PsGetProcessImageFileName about ec

[itsRythem]

ty

[dekoda-uc]

this would be an easy way:

const char* image_name = "r5apex.exe";
LOG("name_hash:    %p\n", *(QWORD*)(image_name));

[itsRythem]

that appears to give a different result as the value that is returned for apex is 0x7265726f6c707865
while what you provided gives 7290897223831860594

[dekoda-uc]

Try a little harder, please

const char* image_name = "r5apex.exe";
LOG("name_hash:    %llx\n", *(QWORD*)(image_name));

correction: %llx

apex is: 0x652e786570613572