Windows warning about NimbusBackup?
It's a false positive.

1. Go binaries look unusual to antivirus engines

Go produces large, statically-linked executables with no external DLLs and their own runtime. Machine-learning scanners are trained mostly on "traditional" binaries (MSVC, dynamically linked), so a Go binary stands out as atypical. And because much modern malware is also written in Go, engines weight that profile negatively.

2. Stripping + PIE = high entropy

Build flags -s -w strip symbols and -buildmode=pie randomizes addressing. The binary then looks packed or obfuscated — a classic malware signal — when these are in fact sound compilation practices.

3. Wails loads WebView2 in memory

Startup loads a loader (go-winloader) to initialize the WebView2 rendering engine. This in-memory DLL loading is also a technique used by some malware: the heuristic fires, even though it's the normal way Wails works.

4. A backup tool "looks like" ransomware

Each step is legitimate in isolation, but together they statistically resemble the profile of ransomware — exactly what behavioural detection (generic Wacatac / Sabsik families) is built to catch:

• • requesting administrator rights (UAC);
• • creating VSS shadow copies;
• • reading entire drives recursively;
• • compressing + encrypting data;
• • uploading over the network (TLS) to a remote server;
• • installing a LocalSystem service.

5. No reputation yet + retroactive re-flagging

A recent, unsigned binary starts with zero SmartScreen/Defender reputation. And because definitions update continuously, a file that was clean yesterday can be flagged today with no code change — which is why the alert is intermittent.