v.2.0 flagged as trojan in Windows Defender

[PenanceXI]

v2.0 is being restricted by Defender after one use. No similar issue happens when using v1.13.

[RinMaru]

Nothing here and i scanned with virustotal. your windows is probably not upto date

[PenanceXI]

Nothing here and i scanned with virustotal. your windows is probably not upto date

Updated today at 8:47AM CDT.

[PenanceXI]

Should be noted this happened after a batch operation of about 170 .iso files.

[RinMaru]

Should be noted this happened after a batch operation of about 170 .iso files.

thats really strange.

[PenanceXI]

Threat quarantined
4/5/2026 6:35 PM
Severe
Detected: Trojan:Win32/Wacatac.H!ml
Status: Quarantined
Quarantined files are in a restricted area where they can't harm your device. They will be removed automatically.
Date: 4/5/2026 6:35 PM
Details: This program is dangerous and executes commands from an attacker.
Affected items:
file: I:\Tools and Other Resources\chdman\namDHC.exe
process: pid:38116, ProcessStart:134198907153746431

[RinMaru]

I even scanned the exe with win defender. on Win 11 beta and nothing to report on it.

[RinMaru]

[umageddon]

Bizzare.... My guess is how Autohotkey bundles its assets in the executable. If it makes you feel better, you can easily compile the source yourself with Authotkey, otherwise its beyond my level.

[SRC267]

No issues here, and i usually get many false flags for having tight security. So i'm surprised with not receiving a threat warning.

[RinMaru]

No issues here, and i usually get many false flags for having tight security. So i'm surprised with not receiving a threat warning.

I figure they are already infected and something grabbed onto the exe?

[daftinquisitor]

Just chiming in that I'm also getting it flagged in Windows Defender. I'm using Windows 10 LTSC, so maybe that has something to do with it? Hypothetically it should be getting all the newest security updates, but maybe something just doesn't play right with Windows Defender on it.

[umageddon]

Like i said, I think it's how Autohotkey packages its assets. Win64 is essentially seeing a script inside an executable that is launched and then executes hidden windows (chdman.exe), which arguably looks bad. I'll look into it as much as I can

[daftinquisitor]

Like i said, I think it's how Autohotkey packages its assets. Win64 is essentially seeing a script inside an executable that is launched and then executes hidden windows (chdman.exe), which arguably looks bad. I'll look into it as much as I can

Yeah, I'm not expecting much to be done here, I just wanted to add that the OP wasn't the only one seeing the issue.