I'm not a windows developer or a ide developer, but I would check the hash against known good git.exe and then only run if it matches it.