// security
Short answer: yes, antiviruses do flag it. We don't hide it — below we show one by one how many engines flag it and why, and explain what those warnings mean.
If we told you "our file is spotless, no warnings at all" and you then saw the warnings on VirusTotal, you'd rightly doubt everything else we say. So we tell it as it is.
Which product? The VirusTotal results below belong to the External (EloHane.exe) file. Internal works differently and is covered separately below.
6 / 70+
engines flag it
VirusTotal scans a file with more than 70 antivirus engines at once. For EloHane, 6 of them flag it; the rest report it as clean.
What matters is not the number but the type of warning — as you'll see below, all six are based on guesswork.
Antivirus detections come in two kinds. Signature detection means the file exactly matches known malware — that is definite. Machine learning / heuristic detection is a guess along the lines of "this file looks suspicious to me". Of the six detections below, all belong to the second group; the labels themselves say so.
W32.Malware.372C9F37
Not the name of any specific malware; an ID generated from the file itself. It's the equivalent of saying "I don't recognise this, it's suspicious".
Malicious (high Confidence)
No malware name — just a confidence score from the model. It doesn't say which behaviour triggered it.
Trojan:Win32/Wacatac.B!ml
The trailing !ml suffix means "machine learning": no signature matched, a model made a guess. Wacatac is one of Defender's broadest generic labels.
Trojan.Kryptik@AI.95
@AI suffix again shows it's a model prediction. Kryptik is a generic family name meaning "packed/compressed executable".
Malicious
A one-word result. Which malware, which behaviour — none of it is stated.
ML.Attribute.HighConfidence
The label itself starts with ML (machine learning): this is not a signature match but model output.
None of the six detections contains the name of a specific piece of malware. They are all Malicious, Wacatac, Kryptik -style generic family labels or plain model output. If this were a real infection, the engines would all give the malware the same name.
Because the things an ESP program has to do are technically similar to what malware does. The antivirus sees the similarity but not the purpose.
Reading CS2's memory is done with standard Windows functions. Because info-stealing malware uses the same functions, this behaviour alone is considered suspicious.
The ESP and menu are drawn on a transparent window sitting on top of the game. This "overlay" technique is also used by screen-capturing software.
We don't have an expensive code-signing certificate and the file isn't installed on millions of computers. Windows warns about every new .exe it doesn't recognise, without looking at its contents.
When the game updates, we update the program too. For antiviruses, "a new file that changes every week and few people have" is a risk signal in itself.
The most practical way to tell whether a file is malicious is to check whether it does the things real malware has to do.
Makes no permanent changes to your system
It doesn't write to the registry, doesn't install Windows services or tasks and doesn't add itself to startup. It only keeps a settings file under Documents\EloHane.
Doesn't touch your files
It doesn't encrypt, delete or copy any file. There isn't a single line of ransomware-like behaviour.
Doesn't send your password or personal data
Only your sign-in details (only at sign-in), your session key and your device ID go to the server — to verify that your license is valid.
Doesn't hide or replicate itself
It shows up by name in Task Manager, doesn't infect other files and fully exits when you close it.
Doesn't load code into CS2
It runs fully externally: it reads the game's memory from outside and places nothing inside the game.
Removal is one step
.exe — just delete this file; nothing is left behind.
Runs inside the game
Internal consists of a loader and a DLL. The loader loads the DLL into CS2; the menu and features run inside the game. That is how it can offer its extensive features (Ragebot, Skin Changer, material Chams).
Antivirus warnings are more likely
Loading code into another program is one of the behaviours antiviruses watch most closely. So the loader and DLL may get more warnings than External. The reason for the warning is the kind of work the file does, not that it is malicious.
Makes no permanent changes to your system
It doesn't install services or tasks and doesn't add itself to startup. Settings and the session are kept under %LOCALAPPDATA%\EloHane\Internal.
Easy to remove
Just delete the two files you extracted from the ZIP and, if you like, the folder above.
A separate matter: an antivirus warning and the risk of an in-game ban are not the same thing. An antivirus checks whether a file harms your computer. VAC checks whether you cheat in the game — and every cheat carries a ban risk, ours included. Don't believe any site that claims this risk is zero. About ban risk
We don't expect you to take anything on this page at face value. You can upload the file you downloaded straight to VirusTotal and see the result yourself.
Note: the 6 results above are from a scan of the External file at the time this page was written. Antivirus engines are updated constantly; your scan may show a slightly different number. The results also change every time we update the program, because the file changes.
For the program to run you need to add an exception to your antivirus. For Windows Defender the steps are:
If you use another antivirus the steps are similar; the section you're looking for is usually called exceptions, allow list or exclusions. If you get stuck, write to our support channel and we'll sort it out together.
It's your call: if these explanations don't convince you, don't install the program. We're not trying to talk you into putting software you don't feel comfortable with on your computer.
