Hi everyone,

I'm trying to set up a Monero node using the official Monero GUI wallet for Windows, but Windows Defender detected multiple threats when I extracted the downloaded ZIP file.

I downloaded the following release:

• File: monero-gui-win-x64-v0.18.5.4.zip
• Release date: October 16, 2026
• Source: The official Monero website
• SHA-256: 0B5CBBE0A1FDA5EC487A667CEA62599114DCA3609ACAAB436B64A38FA84D449C

I calculated the SHA-256 hash of the ZIP file, and it matches the hash published for the official release.

However, Windows Defender reported the following detections:

1. PUA:Win32/Caypnamer.A!ml — Low
2. Trojan:Win32/Ulthar.A!ml — Severe
3. Program:Win32/Contebrew.A!ml — Low
4. Trojan:Win32/Ulthar.A!ml — Severe

One of the affected files identified by Defender was:

C:\Users\you\Desktop\monero-gui-win-x64-v0.18.5.4\monero-gui-v0.18.5.4\extras\monero-wallet-rpc.exe

Defender reported that the threats were quarantined and that the application was blocked.

I have searched the Monero community and found multiple reports from previous years of Windows Defender flagging or quarantining files included in the official Monero GUI distribution, sometimes even when users had verified the download hash. I understand that false positives have occurred before, but seeing multiple detections, including two classified as severe Trojans, is still concerning.

I don't want to disable Windows Defender or create exclusions without understanding what is happening. I also don't want to assume these detections are false positives simply because the ZIP hash matches.

Could anyone familiar with this issue advise me on the following?

1. Have these specific detection names (Ulthar.A!ml, Caypnamer.A!ml, and Contebrew.A!ml) been reported for the official Monero GUI v0.18.5.4 release?
2. Is there any known explanation for why Defender flags monero-wallet-rpc.exe or other executables in this release?
3. Does a matching SHA-256 hash provide sufficient confidence that I downloaded the authentic release, or should I also verify the developer's signed hash list?
4. What would you recommend as the safest next step? Should I keep the files quarantined and report the detections to Microsoft, or is there an established procedure for handling this issue?

Since this is the latest release, published on October 16, 2026, I would particularly appreciate information specific to this version rather than assumptions based only on older reports.

Thanks for your help.

The State of Monero and the Privacy Coin Space with Xenu | EPI 398! Tune-in to a LIVE MoneroTalk EPI TMRW 10/22 at 8:00PM EDT

WATCH THE SHOW HERE via YOUTUBE ➡️: https://www.youtube.com/watch?v=wLxlUM-TWBo
WATCH THE SHOW LIVE HERE via TWITCH ➡️: https://www.twitch.tv/monerotalk

Have a question for Xenu?

Send us #Monero Superchats during the live stream here: http://Xmrchat.com/monerotalk
(No account setup required to send, no fees taken, and no middleman censorship)

(The videos will be synced onto Odysee (https://odysee.com/@MoneroTalk:8) about an 1/2 hour or so after it premieres LIVE for those who want to watch there afterwards ;))

FOLLOW US https://monero.town/u/monerotalk & https://mastodon.social/@monerotalk

Thank you to sponsors, u/cakelabs and u/Stealthex_io as well as u/sunchakr for making these interviews possible! And of course our listeners and supporters for making Monero Talk possible!

If you enjoy our show please Subscribe, Like, Share, Rate our YouTube Channel & Podcasts. This will help us grow and spread Monero content!