That's so strange, I think the most likely case is that Defender is just mis-classifying the file, but it's even weirder that you mention there's no scheduled queries...