home

uninstaller.exe

The application uninstaller.exe has been detected as a potentially unwanted program by 8 anti-malware scanners. This is the uninstaller utility registered in the Windows Control Panel for the program CCleaner Packages. Additionally, the file is typically installed by a number of programs including Video Player Packages by installCore and ImgBurn Free Download Packages by installCore, both potentially unwanted software. It uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
MD5:
8c7fb9078a63b7e5e899e7a2dbb0db53

SHA-1:
9f82bb5dc8d4ec6b8b2bb47cb6c329b8af1c14ce

SHA-256:
248482662fe9874fd0b8a20802861a7a531c1a63cc8b5660e1e2f29de8f1ba70

Scanner detections:
8 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
4/23/2024 9:32:57 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
ADWARE/InstallCore.Gen
7.11.122.108

Dr.Web
Adware.InstallCore.90
9.0.1.05190

ESET NOD32
Win32/InstallCore.AZ potentially unwanted application
6.3.12010.0

F-Prot
W32/InstallCore.W.gen
4.6.5.141

Reason Heuristics
Unnamed.Threat.14
14.3.1.0

Rising Antivirus
PE:Malware.XPACK-LNR/Heur!1.5594
23.00.65.131209

Vba32 AntiVirus
BScope.P2P-Worm.Palevo
3.12.24.3

VIPRE Antivirus
Threat.4150696
47432

File size:
1.1 MB (1,114,624 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\uninstaller.exe

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:D6uSzswzh83eptRBBpLUlm5zckVdzfwKcp+fTSUCymNu6sBCYQhkjHvX8IxtjGIw:OW3eptHWezDdrc0TZCymNfYZPX8Itrk

Entry address:
0xD8830

Entry point:
55, 8B, EC, 83, C4, F0, B8, 34, 8A, 40, 00, E8, 55, F5, FF, FF, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.5946

Developed / compiled with:
Microsoft Visual C++

Code size:
877.5 KB (898,560 bytes)

Program Uninstaller
Program name:
CCleaner Packages

Uninstall string:
C:\users\{user}\appdata\roaming\0s1f1o2z0s2y1h1t\ccleaner packages\uninstaller.exe \uninstall \nm="ccleaner packages" \an="0s1f1o2z0s2y1h1t" \mbn="ccleaner packages"


The file uninstaller.exe has been discovered within the following programs.

Adobe AIR Free Download Packages  by installCore
Adobe AIR Free Download Packages uses the Install Core Click run software which is an installer which bundles legitimate applications with offers for additional third party applications that may be unwanted by the user.
www.installcore.com
84% remove it
Codec Pack Packages  by installCore
Codec Pack Packages uses the InstallCore Click run software which is an installer that bundles legitimate applications that may also offer additional third party applications that may be unwanted by the user.
80% remove it
Firefox Free Download Packages  by installCore
The software uses the InstallCore Click run software which is an installer that bundles legitimate applications that may also offer additional third party applications that may be unwanted by the user.
86% remove it
Image Editor Packages  by installCore
Image Editor Packages uses the InstallCore Click run software which is an installer that bundles legitimate applications that may also offer additional third party applications that may be unwanted by the user.
88% remove it
ImgBurn Free Download Packages  by installCore
ImgBurn Free Download Packages uses the InstallCore Click run software which is an installer that bundles legitimate applications that may also offer additional third party applications that may be unwanted by the user.
69% remove it
Media Player Packages  by installCore
Media Player Packages uses the InstallCore Click run software which is an installer that bundles legitimate applications that may also offer additional third party applications that may be unwanted by the user.
69% remove it
Mozilla Firefox Free Download Packages  by installCore
Mozilla Firefox Free Download Packages uses the InstallCore Click run software which is an installer that bundles legitimate applications that may also offer additional third party applications that may be unwanted by the user.
74% remove it
Mozilla Firefox Packages  by installCore
Mozilla Firefox Packages uses the InstallCore Click run software which is an installer that bundles legitimate applications that may also offer additional third party applications that may be unwanted by the user.
75% remove it
PDF Creator Packages  by installCore
PDF Creator Packages uses the InstallCore Click run software which is an installer that bundles legitimate applications that may also offer additional third party applications that may be unwanted by the user.
81% remove it
PDF Writer Packages  by installCore
PDF Writer Packages uses the InstallCore Click run software which is an installer that bundles legitimate applications that may also offer additional third party applications that may be unwanted by the user.
88% remove it
 
Latest 20 of 13 programs
Powered by Should I Remove It?

Remove uninstaller.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.