Virus detected after download action

[kifgep]

When download the application from release page, first block was from Chrome, then comes to TrendMicro realtime scan.

Multiple files are generated under C:\TEMP, with random extensions.

[mir1ce]

Okay, regarding your question, there may be some concerns:

This program is written in Golang, and programs written in Golang may be identified as malicious by antivirus software.
This program includes an open-source YARA rule library, which contains scanning rules for malicious programs such as ransomware, mining, worms, and C2, which is why the antivirus software alerts about malicious behavior.
As for the issue of the output file, this program's GUI does not use frameworks like Fyne or Wails. I need to ensure compatibility with different versions of Windows, including virtual machine environments. Therefore, to maintain compatibility, this program uses the open-source framework Govcl, and upon running, it will release a file named libvcl.dll.
This program pulls code from Evileye. If you compile Evileye separately, some antivirus software may raise alerts related to Cobalt Strike parsing.

I hope the above answers can clarify your doubts.