File scan report

Verdict Safe

Analyzed Jun 2, 20264 months ago

Is Bulk Edit Calendar Events setup [6.4].exe safe? Yes, no threats found.

Unsigned but long-established installer with zero engine detections and clean sandbox behaviour.

Strong evidence · Widely seen for a long time, and nothing harmful found.

Install it as usual if it came from the official source

Treat as safe; the sample matches the profile of a long-standing benign installer.

Good practice2 tips

We found nothing harmful in this file.

Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Reads the latest antivirus results for this file's hash. Nothing is uploaded.

Antivirus results

0 of 66 flagged

Flagged 0
No detection 66
No result 10

FileBulk Edit Calendar Events setup [6.4].exe45.2 MBSHA-256 831cdab883af…f9df1e

Code signing Unsigned
Test run Completed
First seen 3y ago

None of the 66 antivirus engines that checked it flag it.

Chapter 02

Why we think so

0 points against it and 3 in its favour, checked against the scan evidence.

Analyst conclusion

No antivirus engine flagged the file. Prevalence data shows it has been submitted by 148 sources since 2022 with no malicious labels. Behavioural flags appear to be artefacts of a .NET installer rather than malice.

Where this verdict could be wrong1 caveat

Synthetic rules two of our behaviour rules fired on and direct-IP contacts, which could indicate evasion if the sample were malicious — but zero AV detections and clean sandbox results make this unlikely.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · 5 complete · 1 partial. See every source

Chapter 03

What it did in our test

It ran in our isolated test environment; no test environment rated what it did as risky.

Test run summary

Capture complete

28sandbox rule tags
12spawned processes
5network contacts
40filesystem & mutex artifacts

Runtime behaviour

What this file did when executed

This file was run in a sandbox and its runtime behaviour was observed.

Techniques observed in the sandbox

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1012
T1018
T1027· Obfuscated code
T1033· Reads user info
T1036
T1055· Process injection
T1057· Lists programs
T1059· Runs commands
T1070· Covers its tracks
T1071· Application protocol
T1082· System recon
T1083· Scans your files
T1106
T1112
T1129· Loads modules
T1134
T1140· Deobfuscation
T1497.001· Sandbox evasion
T1518.001· Checks your AV
T1529
T1539
T1543.003· Service install
T1562.001· Disables security
T1564· Hides artifacts
T1564.001· Hides artifacts
T1574.002· Execution hijack
T1614
T1614.001

Observed activity

Processes started

Programs the file ran, with their command lines.

software.exe"C:\Users\<USER>\AppData\Local\Temp\software.exe"
software.tmp"C:\Users\<USER>\AppData\Local\Temp\is-LOS6N.tmp\software.tmp" /SL5="$5005A,44390983,876032,C:\Users\<USER>\AppData\Local\Temp\software.exe"
Bulk Edit Calendar Events.exe"C:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\Bulk Edit Calendar Events.exe"
Bulk Edit Calendar Events_WPF.exe"C:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\net6.0\Bulk Edit Calendar Events_WPF.exe"
chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=6.0.0&arch=x64&rid=win-x64&os=win10&gui=true
chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\<USER>\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\<USER>\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.112 --initial-client-data=0x204,0x208,0x20c,0x1c4,0x210,0x7ff85ea3dc40,0x7ff85ea3dc4c,0x7ff85ea3dc58

Show all 12 entries

chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2264 --field-trial-handle=1740,i,5443968817239447452,2705169190882534289,262144 --variations-seed-version=20240522-180050.589000 /prefetch:3
chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4980 --field-trial-handle=1740,i,5443968817239447452,2705169190882534289,262144 --variations-seed-version=20240522-180050.589000 /prefetch:8
chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5472 --field-trial-handle=1740,i,5443968817239447452,2705169190882534289,262144 --variations-seed-version=20240522-180050.589000 /prefetch:8
chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5612 --field-trial-handle=1740,i,5443968817239447452,2705169190882534289,262144 --variations-seed-version=20240522-180050.589000 /prefetch:8
chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5476 --field-trial-handle=1740,i,5443968817239447452,2705169190882534289,262144 --variations-seed-version=20240522-180050.589000 /prefetch:8
elevation_service.exe"C:\Program Files\Google\Chrome\Application\122.0.6261.112\elevation_service.exe"

Network contacts

5 hosts, listed as 4 addresses, 1 link. Links show the host and path only.

IP address23.39.19.41
IP address23.37.17.215
IP address74.125.195.84
IP address23.197.238.105
URLhttp://go.microsoft.com/fwlink/

Files

Files the file created, changed or deleted.

WrittenC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\unins000.exe
WrittenC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\Base.dll
WrittenC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\Base.pdb
WrittenC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\Bulk Edit Calendar Events.exe
WrittenC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\Bulk Edit Calendar Events.exe.config
WrittenC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\Bulk Edit Calendar Events.pdb

Show all 30 entries

WrittenC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\DeviceId.dll
WrittenC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\DeviceId.Mac.dll
WrittenC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\DeviceId.Windows.dll
WrittenC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\DeviceId.Windows.Mmi.dll
WrittenC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\Google.Apis.Auth.dll
WrittenC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\Google.Apis.Auth.pdb
WrittenC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\Google.Apis.Auth.PlatformServices.dll
WrittenC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\Google.Apis.Calendar.v3.dll
WrittenC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\Google.Apis.Calendar.v3.pdb
DeletedC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\is-AM3FP.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\is-VU4LJ.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\is-R3JLS.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\is-NSK7I.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\is-Q6AHA.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\is-QF3O7.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\is-7IQA1.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\is-VJDFC.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\is-QH179.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\is-KFFH4.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\is-OLOTH.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\is-AUP3Q.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\is-MBOCF.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\is-QTK61.tmp
DeletedC:\Users\<USER>\AppData\Local\Programs\Bulk Edit Calendar Events\is-T24D3.tmp

Registry and auto-start

Settings the file changed, including ways to start again after a restart.

DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0001
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\Owner
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000

Mutexes

Named locks a program uses so only one copy runs; malware families often reuse them.

Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
cversions.3.m
\Sessions\1\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
\Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex

Show all 10 entries

\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex
\Sessions\1\BaseNamedObjects\Global\NetFxSetupMutex
\Sessions\1\BaseNamedObjects\DBWinMutex
\Sessions\1\BaseNamedObjects\Global\SyncRootManager

Sandbox background — not the file

The analysis machine's own processes and connections, recorded in every run.

VM processExplorer.EXEC:\Windows\Explorer.EXE
VM processservices.exeC:\Windows\system32\services.exe
VM processsvchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p
VM host239.255.255.250
VM host224.0.0.251
VM host20.99.184.37

Show all 19 entries

VM host23.216.147.76
VM host23.216.147.64
VM host20.99.133.109
VM host192.229.211.108
VM host20.99.185.48
VM host20.99.186.246
VM host23.216.81.152
VM host131.253.33.203
VM host192.168.0.13
VM host23.198.171.50
VM host23.192.210.9
VM host151.101.22.172
VM host192.168.0.2

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.

10 not checked

d6208ec0b686ee8f3c6a…21f0cbNot checked
no saved verdict
1d3ef8698281e7cf7371…ba1183Not checked
no saved verdict
1eb1f4ef88ff4dadd39d…862093Not checked
no saved verdict
0075284a197d553e1278…cd04d1Not checked
no saved verdict
66d467872a29707393aa…49327fNot checked
no saved verdict
a39a3aefecc33b79403e…27d952Not checked
no saved verdict
3cadcb6b8a7335141c7c…d1c0d5Not checked
no saved verdict
8edb30929c11a4e5db2b…5df04aNot checked
no saved verdict
b624949df8b0e3a6153f…6610f3Not checked
no saved verdict
4b121c60103934fbe995…4b6cd7Not checked
no saved verdict

Chapter 04

Technical details

None of the 66 antivirus engines that checked it flag it; no publisher signature.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 76 enginesComplete0 of 66 engines flagged it · 10 gave no result DetailsNov 20, 2025

Sandbox runVirusTotal sandboxesCompleteRuntime behaviour was recorded DetailsJun 2, 2026

Contacted hostsMalwareTips URL scannerPartial1 of 17 contacted hosts were cross-checked; coverage is incomplete DetailsJun 2, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete1 MalwareTips behaviour rule DetailsJun 2, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedOct 18, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchOct 18, 2026

File fingerprint

Last analyzed: Jun 2, 2026, 12:12 AM UTC

SHA-256: 831cdab883af3765d28995af53239364d44cfb0c929543bae90f991891f9df1e
SHA-1: a770e3d5e1105671e86dfbe7f959cf5bc522f3d0
MD5: 93e245b8b36a7f7162e75a5d20f22e42

About this file

Bulk Edit Calendar Events setup [6.4].exe is a Win32 EXE file of 45.2 MB.

Type and size: Win32 EXE · 45.2 MB
Signer: UnsignedNo code signature.
First seen: Nov 24, 2022On VirusTotal.
Submitted by: 148 distinct sources
Packer: None detected
Entropy: 8.00 of 8

First scanned Jun 2, 2026

Antivirus consensus

0 of 66 engines flagged this file

0 malicious0 suspicious66 not flagged10 no result

10 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-117 engines
0flagged
Tier-233 engines
0flagged
Low-trust16 engines
0flagged

No antivirus engine flagged this file.

View all 76 engine results

AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
APEXClean
ArcabitClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BaiduNo result
BitDefenderClean
BitDefenderFalxNo result
BkavClean
CAT-QuickHealClean
ClamAVNo result
CMCClean
CrowdStrikeClean
CTXClean
CylanceClean
CynetNo result
DeepInstinctClean
DrWebClean
ElasticClean
EmsisoftClean
ESET-NOD32Clean
F-SecureClean
FortinetClean
GDataClean
GoogleClean
GridinsoftClean
huorongClean
IkarusClean
JiangminClean
K7AntiVirusClean
K7GWClean
KasperskyClean
KingsoftClean
LionicClean
MalwarebytesClean
MaxSecureClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
PandaClean
RisingClean
SangforClean
SentinelOneClean
SkyhighClean
SophosClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrapmineClean
TrellixENSClean
TrendMicroNo result
TrendMicro-HouseCallClean
TrustlookNo result
VaristNo result
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaNo result
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

Low-severity pattern matches — worth noting but not on their own cause for alarm.

1 heuristic

MITRE ATT&CK profile

Defense evasion× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 8.00Unpacked

Section entropy10 sections

.text

6.36

.itext

5.97

.data

5.05

.bss

0.00

.idata

5.03

.didata

2.75

.edata

1.88

.tls

0.00

.rdata

1.38

.rsrc

4.04

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

148

Hundreds of people have uploaded this — common.

Total submissions

156

Includes repeat uploads by the same source.

First seen

4y ago

Nov 24, 2022

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 6 questions people ask most about this file.

Is Bulk Edit Calendar Events setup [6.4].exe safe?

We found nothing harmful in Bulk Edit Calendar Events setup [6.4].exe. None of the 66 antivirus engines that checked it flag it. Install it only if it came from the developer's own website or an official app store.

What is Bulk Edit Calendar Events setup [6.4].exe?

Bulk Edit Calendar Events setup [6.4].exe is a software installer, about 45.2 MB. It carries no version information saying what it is or who made it. VirusTotal first saw it on Nov 24, 2022.

How many antivirus engines detected Bulk Edit Calendar Events setup [6.4].exe?

None of the 66 antivirus engines that checked it flag Bulk Edit Calendar Events setup [6.4].exe. That is a good sign, but not proof, so we also weigh who made it, how widely it is used and what it did in a test run.

What is the SHA-256 hash of Bulk Edit Calendar Events setup [6.4].exe?

The SHA-256 fingerprint of Bulk Edit Calendar Events setup [6.4].exe is 831cdab883af3765d28995af53239364d44cfb0c929543bae90f991891f9df1e, and its MD5 is 93e245b8b36a7f7162e75a5d20f22e42. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

Is it safe to install Bulk Edit Calendar Events setup [6.4].exe?

We found nothing harmful in Bulk Edit Calendar Events setup [6.4].exe. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.

How up to date is this analysis of Bulk Edit Calendar Events setup [6.4].exe?

This report reflects the scan on Jun 2, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is Bulk Edit Calendar Events setup [6.4].exe safe? Yes, no threats found.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What this file did when executed

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

File fingerprint

About this file

0 of 66 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is Bulk Edit Calendar Events setup [6.4].exe safe? Yes, no threats found.

What We Detected

Threat Behavior

What To Do Now

Test run summary

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

File fingerprint

About this file

Related file reports