[BUG] Malwarebytes Exploit Detection Triggered

### Please confirm these before moving forward

- [x] I have searched for my issue and have not found a work-in-progress/duplicate/resolved issue.
- [x] I have tested that this issue has not been fixed in the latest [(beta or stable) release](https://github.com/Devolutions/UniGetUI/releases/).
- [x] I have checked the [FAQ](https://github.com/Devolutions/UniGetUI#frequently-asked-questions) section for solutions.
- [x] This issue is about a bug (if it is not, please use the [correct template](https://github.com/Devolutions/UniGetUI/issues/new/choose)).

### UniGetUI Version

2026.2.5

### Windows version, edition, and architecture

Windows 11 Pro 26200.8894 x64

### Describe your issue

Every time I launch UniGetUI my Malwarebytes pops up with an "exploit detected and blocked" message. While I would like to assume this is a false positive due to a necessary implementation method, I would like to know what's causing it and if there's a different implementation that might not trigger as suspicious behavior. At the very least I'd like to know exactly what's causing this security alert to be triggered upon program launch (every time) for whitelisting and reporting to Malwarebytes if this is a detection flaw on their part that should not be triggering exploit protection against a suspicious implementation method/code command. Thanks!

Malwarebytes 5.6.3 (x64)
Component package version 161.0.5685
Database package version 1.0.112548
(latest update 07/26/2026 9:00 AM EST)

### Steps to reproduce the issue

Launch UniGetUI.
Malwarebytes shows the alert while the UI of the application is completing loading.

### UniGetUI Log

```text
[7/26/2026 9:07:42 AM] __ __ _ ______ __ __ ______
/ / / /___ (_) ____/__ / /_/ / / / _/
/ / / / __ \/ / / __/ _ \/ __/ / / // /
/ /_/ / / / / / /_/ / __/ /_/ /_/ // /
\____/_/ /_/_/\____/\___/\__/\____/___/
Welcome to UniGetUI Version 2026.2.5
[7/26/2026 9:07:42 AM]
[7/26/2026 9:07:42 AM] Build 107
[7/26/2026 9:07:42 AM] UI Framework: Avalonia
[7/26/2026 9:07:42 AM] Data directory C:\Users\Alex Thompson\AppData\Local\UniGetUI
[7/26/2026 9:07:42 AM] OS: Microsoft Windows 10.0.26200
[7/26/2026 9:07:42 AM] Process arch: X64 (OS: X64)
[7/26/2026 9:07:42 AM] Runtime: .NET 10.0.10
[7/26/2026 9:07:42 AM] Loaded language locale: en
[7/26/2026 9:07:42 AM] Elevated: False
[7/26/2026 9:07:42 AM] Packaged (MSIX): False
[7/26/2026 9:07:42 AM] Args: (none)
[7/26/2026 9:07:42 AM] DXGI hardware GPU detection took 15.0 ms; hardware GPU: True
[7/26/2026 9:07:43 AM] Command cargo-binstall.exe was not found on the system
[7/26/2026 9:07:43 AM] Unable to retrieve secret for resource 'UniGetUI/GitHubAccessToken': Element not found.

Cannot get credential from Vault
[7/26/2026 9:07:43 AM] Unable to retrieve secret for resource 'UniGetUI/GitHubAccessToken': Element not found.

Cannot get credential from Vault
[7/26/2026 9:07:43 AM] Starting Avalonia shell bootstrap
[7/26/2026 9:07:43 AM] Loaded language locale: en
[7/26/2026 9:07:43 AM] Generated a IPC API auth token for the current session
[7/26/2026 9:07:43 AM] PowerShell7 is not enabled
[7/26/2026 9:07:43 AM] Bun is not enabled
[7/26/2026 9:07:43 AM] Npm is not enabled
[7/26/2026 9:07:43 AM] Chocolatey is not enabled
[7/26/2026 9:07:43 AM] Scoop is not enabled
[7/26/2026 9:07:43 AM] .NET Tool is not enabled
[7/26/2026 9:07:43 AM] vcpkg is not enabled
[7/26/2026 9:07:43 AM] Cargo is not enabled
[7/26/2026 9:07:43 AM] PowerShell is enabled and was found on C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe
[7/26/2026 9:07:43 AM] Pip is enabled and was found on C:\Users\Alex Thompson\AppData\Local\Programs\Python\Python314\python.EXE
[7/26/2026 9:07:43 AM] Packaged WinGet COM activation failed (0x80040154: Class not registered), attempting lower-trust activation...
[7/26/2026 9:07:43 AM] Lower-trust WinGet COM activation failed (0x80040154: Class not registered).
[7/26/2026 9:07:43 AM] Native WinGet helper is unavailable on this machine (0x80040154: Class not registered)
[7/26/2026 9:07:43 AM] WinGet will resort to using WinGetCliHelper()
[7/26/2026 9:07:43 AM] Winget is enabled and was found on C:\Users\Alex Thompson\AppData\Local\Microsoft\WindowsApps\winget.exe
[7/26/2026 9:07:43 AM] Api running on named pipe UniGetUI.IPC
[7/26/2026 9:07:43 AM] ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
█▀▀▀▀▀▀▀▀▀▀▀▀▀ MANAGER LOADED ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
█ Name: WinGet (aka Winget)
█ Executable name: "winget.exe"
█ Executable path: "C:\Users\Alex Thompson\AppData\Local\Microsoft\WindowsApps\winget.exe"
█ Call arguments: ""
█ Version: System WinGet (CLI) Version: v1.29.280
█ Using WinGet CLI helper (CLI parsing)
█
█ WinGet is enabled and ready to go.
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
[7/26/2026 9:07:43 AM] Auto-updater source 'ProductInfo' returned version 2026.2.5.0 (upgradable=False)
[7/26/2026 9:07:46 AM] ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
█▀▀▀▀▀▀▀▀▀▀▀▀▀ MANAGER LOADED ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
█ Name: PowerShell 5.x (aka PowerShell)
█ Executable name: "powershell.exe"
█ Executable path: "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe"
█ Call arguments: " -NoProfile -Command"
█ Version: Name Value
█ ---- -----
█ PSVersion 5.1.26100.8894
█ PSEdition Desktop
█ PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
█ BuildVersion 10.0.26100.8894
█ CLRVersion 4.0.30319.42000
█ WSManStackVersion 3.0
█ PSRemotingProtocolVersion 2.3
█ SerializationVersion 1.1.0.1
█
█ PowerShell 5.x is enabled and ready to go.
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
[7/26/2026 9:07:48 AM] ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
█▀▀▀▀▀▀▀▀▀▀▀▀▀ MANAGER LOADED ▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
█ Name: Pip (aka Pip)
█ Executable name: "pip"
█ Executable path: "C:\Users\Alex Thompson\AppData\Local\Programs\Python\Python314\python.EXE"
█ Call arguments: "-m pip "
█ Version: pip 26.1.2 from C:\Users\Alex Thompson\AppData\Local\Programs\Python\Python314\Lib\site-packages\pip (python 3.14)
█
█ Pip is enabled and ready to go.
▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
[7/26/2026 9:07:50 AM] Integrity check passed successfully!
[7/26/2026 9:07:50 AM] Avalonia shell bootstrap completed
[7/26/2026 9:07:53 AM] Found 151 installed packages from Winget
[7/26/2026 9:07:54 AM] Found 0 installed packages from PowerShell
[7/26/2026 9:07:54 AM] Found 0 installed packages from PowerShell
[7/26/2026 9:07:54 AM] Found 0 available updates from PowerShell
[7/26/2026 9:07:55 AM] Found 0 available updates from Winget
[7/26/2026 9:07:55 AM] Found 45 installed packages from Pip
[7/26/2026 9:07:59 AM] Found 0 available updates from Pip
[7/26/2026 9:14:39 AM] Unable to retrieve secret for resource 'UniGetUI/GitHubAccessToken': Element not found.

Cannot get credential from Vault
```

### Package Managers Logs

```text
Manager WinGet with version:
System WinGet (CLI) Version: v1.29.280
Using WinGet CLI helper (CLI parsing)

——————————————————————————————————————————

Logged subprocess-based task on manager Winget. Task type is FindPackages
Subprocess executable: "C:\Users\Alex Thompson\AppData\Local\Microsoft\WindowsApps\winget.exe"
Command-line arguments: " source list "
Process start time: 7/26/2026 9:07:43 AM
Process end time: 7/26/2026 9:07:43 AM

-- Process STDOUT
...

Return code: SUCCESS (0)

——————————————————————————————————————————
Logged subprocess-based task on manager Winget. Task type is ListInstalledPackages
Subprocess executable: "C:\Users\Alex Thompson\AppData\Local\Microsoft\WindowsApps\winget.exe"
Command-line arguments: " list --accept-source-agreements "
Process start time: 7/26/2026 9:07:50 AM
Process end time: 7/26/2026 9:07:53 AM

-- Process STDOUT
...

Return code: SUCCESS (0)

——————————————————————————————————————————
Logged subprocess-based task on manager Winget. Task type is RefreshIndexes
Subprocess executable: "C:\Users\Alex Thompson\AppData\Local\Microsoft\WindowsApps\winget.exe"
Command-line arguments: " source update --disable-interactivity "
Process start time: 7/26/2026 9:07:53 AM
Process end time: 7/26/2026 9:07:54 AM

-- Process STDOUT
...

Return code: SUCCESS (0)

——————————————————————————————————————————
Logged subprocess-based task on manager Winget. Task type is ListUpdates
Subprocess executable: "C:\Users\Alex Thompson\AppData\Local\Microsoft\WindowsApps\winget.exe"
Command-line arguments: " update --include-unknown --accept-source-agreements "
Process start time: 7/26/2026 9:07:54 AM
Process end time: 7/26/2026 9:07:55 AM

-- Process STDOUT
...

Return code: SUCCESS (0)

——————————————————————————————————————————
```

### Relevant information

No special settings set other than having Exploit Protection enabled within Malwarebytes.

### Screenshots and videos

No source file or test is named. Reproduce the alert while launching UniGetUI and compare Malwarebytes timing with the logged Avalonia shell bootstrap and integrity-check stages; trace the startup path to identify the operation that triggers the detection. Done means the trigger is identified and the launch no longer produces the alert, or the cause is documented for Malwarebytes reporting.

Written by the indexing model from the issue text.