home

pro evolution soccer 2013.exe

TPAutoConnect

OOO

The application pro evolution soccer 2013.exe, “ThinPrint AutoConnect component” by OOO has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The file has been seen being downloaded from proppressure.ru.
Publisher:
Cortado AG  (signed by OOO )

Product:
TPAutoConnect

Description:
ThinPrint AutoConnect component

Version:
8,8,774,2

MD5:
c97342aa7878a4f3967a5d17be4bdd5a

SHA-1:
f9cb2c01c51ed23c024c2d4aa0b462cbca971991

SHA-256:
59c2f582c3018127dcefd6a8f056d4dbe695c03b42a05beea6e0dd6a0d652142

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/24/2024 12:45:27 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP (M)
17.3.11.15

File size:
865 KB (885,800 bytes)

Product version:
8,8,774,2

Copyright:
Copyright (c) 1999-2013 Cortado AG

Original file name:
TPAutoConnect.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\pro evolution soccer 2013.exe

Digital Signature
Signed by:
OOO

Authority:
COMODO CA Limited

Valid from:
6/22/2016 5:00:00 AM

Valid to:
6/23/2017 4:59:59 AM

Subject:
CN="OOO ""BAYKAL FORT AYTI""", O="OOO ""BAYKAL FORT AYTI""", STREET="Dzergynskogo, 25, of.511", L=Irkutsk, S=Irkutskaya, PostalCode=664011, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
3893027C66B26D657A5F538754DBCC25

File PE Metadata
Compilation timestamp:
7/10/2016 4:42:24 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

Entry address:
0x1290

Entry point:
55, 8B, EC, B8, 60, 8B, 00, 00, E8, B3, FF, FF, FF, 53, 56, 57, C6, 45, F4, 3E, 8B, 85, 70, 77, FF, FF, 2B, 85, 74, 77, FF, FF, 89, 85, 74, 77, FF, FF, 8B, 8D, 6C, 77, FF, FF, 0F, AF, 8D, 74, 77, FF, FF, 89, 8D, 6C, 77, FF, FF, FF, 15, F0, 30, 43, 00, 68, 84, 00, 44, 00, FF, 15, F4, 30, 43, 00, 8B, 95, 70, 77, FF, FF, 52, FF, 15, 48, 31, 43, 00, 8B, 85, 6C, 77, FF, FF, 50, FF, 15, 44, 31, 43, 00, FF, 15, F0, 30, 43, 00, 8B, 95, 74, 77, FF, FF, 8B, 8D, 74, 77, FF, FF, D3, E2, 89, 95, 70, 77, FF, FF, 68, 90...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
197 KB (201,728 bytes)

The file pro evolution soccer 2013.exe has been seen being distributed by the following URL.

http://proppressure.ru/.../4?file=7930&mirror=6076&from=http

Remove pro evolution soccer 2013.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.