What is ExchangeCredentialManager.exe ?

[bdinh]

My laptop has  cloud-based detection and found this to be a threat, is this "ExchangeCredentialValidator.exe" part of HP WorkWise? I am asking that because this file resides in the directory (shown below). I just want to know if this is a false positive, if not I want to take corrective action immediately.

\Device\HarddiskVolume3\Program Files\WindowsApps\AD2F1837.HPWorkWise_2.2.36.0_x64__v10z8vjag6ke6\My Product Name\ExchangeCredentialValidator\ExchangeCredentialValidator.exe

thank you for your time,

-bdinh

[banhien]

@bdinh 

It is a Microsoft product . More info:

           https://support.microsoft.com/en-us/windows/accessing-credential-manager-1b5c916a-6a16-889f-8581-fc1...

Regards.

[bdinh]

@banhien I am familiar with credential manager in windows but this exchangecredentialmanger.exe resides in a HP WW directory, if it is a Microsoft product why is it located there. Please explain further in detail how that is?

[bdinh]

@banhien here is the SHA1 hash: 1053dfc5cc22900e5a6eadcedd34546be98e237b , and this file is not in the same location as windows credential manager it is in a HP WorkWise path.

[CounterDavidSB]

I'm having the same issue here, my EDR solution is recognizing this as a threat, and its definetely not the Windows Credential Manager due to file name, hash and location.

Is anyone able to explain this file? I'm about to quarentine it but I'm afraid is gonna break something.

Cheers

[bdinh]

@banhien if you may look further into this file or ask any other HP Expert, because Microsoft products aren't located in HP Workwise directories...I just want to confirm if this is a false positive or an actual threat.