AMP for Networks calculates the SHA of the file as the file passes through the appliance, and the disposition is returned indicating if the file is good, unknown, or malicious. How does AMP for Network operate for fileless malware, where a SHA cannot be calculated? Please explain, thanks.