@Gemini as per the request in #91 as FreshDA9 hasn't responded, doesn't look like the readme has any link back to the forum
Removed Malware contains the below:
REMOVED MALICIOUS FILES — SHA-256
================================
The following files were present in the supplied larger collection and are NOT
included in this package. All four used the same suspicious VB6 loader family
and were detected locally as Win.Malware.Swisyn-7610494-0.
Titanium.exe (tree 1)
5f5e29c12b4d0d6e11fd08a907c720d5184bb807eda864bddc68d20938da84f3
Titanium.exe (tree 2)
3fa694bec38eda78d3437b956c5eaaa6045cc3567c5ef0955388aee78240b529
uninstall.exe (tree 1)
afc1c438669ab89a868258b48b4f6f5dc373f21db8492a8ba3934a0da72d4d3b
uninstall.exe (tree 2)
9c0f730ea9e65f554f02f8b8e204a6b2fc7541ea044a5d7d48a9815e6a7899b3
The supplied installer and all uninstall data were also excluded because a
portable runtime does not need them.
Readme contains:
ECM TITANIUM 1.61 COMPLETE PORTABLE
===================================
PACKAGE STATUS / IMPORTANT
--------------------------
This package was rebuilt from two supplied collections. It uses the researched
Alientech ECM Titanium 1.61.0.0 runtime instead of the infected VB6 wrappers
found in the larger collection. The infected launchers, uninstallers, installer,
Internet shortcut, duplicate program tree and duplicate "- Copia" driver files
were excluded. The ZIP has no password.
The working database contains 43,021 driver records and 21 indexed ORI files.
All 21 indexed ORI files were checked against the MD5 values stored in the
database. The 18,454 installed DRT files contain 10,302 unique file contents;
the extra 548 DRT names in the supplied "Full" tree were only duplicate copies
and added no unique driver content.
"ECU Sample Library" is a separate reference collection of 12,958 original,
modified and unidentified ECU files. It is not part of the Titanium runtime.
Never flash a sample merely because its folder name resembles a vehicle: first
verify ECU hardware/software numbers, file size, checksums and every change.
"Optional/Recovered ORI from 43000 set" contains three older ORI files whose
numeric names conflicted with the 21 indexed ORI files. They are deliberately
kept outside DataBase and are not loaded automatically. DRT.rar is the supplied
backup of alternate older driver revisions and is not required for startup.
SECURITY LIMITS
---------------
Titanium.exe is unsigned and protected with Themida/WinLicense. This can cause
heuristic antivirus warnings and prevents complete static inspection. No
absolute safety guarantee is possible. Test in an isolated Windows VM first,
scan the extracted folder with an up-to-date antivirus, and verify the hashes
below. Do not disable security software merely to run it.
Post-rebuild scan: ClamAV 1.5.3 scanned 31,862 files with 3,627,998 known
signatures on 2026-08-08 and reported 0 infected files.
SHA-256 (runtime)
-----------------
Titanium.exe 8439b114d95a910ca7c7108c0e51cb420190136f37165be45f411a2c29ef75aa
EcmAlgoDLL.dll 41753660b31d184b00a4322da40d1afa917f6c0a0b175b0b2d112bd370f53a24
lua5.1.dll 94deef0a6a60213b3020334aede2eb5c7aa39286833a6699f8fd439c7cce63cf
EN
--
1. Extract the complete folder to a writable local directory. Do not start the
program from inside the ZIP and do not place it under Program Files.
2. Keep Titanium.exe, the DLL files, DataBase, Resource, PlugIn and CheckFam in
their existing relative locations.
3. Start Titanium.exe. No installer, password or Internet connection is needed.
4. If Windows marks a downloaded file as blocked, check Properties > Unblock
only after verifying the SHA-256 above. Administrator rights are normally
unnecessary when the folder is writable.
5. Work only on a copy of an ECU file. Verify identification, checksums and all
modifications before writing anything to a vehicle.
DE
--
1. Den kompletten Ordner in ein beschreibbares lokales Verzeichnis entpacken.
Nicht direkt aus dem ZIP und nicht unter "Program Files" starten.
2. Titanium.exe, DLLs, DataBase, Resource, PlugIn und CheckFam in ihrer
vorhandenen Ordnerstruktur belassen.
3. Titanium.exe starten. Installer, Passwort und Internet sind nicht noetig.
4. Eine Windows-Dateisperre erst nach Pruefung des obigen SHA-256-Werts ueber
Eigenschaften > Zulassen aufheben. Normalerweise sind keine Adminrechte
erforderlich, wenn der Ordner beschreibbar ist.
5. Nur mit einer Kopie der ECU-Datei arbeiten. Identifikation, Pruefsummen und
alle Aenderungen vor dem Schreiben ins Fahrzeug kontrollieren.
ES
--
1. Extraiga la carpeta completa en un directorio local con permiso de escritura.
No ejecute el programa desde el ZIP ni desde "Program Files".
2. Mantenga Titanium.exe, las DLL, DataBase, Resource, PlugIn y CheckFam en su
estructura original.
3. Ejecute Titanium.exe. No requiere instalador, contrasena ni Internet.
4. Si Windows bloquea el archivo descargado, use Propiedades > Desbloquear solo
despues de verificar el SHA-256 indicado arriba. Normalmente no se requieren
privilegios de administrador si la carpeta permite escritura.
5. Trabaje solo con una copia del archivo ECU. Verifique identificacion, sumas
de control y todos los cambios antes de escribir en el vehiculo.
FR
--
1. Extrayez le dossier complet dans un repertoire local accessible en ecriture.
Ne lancez rien depuis le ZIP ni depuis "Program Files".
2. Conservez Titanium.exe, les DLL, DataBase, Resource, PlugIn et CheckFam dans
leur arborescence actuelle.
3. Lancez Titanium.exe. Aucun installateur, mot de passe ou acces Internet
n'est necessaire.
4. Si Windows bloque le fichier telecharge, utilisez Proprietes > Debloquer
uniquement apres verification du SHA-256 ci-dessus. Les droits administrateur
sont normalement inutiles si le dossier est accessible en ecriture.
5. Travaillez uniquement sur une copie du fichier ECU. Verifiez identification,
sommes de controle et modifications avant toute ecriture dans le vehicule.
PL
--
1. Rozpakuj caly folder do lokalnego katalogu z prawem zapisu. Nie uruchamiaj
programu z ZIP ani z katalogu "Program Files".
2. Zachowaj Titanium.exe, DLL, DataBase, Resource, PlugIn i CheckFam w obecnej
strukturze katalogow.
3. Uruchom Titanium.exe. Instalator, haslo i Internet nie sa potrzebne.
4. Jesli Windows blokuje pobrany plik, uzyj Wlasciwosci > Odblokuj dopiero po
sprawdzeniu SHA-256 podanego wyzej. Uprawnienia administratora zwykle nie sa
potrzebne, gdy katalog jest zapisywalny.
5. Pracuj tylko na kopii pliku ECU. Przed zapisem do pojazdu sprawdz identyfikacje,
sumy kontrolne i wszystkie modyfikacje.
RU
--
1. Полностью распакуйте папку в локальный каталог с правом записи. Не запускайте
программу из ZIP и не помещайте её в Program Files.
2. Не разделяйте Titanium.exe, DLL и папки DataBase, Resource, PlugIn, CheckFam.
3. Запустите Titanium.exe. Установщик, пароль и Интернет не требуются.
4. Если Windows заблокировала загруженный файл, снимайте блокировку в свойствах
только после проверки SHA-256 выше. При доступной для записи папке права
администратора обычно не нужны.
5. Работайте только с копией файла ECU. До записи в автомобиль проверьте
идентификаторы, контрольные суммы и каждое изменение.
View full details and download — ECM Titanium (over 43,000 drivers) - Complete driver-based remapping software
