Yeah, I've been working for weeks on this issue, making lots of changes in the runtime to remove some function calls that could be seen by AV's as suspicious, changing signatures of the various parts of the EXE according to the MFA, adding a new option to separate the EXE from app data and extension DLLs, etc. Results are good for the moment, a new beta is being tested and should be posted today.