When viewing risk events in the Symantec Endpoint Protection Manager (SEPM), the 'risk details' pane shows a different MD5 each time the event details are opened.
A query in the SEPM was incorrectly selecting all records with a blank SHA1 hash. This query would eventually time out; when it did so, the first record in the list gets selected and the MD5 for that record is displayed in the risk details pane.
This issue is resolved in Endpoint Protection 14 RU1.
For information on how to obtain the latest build of Endpoint Protection see Download the latest version of Symantec Endpoint Protection.