Windows Defender flags legacy-notepad-x86.exe as Trojan:Win32/Wacatac.H!ml

[adrianvicoh]

Hi,

I’d like to report an issue detected by Windows Defender on Windows 11.

A few days after downloading legacy-notepad-x86.exe, Windows Defender flagged the file as Trojan:Win32/Wacatac.H!ml. The detection occurred immediately after downloading the file, without ever executing it.

This issue does not occur with legacy-notepad-x64.exe, which is not flagged by Windows Defender.

I verified the integrity of the file and confirmed that the SHA-256 hash matches the hash published in the release.

Maybe it could be a false positive, but I wanted to report it for visibility.

I’ve attached screenshots from Windows Defender and VirusTotal for reference.

Thanks for your work, and please let me know if you need any additional information.

[ForLoopCodes]

Thanks for reporting this with screenshots.
I hardened releases: tagged builds now require code signing, release binaries/installers are signed, and SHA256SUMS are published per architecture.
I’ve also documented and the Microsoft false-positive submission process for Defender review.
Please re-check the next signed x86 release and confirm if detection is cleared.

[adrianvicoh]

Thank you very much.

It seems that Windows Defender no longer flags it as a trojan.

However, I scanned it again on VirusTotal and it is still detected as malware only by engines using the BitDefender engine. It still appears to be a false positive, since the main antivirus engines do not detect any issue.

[ForLoopCodes]

ill keep the issue open