As essexboy said it’s Pandas unencrypted definitions that are being detected, the definitions are in the installer exe.