» uninstalltoolwizcare.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)
Downloads (1)

uninstalltoolwizcare.exe

ToolWiz Care

XII CNC Inc.

This is a setup program which is used to install the application. This is the uninstaller utility registered in the Windows Control Panel for the program Toolwiz Care by ToolWiz Care. This file is installed with the program Toolwiz Care. The file has been seen being downloaded from bcs.duapp.com.

File name:

Publisher:

ToolWiz (signed by XII CNC Inc.)

Product:

ToolWiz Care

Version:

3.1.0.2000

MD5:

10664652a7e26b9810ec6d2ff662a4d1

SHA-1:

f6280fe6f1f233010be3a7657d52cf6013192620

SHA-256:

9d20cc0c6241e16e5c49b2f90ea39fa7901f276d12dc76029dc50c3d42614f70

Scanner detections:

1 / 68

Status:

Clean (1 probable false positive detection)

Explanation:

This is mosty likely a false positive detection, the file is probably clean.

Analysis date:

12/26/2024 8:17:12 PM UTC (today)

Scan engine

Detection

Engine version

Rising Antivirus

PE:Trojan.Agent!6.670

23.00.65.14306

File size:

7.6 MB (7,953,664 bytes)

Product version:

2.0

Trademarks:

ToolWiz

Original file name:

Setup.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\toolwizcarefree\uninstalltoolwizcare.exe

Digital Signature

Signed by:

XII CNC Inc.

Authority:

VeriSign, Inc.

Valid from:

8/29/2012 1:00:00 AM

Valid to:

9/29/2013 12:59:59 AM

Subject:

CN=XII CNC Inc., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=XII CNC Inc., L=Anyang-si, S=Gyunggi-do, C=KR

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

5AE657C73341F9A5D7BDDD336C543E67

File PE Metadata

Compilation timestamp:

6/19/1992 11:22:17 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

196608:Wl65T+LUHCrqLVkVQKIYdpLDtM714uJLFb3MGkjDCayR55fCBS:8wTR0qxkV51OiuRp3M1PyBCI

Entry address:

0x102F001

Entry point:

60, E9, 3D, 04, 00, 00, 2B, 6C, FC, 20, C3, A3, F8, 9B, F3, 71, BC, 20, C0, 95, D3, BD, 13, 77, BC, 20, 40, F5, 04, 69, 87, 48, F8, A9, 5E, B4, B1, 64, C3, 47, 7D, 46, C0, 48, F8, E7, 46, 7B, C1, 64, C3, 48, F8, 20, C3, C5, 7D, 24, 89, 0C, F8, 70, 3C, DD, F8, 6B, 87, 48, 71, A5, C3, 02, BC, 20, 48, B0, 75, BD, D2, 02, BC, 20, 90, 18, 07, B5, 3F, 02, BC, 20, 4A, CD, 04, 1F, 87, 48, 75, BD, DD, 02, BC, 20, 90, 1F, 07, B5, 3F, 02, BC, 20, 4A, CD, F8, 60, 87, 48, 75, A5, 76, 71, BC, 20, 3C, A8, C8, 47, D6, 48... 
[+]

Entropy:

7.9950

Packer / compiler:

ASPack v2.11

Code size:

1.3 MB (1,399,808 bytes)

Program Uninstaller

Program name:

Toolwiz Care

Display publisher:

ToolWiz Care

Display version:

3.1.0.2000

Uninstall string:

"C:\Program Files\ToolwizCareFree\UninstallToolwizCare.exe" /REMOVE

The file uninstalltoolwizcare.exe has been discovered within the following program.

Toolwiz Care by ToolWiz

Publisher's description - “ToolWiz Care is a set of free-of-charge tools designed to speed up your PC and give your system a full range of care.”

www.Toolwiz.com

4% remove it

The file uninstalltoolwizcare.exe has been seen being distributed by the following URL.

http://bcs.duapp.com/btowssoft/.../Setup_ToolwizCare3.1.0.2000.exe

Scan uninstalltoolwizcare.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.