it's higher for the exe that's dropped, but definitely still possible for it to be a false positive. https://www.virustotal.com/gui/file/038421636df34fbfc25cdb

it's higher for the exe that's dropped, but definitely still possible for it to be a false positive. https://www.virustotal.com/gui/file/038421636df34fbfc25cdb92acd0815a749bcc2185dfafd5c861eb3679e7666f https://www.virustotal.com/gui/file/038421636df34fbfc25cdb92... it's got strings in the exe from RTPatch, it might be a generic match for that?