File scan report
Verdict Safe
Is windowsdesktop-
This .NET Windows Desktop Runtime 6.0.36 installer carries a valid signature, none of the 70 antivirus engines that checked it flagged it, and thousands of users have submitted it.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
This installer can be used normally. Get .NET runtimes from Microsoft's official download pages and keep your security software enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 5
- Code signing .NET
- Test run Completed
- First seen 1y ago
Chapter 02
Why we think so
0 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 70 antivirus engines that checked it flagged this installer, and every major antivirus engine reported it clean. It carries a valid .NET signature, has been seen from over 3,700 sources for nearly two years, and its activity in the test run matches a standard Microsoft runtime setup.
The file is a WiX Burn bootstrapper for the .NET Windows Desktop Runtime 6.0.36. Its signature verified, and every earlier sample from the same signer that we hold was clean. The sandbox run returned clean and showed no high-risk techniques or injection. The run extracted installer resources and wrote standard uninstall and dependency registry entries, and its only network contacts were background Microsoft traffic. A single community YARA rule matched, but it is not corroborated by any other evidence and carries little weight against this broad, long-standing prevalence.
What We Detected
None of the 70 antivirus engines that checked it flagged this file. The installer has a valid signature from the .NET signer and has been submitted more than 71,000 times from 3,701 sources since November 2024. Similar runtime installers from the same signer were previously judged clean.
Threat Behavior
In the sandbox, the file behaved like a standard WiX Burn installer. It copied itself to a temporary clean-room folder, unpacked its bootstrapper UI files, ran Windows Installer, and registered uninstall and dependency keys. No high-risk techniques or process injection were recorded, and the only network contacts were background Microsoft traffic. One community pattern rule matched, but nothing else corroborates it.
What To Do Now
This installer can be used normally. As with any runtime, download it from Microsoft's official .NET site and keep your antivirus enabled.
Where this verdict could be wrong1 caveat
- A single community YARA rule named 'RANSOMWARE' matched, but it is one unvetted rule against zero engine detections, no high-risk runtime techniques and broad prevalence, which fits a false match on a large installer.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 70 antivirus engines that checked it flagged the file, including every major antivirus engine
- Valid digital signature from the .NET signer, with a fully clean history
- Very widely distributed: over 3,700 sources across nearly two years
- Sandbox behaviour matches a standard Microsoft runtime installer, with no high-risk techniques
- Earlier .NET runtime installers from the same signer were all judged clean
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 31sandbox rule tags
- 15spawned processes
- 6network contacts
- 39filesystem & mutex artifacts
Includes the sandbox verdicts, 31 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; signed by .NET.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 3, 2026, 5:15 PM UTC
- SHA-256
0d20debb26fc8b2bc84f25fbd9d4596a6364af8517ebf012e8b871127b798941- SHA-1
c290c59e58f6629f0d0fa66b05ee740079b6ccda- MD5
2f34b7c01b2c0ec8c95e2050d0a48b56
About this file
windowsdesktop-runtime-6.0.36-win-x64.exe is a Win32 EXE file of 57.4 MB.
- Type and size
- Win32 EXE · 57.4 MB
- Signer
- .NETValid code signature.
- First seen
- Nov 12, 2024On VirusTotal.
- Submitted by
- 3,701 distinct sources
- Packer
- None detected
- Entropy
- 6.10 of 8
First scanned Updated
Includes every engine result (75), 6 matched signature rules, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is windowsdesktop-runtime-6.0.36-win-x64.exe safe?
What is windowsdesktop-runtime-6.0.36-win-x64.exe?
How many antivirus engines detected windowsdesktop-runtime-6.0.36-win-x64.exe?
Is windowsdesktop-runtime-6.0.36-win-x64.exe digitally signed?
What is the SHA-256 hash of windowsdesktop-runtime-6.0.36-win-x64.exe?
Is it safe to run windowsdesktop-runtime-6.0.36-win-x64.exe?
How up to date is this analysis of windowsdesktop-runtime-6.0.36-win-x64.exe?
Community
Member reviews and reports for this exact file hash.