RemoteFXvGPUDisablement.exe
Program on Windows 2 known copies with hashes 1 Sigma rule names it
Is it the real RemoteFXvGPUDisablement.exe?
Installed in
C:\Windows\system32\Signed byMicrosoft Windows
ProductMicrosoft (R) Windows (R) Operating System, Microsoft Corporation
2 known copies
10.0.19041.388 · C:\Windows\system32\RemoteFXvGPUDisablement.exe · signed by Microsoft Windows
cfcf444ddb908a89dc7c0c279d320f960fac3ba5d64e631370cd7357d400388010.0.17763.1339 · C:\Windows\system32\RemoteFXvGPUDisablement.exe · signed by Microsoft Windows
a42b55bf02179c8676f260ec9fd89ec8aed9fb5117c914d928ec711d96771424From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
What detects it
Sigma names RemoteFXvGPUDisablement.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.