File name:

SetupError.exe

Full analysis: https://app.any.run/tasks/35743aa7-8ac8-4e13-8162-f7e0924c3f44
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 21:58:28
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
xred
backdoor
delphi
dyndns
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

D0825627ACAD7FA519EDFF44292F57DF

SHA1:

10F9142F2A350FDB9822FB15766A53D5FB925C36

SHA256:

7EABE8F6D8CA61B9D4FE2FCDBA7A6297FD5C1BE86E4E8CCC7BE4A6F9CB6DE6F9

SSDEEP:

24576:y3HzLnqOaNMCFJ6kPvOxrcg0i7uF9xs5Qsa:y3HzLnqOaNMCFJ6kPvO1cg0i7WxGQsa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • SetupError.exe (PID: 6868)

    • XRED mutex has been found

      • Synaptics.exe (PID: 4808)
      • SetupError.exe (PID: 6868)
      • Synaptics.exe (PID: 5628)

    • XRED has been detected (YARA)

      • Synaptics.exe (PID: 4808)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • SetupError.exe (PID: 6868)

    • Process drops legitimate windows executable

      • SetupError.exe (PID: 6868)

    • Starts a Microsoft application from unusual location

      • ._cache_SetupError.exe (PID: 5900)

    • Reads security settings of Internet Explorer

      • SetupError.exe (PID: 6868)
      • Synaptics.exe (PID: 4808)

    • There is functionality for taking screenshot (YARA)

      • Synaptics.exe (PID: 4808)

    • There is functionality for communication dyndns network (YARA)

      • Synaptics.exe (PID: 4808)

    • There is functionality for communication over UDP network (YARA)

      • Synaptics.exe (PID: 4808)

  • INFO

    • The sample compiled with english language support

      • SetupError.exe (PID: 6868)

    • The sample compiled with turkish language support

      • SetupError.exe (PID: 6868)

    • Reads the computer name

      • SetupError.exe (PID: 6868)
      • Synaptics.exe (PID: 4808)
      • Synaptics.exe (PID: 5628)

    • Process checks computer location settings

      • SetupError.exe (PID: 6868)

    • Checks supported languages

      • SetupError.exe (PID: 6868)
      • ._cache_SetupError.exe (PID: 5900)
      • Synaptics.exe (PID: 4808)
      • Synaptics.exe (PID: 5628)

    • Creates files in the program directory

      • SetupError.exe (PID: 6868)
      • Synaptics.exe (PID: 4808)

    • Launching a file from a Registry key

      • SetupError.exe (PID: 6868)

    • Checks proxy server information

      • Synaptics.exe (PID: 4808)
      • slui.exe (PID: 6348)

    • Reads the software policy settings

      • slui.exe (PID: 6348)
      • Synaptics.exe (PID: 4808)

    • Compiled with Borland Delphi (YARA)

      • Synaptics.exe (PID: 4808)
      • slui.exe (PID: 6348)

    • Manual execution by a user

      • Synaptics.exe (PID: 5628)

    • Reads the machine GUID from the registry

      • Synaptics.exe (PID: 4808)

    • Create files in a temporary directory

      • Synaptics.exe (PID: 4808)

    • Creates files or folders in the user directory

      • Synaptics.exe (PID: 4808)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Borland Delphi 7 (90.7)
.exe | InstallShield setup (5.8)
.exe | Win32 Executable Delphi generic (1.9)
.exe | Win32 Executable (generic) (0.6)
.exe | Win16/32 Executable Delphi generic (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 629760
InitializedDataSize: 215552
UninitializedDataSize: -
EntryPoint: 0x9ab80
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.4
ProductVersionNumber: 1.0.0.4
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Turkish
CharacterSet: Windows, Turkish
CompanyName: Synaptics
FileDescription: Synaptics Pointing Device Driver
FileVersion: 1.0.0.4
InternalName: -
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: -
ProductName: Synaptics Pointing Device Driver
ProductVersion: 1.0.0.0
Comments: -
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
160
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XRED setuperror.exe ._cache_setuperror.exe no specs #XRED synaptics.exe svchost.exe #XRED synaptics.exe no specs slui.exe ucpdmgr.exe no specs conhost.exe no specs setuperror.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1052"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2612\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3756"C:\Users\admin\Desktop\SetupError.exe" C:\Users\admin\Desktop\SetupError.exe—explorer.exe
User:
admin
Company:
Synaptics
Integrity Level:
MEDIUM
Description:
Synaptics Pointing Device Driver
Exit code:
3221226540
Version:
1.0.0.4
Modules
Images
c:\users\admin\desktop\setuperror.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4808"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdateC:\ProgramData\Synaptics\Synaptics.exe
SetupError.exe
User:
admin
Company:
Synaptics
Integrity Level:
HIGH
Description:
Synaptics Pointing Device Driver
Version:
1.0.0.4
Modules
Images
c:\programdata\synaptics\synaptics.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
5628C:\ProgramData\Synaptics\Synaptics.exeC:\ProgramData\Synaptics\Synaptics.exe
explorer.exe
User:
admin
Company:
Synaptics
Integrity Level:
MEDIUM
Description:
Synaptics Pointing Device Driver
Exit code:
0
Version:
1.0.0.4
Modules
Images
c:\programdata\synaptics\synaptics.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
5900"C:\Users\admin\Desktop\._cache_SetupError.exe" C:\Users\admin\Desktop\._cache_SetupError.exe—SetupError.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Welcome to Windows
Exit code:
87
Version:
10.0.22621.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\desktop\._cache_setuperror.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6348C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6868"C:\Users\admin\Desktop\SetupError.exe" C:\Users\admin\Desktop\SetupError.exe
explorer.exe
User:
admin
Company:
Synaptics
Integrity Level:
HIGH
Description:
Synaptics Pointing Device Driver
Exit code:
0
Version:
1.0.0.4
Modules
Images
c:\users\admin\desktop\setuperror.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
2 889
Read events
2 884
Write events
5
Delete events
0

Modification events

(PID) Process:(6868) SetupError.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(6868) SetupError.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Synaptics Pointing Device Driver
Value:
C:\ProgramData\Synaptics\Synaptics.exe
(PID) Process:(4808) Synaptics.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4808) Synaptics.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4808) Synaptics.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
4
Suspicious files
8
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6868SetupError.exeC:\ProgramData\Synaptics\Synaptics.exeexecutable
MD5:D0825627ACAD7FA519EDFF44292F57DF
SHA256:7EABE8F6D8CA61B9D4FE2FCDBA7A6297FD5C1BE86E4E8CCC7BE4A6F9CB6DE6F9
4808Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:801186D57ABF3BB13E60A80D15B1F903
SHA256:7E49B614E78CD3976BFA21580DA74E76320B55A15E9373198CB2A03EACEFC0A9
4808Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F
4808Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C60C0C29522E01E6A22BD2717F20782E_927CD7694ABAB4DA64EA66E7743CA0D9binary
MD5:FA42B1E4CB9AE62025204B9945EC456B
SHA256:9280FE8AE77DBCE419AAB721B601D0F085AB01867E3FA019C521C47390EEC2DF
4808Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C60C0C29522E01E6A22BD2717F20782E_927CD7694ABAB4DA64EA66E7743CA0D9binary
MD5:4F14745AA76E1B430833AD6F5E99D50D
SHA256:8DEA0606AA61D7F671E989D4E6A47DCFECACA574D0C05C8FF36EA85076BF6355
4808Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9E62DD75009A293E0AF9565AE544F23E_62EF4F5924FC0DC7564A4F4F2942BB70binary
MD5:1C09BC68C9493C0098C6A9C5B857E94B
SHA256:326153FF4EEC8A12DF2CB690789214537D1B24C71D1E985D123C77923B6200FA
4808Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9E62DD75009A293E0AF9565AE544F23E_62EF4F5924FC0DC7564A4F4F2942BB70binary
MD5:333E361D44F0717820179CB639106A09
SHA256:D78FB8067E0A3027146C62FDBF0C778B1E21C02C2CD78F2944A6686D0AD6E290
4808Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:F8DBC49BBA218917604EB6F2694C5A27
SHA256:71187C7FC9C9B03734A31C47714422C48D8C40471193D574E2F02F51786CA218
4808Synaptics.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:4A90329071AE30B759D279CCA342B0A6
SHA256:4F544379EDA8E2653F71472AB968AEFD6B5D1F4B3CE28A5EDB14196184ED3B60
6868SetupError.exeC:\ProgramData\Synaptics\RCX7975.tmpexecutable
MD5:0ED002686FCBE73FA472EAAF7299FDB0
SHA256:2C2A05B055B90804B1DDC97CA74E82591C6C4109D4154C517FE82F764476E373
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
54
DNS requests
30
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3576
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4808
Synaptics.exe
GET
200
69.42.215.252:80
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.24.77.35:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4084
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4084
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4808
Synaptics.exe
GET
200
172.217.18.3:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
4808
Synaptics.exe
GET
200
172.217.18.3:80
http://o.pki.goog/we2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEQCebGtkb2cNegm%2FGwwoZmjS
unknown
—
—
whitelisted
4808
Synaptics.exe
GET
200
172.217.18.3:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
4808
Synaptics.exe
GET
200
172.217.18.3:80
http://o.pki.goog/we2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEQCLv9IIZH%2B2MBIS18%2FOut80
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4816
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3576
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3576
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2336
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2200
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
2200
svchost.exe
224.0.0.251:5353
—
—
—
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.78
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.68
  • 20.190.160.131
  • 20.190.160.2
  • 20.190.160.64
  • 40.126.32.74
  • 40.126.32.138
  • 40.126.32.140
  • 20.190.160.14
  • 20.190.160.20
  • 20.190.160.65
  • 20.190.160.132
  • 40.126.32.133
  • 20.190.160.66
  • 20.190.160.67
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
xred.mooo.com
  • —
whitelisted
freedns.afraid.org
  • 69.42.215.252
whitelisted
crl.microsoft.com
  • 184.24.77.35
  • 184.24.77.18
  • 184.24.77.28
  • 184.24.77.36
  • 184.24.77.39
  • 184.24.77.24
  • 184.24.77.37
  • 184.24.77.23
  • 184.24.77.34
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.14
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to Abused Domain *.mooo.com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SetupError.exe