home

ktmpfis2ovdn.exe

TPAutoConnect

OOO

The application ktmpfis2ovdn.exe, “ThinPrint AutoConnect component” by OOO has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It is also typically executed from the user's temporary directory.
Publisher:
Cortado AG  (signed by OOO )

Product:
TPAutoConnect

Description:
ThinPrint AutoConnect component

Version:
8,8,774,2

MD5:
4efc90493b5207d8e04abaac5fd452e7

SHA-1:
2d099132e832569eecc29e35b7c3fbd023c51bb6

SHA-256:
8dbd8d44d613f6da3ca79d269bdfdf39c8590af0beeababa617822412bf542a9

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/24/2024 1:04:52 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP (M)
17.3.4.1

File size:
865 KB (885,800 bytes)

Product version:
8,8,774,2

Copyright:
Copyright (c) 1999-2013 Cortado AG

Original file name:
TPAutoConnect.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\ktmpfis2ovdn.exe

Digital Signature
Signed by:
OOO

Authority:
COMODO CA Limited

Valid from:
6/22/2016 3:00:00 AM

Valid to:
6/23/2017 2:59:59 AM

Subject:
CN="OOO ""BAYKAL FORT AYTI""", O="OOO ""BAYKAL FORT AYTI""", STREET="Dzergynskogo, 25, of.511", L=Irkutsk, S=Irkutskaya, PostalCode=664011, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
3893027C66B26D657A5F538754DBCC25

File PE Metadata
Compilation timestamp:
7/10/2016 2:42:24 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

Entry address:
0x1290

Entry point:
55, 8B, EC, B8, 60, 8B, 00, 00, E8, B3, FF, FF, FF, 53, 56, 57, C6, 45, F4, 3E, 8B, 85, 70, 77, FF, FF, 2B, 85, 74, 77, FF, FF, 89, 85, 74, 77, FF, FF, 8B, 8D, 6C, 77, FF, FF, 0F, AF, 8D, 74, 77, FF, FF, 89, 8D, 6C, 77, FF, FF, FF, 15, F0, 30, 43, 00, 68, 84, 00, 44, 00, FF, 15, F4, 30, 43, 00, 8B, 95, 70, 77, FF, FF, 52, FF, 15, 48, 31, 43, 00, 8B, 85, 6C, 77, FF, FF, 50, FF, 15, 44, 31, 43, 00, FF, 15, F0, 30, 43, 00, 8B, 95, 74, 77, FF, FF, 8B, 8D, 74, 77, FF, FF, D3, E2, 89, 95, 70, 77, FF, FF, 68, 90...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
197 KB (201,728 bytes)

Remove ktmpfis2ovdn.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.