@theopenem_admin ( this is just one of the msi's others look like this

c9ab.msi
1b5af34b.msi
6a45.msi
24c9d42f.msi
e2262d.msi

really appreciate the help

@theopenem_admin Hi we are seeing that defender is also picking up and blocking random MSI's being created in C:/Windows/Installer/ is this expected behaviour?