[0xDEADFED5]

it's higher for the exe that's dropped, but definitely still possible for it to be a false positive.

https://www.virustotal.com/gui/file/038421636df34fbfc25cdb92...

it's got strings in the exe from RTPatch, it might be a generic match for that?