Is SetAoEDE.exe safe?
Only 2 of 76 engines flagged this older unsigned executable, but observed T1055 process-injection activity prevents treating the sparse detections as harmless.
The detections are sparse and nonspecific: 2 of 76 engines flagged the file, while all 17 tier-1 engines were silent. However, one sandbox mapped its activity to T1055 process injection, and the unsigned publisher identity plus incomplete network-reputation coverage warrant caution despite the absence of corroborating malware intelligence.
adf3e24fd77347a52e…42c2ee2e79b36bRecommended next actions
Before running
Do not run it until the source and publisher can be verified independently.
If you already ran it
Stop using it, scan the device, and watch for unexpected behavior or security alerts. Get a fresh copy from the developer's official site or an official app store.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
The detections are sparse and nonspecific: 2 of 76 engines flagged the file, while all 17 tier-1 engines were silent. However, one sandbox mapped its activity to T1055 process injection, and the unsigned publisher identity plus incomplete network-reputation coverage warrant caution despite the absence of corroborating malware intelligence.
Two of 76 engines raised detections, with no tier-1 detection or shared malware-family identification. CrowdStrike called the sample grayware, while Bkav supplied a generic machine-learning label, making the engine evidence relatively weak. A completed sandbox run nevertheless mapped activity to T1055 process injection, which is a meaningful risk signal even without a malicious sandbox verdict. The sample is more than eight years old and moderately distributed, and neither the two inspected child files nor external intelligence supplied malware corroboration. Because host-reputation inspection covered only one of the listed network contacts and the executable is unsigned, the evidence does not support confidently dismissing the runtime concern.
What We Detected
Two of 76 antivirus engines flagged the executable. CrowdStrike reported grayware with 60% confidence, and Bkav used a generic detection; none of the 17 tier-1 engines detected it, and no engine consensus identified a malware family.
Threat Behavior
One completed sandbox run mapped activity to MITRE T1055, indicating possible process injection. The run did not produce a malicious sandbox verdict or persistence indicators, and two inspected dropped children were not identified as malicious. Network-reputation coverage was incomplete: only www.microsoft.com was cross-checked, while the remaining listed IP contacts were not covered by the saved host-reputation result.
What To Do Now
Do not run the file unless its origin and intended purpose can be verified. Keep endpoint protection enabled, obtain a fresh copy from the official developer or distributor, and compare its hash or signature with an authoritative release before use.
Where this verdict could be wrong4 caveats
- The executable is unsigned despite signing.applicable=true, so publisher identity and release provenance cannot be verified.
- T1055 process-injection mapping is an offensive runtime signal even though the sandbox issued no malicious verdict.
- contactedHosts.inspected=1 does not cover all 15 distinct contacts listed under behaviour, leaving most network reputation unchecked.
- CrowdStrike's grayware detection is a tier-2 counter-signal, so this is not a low-trust-only detection pattern.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- All 17 tier-1 engines reported no detection
- Only 2 of 76 engines flagged the sample
- No malicious sandbox verdict or persistence indicators
- No malicious child among 2 inspected dropped files
- No MalwareBazaar or YARAify corroboration
- Unsigned Win32 executable with no verifiable publisher identity
- T1055 process-injection behavior mapped during one sandbox run
- CrowdStrike tier-2 grayware detection
- Incomplete reputation coverage for listed network contacts
Quarantine the current copy until its source can be verified, and replace it with a copy obtained directly from an official release channel. Keep antivirus and endpoint protection enabled during any further examination.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete2 of 76 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Partial1 of 15 contacted hosts were cross-checked; coverage is incomplete.
YARA
Complete1 signature or behavior rule matched.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 13MITRE ATT&CK techniques
- 15spawned processes
- 15network contacts
- 26filesystem & mutex artifacts
What this file does
Observed actions and their security significance
High concern: Injected code into another process, a technique that can conceal execution.
Moderate concern: Contained obfuscated or packed code that makes inspection harder.
Moderate concern: Runs hidden system commands (script or shell).
Moderate concern: Communicated over a common application protocol; malware can use this for command-and-control.
Moderate concern: Scans through your files and folders.
Moderate concern: Decoded or unpacked concealed content while running.
Note: Reads your Windows user-account details.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
SetAoEDE.exe
adf3e24fd77347a52e6495f58ba2594ad682c8123d5865eb0842c2ee2e79b36b
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Users\<USER>\Desktop\program.exe"
02Isolated runtime analysis - ProcessObserved
Observed process
"C:\Users\<USER>\AppData\Local\Temp\is-DDH14.tmp\program.tmp" /SL5="$20196,148480,0,C:\Users\<USER>\Desktop\program.exe"
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
program.tmp
C:\Users\<USER>\AppData\Local\Temp\is-DDH14.tmp\program.tmp
04Isolated runtime analysis - Written fileObserved
_setup64.tmp
C:\Users\<USER>\AppData\Local\Temp\is-GBRFQ.tmp\_isetup\_setup64.tmp
05Isolated runtime analysis - +1 more recorded observation in Analyst mode
Network
Hosts contacted
- Contacted hostDerived
www.microsoft.com
Saved reputation verdict: safe.
06Contacted-host cross-check - Contacted hostObserved
204.79.197.203
Contact observed during runtime.
07Isolated runtime analysis - +1 more recorded observation in Analyst mode
7 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- www.microsoft.com
- 204.79.197.203
- 209.85.200.94
- 23.216.147.64
- 23.216.147.76
- 20.99.186.246
- 23.51.202.8
- 52.154.209.174
- 23.216.81.152
- a83f:8110:0:0:f8ff:ffff:1023:6e00
- 23.59.198.43
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\Owner
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
- HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\Owner
- C:\Users\<USER>\AppData\Local\Temp\is-DDH14.tmp\program.tmp
- C:\Users\<USER>\AppData\Local\Temp\is-GBRFQ.tmp\_isetup\_setup64.tmp
- C:\Users\<USER>\AppData\Local\Temp\is-GBRFQ.tmp\bubbletro.dll
- C:\Users\ADMINI~1\AppData\Local\Temp\is-2AON6.tmp
- C:\Users\ADMINI~1\AppData\Local\Temp\is-2AON6.tmp\1538255576.tmp
- C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\is-OPAPT.tmp\adf3e24fd77347a52e6495f58ba2594ad682c8123d5865eb0842c2ee2e79b36b.tmp
- Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
- Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
- oleacc-msaa-loaded
- CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
- CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
Files this sample writes at runtime
This file drops 2 children at runtime. None are currently flagged malicious in our cache.
- 2ba1d3e9f542ea25a3d8…339215Never scannednever seen before
- 388a796580234efc95f3…136f95Never scannednever seen before
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 1rule hit recorded
- 2 / 76engines flagged
- 77sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
1 high-confidence signature or behavior rule matched this file.
Verdict inputView chapterProvenanceDerivedSourceSignature and behavior rulesObserved at - 02
2 of 76 antivirus engines flagged the file, including Bkav and CrowdStrike.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 03
The hash has been submitted 100 times from 77 sources.
ProvenanceDerivedSourceSaved report factsObserved at - 04
Scanned file: SetAoEDE.exe — adf3e24fd77347a52e6495f58ba2594ad682c8123d5865eb0842c2ee2e79b36b
ProvenanceObservedSourceUploaded fileObserved at - 05
Observed process — "C:\Users\<USER>\Desktop\program.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
Observed process — "C:\Users\<USER>\AppData\Local\Temp\is-DDH14.tmp\program.tmp" /SL5="$20196,148480,0,C:\Users\<USER>\Desktop\program.exe"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 07
File written: program.tmp — C:\Users\<USER>\AppData\Local\Temp\is-DDH14.tmp\program.tmp
ProvenanceObservedSourceIsolated runtime analysisObserved at - 08
File written: _setup64.tmp — C:\Users\<USER>\AppData\Local\Temp\is-GBRFQ.tmp\_isetup\_setup64.tmp
ProvenanceObservedSourceIsolated runtime analysisObserved at - 09
Contacted host: www.microsoft.com — Saved reputation verdict: safe.
ProvenanceDerivedSourceContacted-host cross-checkObserved at - 10
Contacted host: 204.79.197.203 — Contact observed during runtime.
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
Category: pua
MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.
Signatures and behavior heuristics
A community signature or high-severity behavioral heuristic matched. Signatures identify known patterns; heuristics are strong leads but are not proof on their own.
The saved runtime evidence maps this activity to MITRE T1055 (Process Injection). The mapping supports possible process injection, but it does not prove the exact injection method or the operator's intent.
Evidence"C:\Users\<USER>\Desktop\program.exe"
2 of 76 engines flagged this file
View all 76 engine results
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Fingerprint and provenance
- File name
- SetAoEDE.exe
- Format
- Win32 EXE
- Code signing
- No verified publisher
- Size
- 3.3 MB
- Last analyzed
- Oct 5, 2026, 7:51 AM UTC
adf3e24fd77347a52e6495f58ba2594ad682c8123d5865eb0842c2ee2e79b36bSafety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
We couldn't fully clear this file. Treat it with caution.
- Recovery step 01
Don't run it unless you're certain it came from a source you trust.
- Recovery step 02
Check where you got it — an unexpected attachment or a random download link is a red flag.
- Recovery step 03
If its origin cannot be confirmed, delete this file and use a fresh copy from a trusted source. Get a fresh copy from the developer's official site or an official app store.
- Recovery step 04
If you're still unsure, scan it again in a day or two — detections often catch up on newer files.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is SetAoEDE.exe safe, or is it malware?
What is SetAoEDE.exe?
How many antivirus engines detected SetAoEDE.exe?
What should I do if I already ran SetAoEDE.exe?
How do I remove SetAoEDE.exe?
What kind of malware is SetAoEDE.exe?
What is the SHA-256 hash of SetAoEDE.exe?
How up to date is this analysis of SetAoEDE.exe?
Community
Member reviews and reports for this exact file hash.