Why is the program flagged by antivirus?

Explanation of antivirus detection

This is a false positive. Any high-quality private software designed to bypass anti-cheats uses techniques that antiviruses flag as suspicious - simply because these are the same techniques used by actual malware. An antivirus alert is a sign that the software is operating at a low system level.

Q: Is a cheat that doesn't trigger an antivirus detection better?

No. Private software that doesn't trigger an antivirus either lacks necessary low-level operations (likely failing against serious anti-cheats) or is already in the anti-cheat's signature database.

Q: Is 40/72 detections on VirusTotal normal?

Yes, this is absolutely normal. These are not detections of a specific virus - they are detections of the Themida protector used to shield the code. Themida is a legal, commercial software used to protect programs from reverse engineering.

W64/Themida.WN
Win64/Packed.Themida.Q
Suspicious App
Generic.Packed
Unsafe

Q: But isn't 40 detections a lot?

The paradox is that actual viruses usually have 0–5 detections on VirusTotal, not 40. Malware developers test their files on VT before distribution and use private cryptors. We use Themida - a public commercial protector. We don't need to hide from antiviruses; we need to protect the code from analysis by anti-cheats.

A high detection count on VT with labels like "Themida/Packed/Suspicious" is a sign of legitimate protected software, not a virus. Antivirus detections are a side effect of the technologies required to operate at the kernel level.