(22473625, +0 ms) Jan 03 14:46:32 [7456]: ERROR: Unknown Disposition: 1
(22473625, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x3ae0, 57344, 0x185ffd30,

(22473625, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x3ae0, 57344, 0x423f3a10,

(22473625, +0 ms) Jan 03 14:46:32 [7440]: ERROR: Event::SlowProcessor unable to calculate hash using handle(\\?\C:\Users\LoginName\AppData\Local\Microsoft\MSIP\mip\EXCEL.EXE\mip\mip.policies.sqlite3)
(22473625, +0 ms) Jan 03 14:46:32 [7476]: ERROR: Unknown Disposition: 1
(22473640, +15 ms) Jan 03 14:46:32 [7472]: ERROR: Unknown Disposition: 1
(22473656, +16 ms) Jan 03 14:46:32 [7460]: ERROR: Unknown Disposition: 1
(22473656, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x4144, 12824, 0x185ffd30,

(22473656, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x4144, 12824, 0x423f3b30,

(22473656, +0 ms) Jan 03 14:46:32 [7440]: ERROR: Event::SlowProcessor unable to calculate hash using handle(\\?\C:\Users\LoginName\AppData\Local\Microsoft\MSIP\Telemetry\v1.7\MSIP_Telemetry.tm-journal)
(22473671, +15 ms) Jan 03 14:46:32 [7464]: ERROR: Unknown Disposition: 1
(22473671, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x1234, 12824, 0x185ffd30,

(22473671, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x1234, 12824, 0x423f3a50,

(22473671, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x1fb8, 20480, 0x423f3900,

(22473671, +0 ms) Jan 03 14:46:32 [7440]: ERROR: Event::SlowProcessor unable to calculate hash using handle(\\?\C:\Users\LoginName\AppData\Local\Microsoft\MSIP\Telemetry\v1.7\MSIP_Telemetry.tm)
(22473687, +16 ms) Jan 03 14:46:32 [7460]: ERROR: Unknown Disposition: 1
(22473687, +0 ms) Jan 03 14:46:32 [7464]: ERROR: Unknown Disposition: 1
(22473687, +0 ms) Jan 03 14:46:32 [7460]: ERROR: Unknown Disposition: 1
(22473796, +109 ms) Jan 03 14:46:32 [7456]: ERROR: Unknown Disposition: 1
(22473796, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x479c, 3884, 0x185ffd30,

(22473796, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x479c, 3884, 0x4428c6f0,

(22473796, +0 ms) Jan 03 14:46:32 [7440]: ERROR: Event::SlowProcessor unable to calculate hash using handle(\\?\C:\Users\LoginName\AppData\Roaming\Microsoft\Office\Recent\index.dat)
(22473812, +16 ms) Jan 03 14:46:32 [7476]: ERROR: Unknown Disposition: 1
(22473812, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x3a98, 16384, 0x185ffd30,

(22473812, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x3a98, 16384, 0x4428c9a0,

(22473812, +0 ms) Jan 03 14:46:32 [7440]: ERROR: Event::SlowProcessor unable to calculate hash using handle(\\?\C:\Users\LoginName\AppData\Local\Temp\Outlook Logging\EXCEL_16_0_14701_20262-20220103T1445380379-18364.etl)
(22473843, +31 ms) Jan 03 14:46:32 [7452]: ERROR: Unknown Disposition: 1
(22473906, +63 ms) Jan 03 14:46:32 [7464]: ERROR: Unknown Disposition: 1
(22473906, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x45e0, 1037, 0x185ffd30,

(22473906, +0 ms) Jan 03 14:46:32 [7440]: ERROR: GetEthosHash 0, 0x45e0, 1037, 0x1bff0dc0

Re: SlowProcessor unable to calculate hash using handle

pmittal — Thu, 18 Apr 2024 07:37:18 GMT

Hi Cisco Community,

Any Update on the above point. It will be great Help.

topic SlowProcessor unable to calculate hash using handle in Endpoint Security

SlowProcessor unable to calculate hash using handle

Re: SlowProcessor unable to calculate hash using handle