File scan report
Verdict Safe
Is windowsdesktop-
This .NET Desktop Runtime 7.0.20 installer is widely distributed and validly signed, with no detections among 75 engines and clean sandbox and network results.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
This installer can be run normally. Obtain future runtime installers from official Microsoft download channels.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 40 flagged
- Flagged 0
- No detection 40
- No result 35
- Code signing .NET
- Test run Completed
- First seen 2y ago
Chapter 02
Why we think so
0 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 40 antivirus engines that checked it flagged this installer. It carries a verified signature from the .NET signer and has been seen from over 3,700 sources since it was first seen on May 28, 2024. Sandbox runs showed ordinary installer activity, and none of the contacted hosts are known bad.
No engine flagged the file, and five major antivirus engines returned a clean result. The signature verifies, and every earlier sample from the same signer in our records was clean, including other versions of this runtime installer. The file is very widely submitted, and no public malware database or malware-specific rule lists it. The combined sandbox verdict was clean. The recorded behaviour, including a one-time startup registry entry, matches a standard WiX-based installer, and every dropped file we hold a verdict for is a known software component. A community comment naming malware is uncorroborated by any other evidence.
What We Detected
None of the 40 antivirus engines that checked it flagged this .NET Desktop Runtime 7.0.20 installer. It has a verified signature from the .NET signer, has been submitted by over 3,700 sources since it was first seen on May 28, 2024, and matches no public malware database entries or malware-specific rules.
Threat Behavior
Seven sandbox runs produced a combined clean verdict and recorded no high-risk techniques. The installer extracts its setup components, runs Windows Installer packages and sets a one-time startup entry used to resume setup after a reboot. Dropped files with verdicts are known software components, and none of the contacted hosts are known malicious or suspicious.
What To Do Now
This installer can be used normally. As always, download runtime installers from the official Microsoft or .NET download pages.
Where this verdict could be wrong2 caveats
- A community annotation tags the file with an infostealer family name, but no engine, malware-specific rule, sandbox verdict or contacted host supports that claim.
- The sandbox recorded a startup registry entry. It matches the installer's own resume-after-reboot mechanism, not an unknown program.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No detections among 75 antivirus engines
- Valid digital signature from the .NET signer with a fully clean history
- Widely distributed: over 3,700 sources since May 2024
- Sandbox runs showed only standard installer behaviour, with a clean combined verdict
- Dropped files with verdicts match known-software reference entries
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 7 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 7isolated sandbox runs
- 30sandbox rule tags
- 15spawned processes
- 21network contacts
- 39filesystem & mutex artifacts
Includes the sandbox verdicts, 30 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 40 antivirus engines that checked it flag it; signed by .NET.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 24, 2026, 2:35 AM UTC
- SHA-256
57e7c16e7226c9a29dbc3faedd9e5876cec494c7660528052f52160521e7b714- SHA-1
c1606df0870f304f0ed56adbd41290016044df3e- MD5
b474f5f22ebde90237c77cf54c529a14
About this file
windowsdesktop-runtime-7.0.20-win-x64.exe says it is Microsoft Windows Desktop Runtime - 7.0.20 (x64), 58.0 MB.
- Claims to be
- Microsoft Windows Desktop Runtime - 7.0.20 (x64)From the file's own version information, written by whoever built it.
- Original name
- windowsdesktop-runtime-7.0.20-win-x64.exeMatches the shared file name.
- Type and size
- Win32 EXE · 58.0 MB
- Signer
- .NETValid code signature.
- First seen
- May 28, 2024On VirusTotal.
- Submitted by
- 3,710 distinct sources
- Packer
- None detected
- Entropy
- 6.12 of 8
First scanned
Includes every engine result (75), 1 matched signature rule, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is windowsdesktop-runtime-7.0.20-win-x64.exe safe?
What is windowsdesktop-runtime-7.0.20-win-x64.exe?
How many antivirus engines detected windowsdesktop-runtime-7.0.20-win-x64.exe?
Is windowsdesktop-runtime-7.0.20-win-x64.exe digitally signed?
What is the SHA-256 hash of windowsdesktop-runtime-7.0.20-win-x64.exe?
Is it safe to run windowsdesktop-runtime-7.0.20-win-x64.exe?
How up to date is this analysis of windowsdesktop-runtime-7.0.20-win-x64.exe?
Community
Member reviews and reports for this exact file hash.