Thread Info
Options
Suggested

What is this Hitman check? WinVerifyFileClassifier error 0x800b0100 2148073480

LHerzog

I needed to exclude this program from

Exploit Mitigation And Activity Monitoring (Windows)

But still I see another log event in Hitman sophoshmpaservice.log

2025-02-05T10:36:51.316Z [ 1820: 2732] W [WinVerifyFileClassifier] GetFileEmbeddedSigned: WinVerifyTrust for path D:\xxx\bin\program.exe returned 0x800b0100
2025-02-05T10:36:51.340Z [ 1820: 2732] W [WinVerifyFileClassifier] Failed to get context for file D:\xxx\bin\program.exe with error code 2148073480

What kind of check is it? Looks like certificate checking for code signing.

Can I exclude that behavior on the exe?



Edit Tags
[edited by: GlennSen at 9:58 AM (GMT -8) on 3 Mar 2025]
  • +1

    Thank you for sharing the log entry. Based on the details, this appears to be from Intercept X attempting to verify the code signing certificate of program.exe. While the verification failure is unusual (these checks typically succeed for standard programs), it a bit suspicious.

    However, based on the details provided, I assume it is not triggering any actual protection events. Since there's no detection being generated, there wouldn't be anything to exclude in this case. I'm unclear about why an exclusion would be needed here.

    If you're still experiencing issues, could you share more context about why you're looking to create an exclusion?

    • 0 in reply to MarkLoman

      Thanks  , the exe is not signed:

      Get-AuthenticodeSignature -FilePath "D:\xxx\bin\program.exe"

          D:\xxx\bin\

      SignerCertificate                         Status                                 Path
      -----------------                         ------                                 ----
                                                NotSigned                              program.exe

      The main program (actually an other exe) was not running stable in all aspects so I was asked to exclude as per vendor recommendation.

      While checking the logs this secondary program just jumped to my eye in the log because it's in the same directory as the main program.

      We'll just let it run, fingers crossed it's now working and not causing any problem as you suspect.

      Thanks

Unfiltered HTML