Should I worry?

[fanelaru]

Defender is suspicious with freebuff.exe. Any idea what is happening?

[fanelaru]

Besides this message, I noticed (it happened twice) Teams is requesting password change when freebuff starts to work on a prompt.

[lab1207]

Almost certainly a false positive — small independent dev-tool binaries get flagged routinely (unsigned or newly-seen executables with updater/packer patterns trip heuristics). Do this to confirm in 2 minutes:

1. Check the signature yourself: right-click freebuff.exe → Properties → Digital Signatures, or in PowerShell: Get-AuthenticodeSignature .\freebuff.exe. Unsigned or just-published cert = expected Defender noise, not compromise.
2. Upload the exact file hash (not the file) to VirusTotal — if only 1–3 vendors flag it with generic names (like Trojan:Win32/Wacatac or ML-heuristic labels) while 60+ pass it, that's the false-positive signature.
3. Confirm provenance: download only from the official release page and compare the SHA256 with the published checksum. Match = safe.

If all three check out, add a Defender exclusion for the install folder and report it to the maintainers (they can submit the binary to Microsoft for analysis to clear the flag for everyone). If the hash does NOT match the official checksum, stop and report that immediately — that's the one case that isn't a false positive.