We’ll find out tomorrow. Even if it’s just spoofing a valid signature on a exe I’d still call that pretty serious. Might get a piece of malware masquerading as a legit background program past a lot of SOC analysts. I’d bet there’s more to it though.