The install/uninstall and local helper code is public. The 29 published local files were compared byte-for-byte with the actual distributed ZIP. The C++ inspection tool is a source reference and is not marked as a reproducible build. This does not include the cloud's analysis, plan generation, signing, payment, entitlement issuance, or personal offline conversion rights.
DrWeb labelled this component Trojan.MulDrop36.36111. Its job is to unpack and install the selected USB driver after administrator approval. The distributed file is byte-identical to Raspberry Pi usbboot's pinned upstream file, SHA-256 e5c3c51396e5aeacc5b63d2991623894eb5a6a8981b7aef680e1d0d8af8a4387. This rules out a local byte change relative to that file; it does not establish DrWeb's reason or prove safety.
2. Python runtime files
The bundled-file reports include DLLs/libffi-8.dll (Cynet) and Lib/venv/scripts/nt/pythonw.exe (Trapmine). We downloaded Astral's official 20260414 CPython 3.11.15 Windows archive, verified its published archive SHA-256 71ffdf290e0483f0881e02518ecb9cedb449807856ae7dc76aa630e5acd00919, and compared the actual files: both match exactly, as do the Python interpreter and Python DLL. libffi is the foreign-function interface dependency used by Python's native-call support. The venv launcher is bundled standard-runtime material, not a separately downloaded co-Link program. No claim is made that these observations explain every ZIP-level detection.
3. The co-Link.exe we built
A separate direct EXE analysis reported Trapmine suspicious.low.ml.score and Gridinsoft Trojan.Heur!.02016023. Those are the reported labels; the presence of ML/Heur in a label is not confirmation of a false positive. We do not yet have a vendor explanation or a vendor-confirmed false-positive verdict for this EXE. The upstream checks above do not resolve these separate detections.
Release decision
New binary downloads are paused. Source inspection and these exact reports remain public. We will not silently rename/repack binaries, disable antivirus, or present this as a clean release. Distribution can resume after the findings are corrected or supported by a documented review sufficient to explain the exact files.
Direct main EXE check
The co-Link.exe inside the Setup ZIP was also submitted separately.
Some bundled-file reports identify wdi-simple.exe and Python runtime files. The distributed wdi-simple.exe matches the pinned Raspberry Pi upstream bytes; this establishes provenance, not safety. Investigation of the ZIP-level detections is not complete.
The helper temporarily connects the website to local device inspection, backup and driver operations. It is not required for ordinary playback after conversion. Changing the chosen dongle can disconnect its other devices. Administrator approval is needed for driver changes; keep your original backup.
Some launch scripts use an encoded command for reliable argument passing and a process-scoped PowerShell launch option. Read the public scripts before approving UAC. UAC is consent, not proof of authorship.
Limits
Source disclosure covers these local components, not the full closed desktop EXE. Antivirus scans are engine-, time- and file-specific. Undetected is not a safety guarantee; some scanners cannot inspect all nested archive formats. A hash identifies bytes, not safety. This report is developer-published evidence, not a Microsoft certification. The app is not code-signed yet.
Publishing part of the source and an undetected antivirus result is not presented as certification that no malicious function exists. If a file changes, earlier scan results do not apply to the new file. External Adaptive source encoders, firmware, pairing keys and cloud secrets are not distributed.