Just reporting the false positives in Defender scan.
I overwrote with fresh copy of wp 4.4.2 and the following are still reporting modified
"WORDPRESS CORE This WordPress core file appears modified"
Also Gravity Forms - this one isn't Defender's fault, but it could confuse people because they have to manually install, as the GF update isn't available in the updates dashboard (perhaps an explanation why you are sending them to GF?).
Access granted in case you need it