home

xxclone.exe

XXCLONE: A Windows disk utility for self-bootable duplicates of the system volume.

Pixelab, Inc.

The executable xxclone.exe, “xxclone Application” has been detected as malware by 13 anti-virus scanners. This is the uninstaller utility registered in the Windows Control Panel for the program XXClone ver 2.08.0 by Pixelab.
Publisher:
Pixelab www.pixelab.com  (signed by Pixelab, Inc.)

Product:
XXCLONE: A Windows disk utility for self-bootable duplicates of the system volume.

Description:
xxclone Application

Version:
2.08.0

MD5:
7964c8c42d8821677655ae0a6ba70db3

SHA-1:
2a38738feb466a46a7c0ae89a3720b4c80a615c2

SHA-256:
6fca6317861a92a4a5a14bf610cabe5de98d9e508bf505090381c03d9183a69b

Scanner detections:
13 / 68

Status:
Malware

Analysis date:
5/10/2024 6:33:18 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Mabezat [Wrm]
160210-3

AVG
Win32/Mabezat
2015.0.4522

Dr.Web
Win32.HLLW.Tazebama
9.0.1.05190

Emsisoft Anti-Malware
Win32.Worm.Mabezat.Gen
10.0.0.5366

ESET NOD32
Win32/Mabezat.A virus
7.0.302.0

F-Prot
W32/Mabezat.A-2
4.6.5.141

F-Secure
Win32.Worm.Mabezat.Gen
5.15.21

Kaspersky
Worm.Win32.Mabezat
15.0.0.562

McAfee
Virus.W32/Mabezat.a
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.213.5860.0

Norman
Win32.Worm.Mabezat.Gen
03.02.2016 10:30:35

Sophos
Virus 'W32/Mabezat-B'
5.23

VIPRE Antivirus
Threat.303962
47068

File size:
2.8 MB (2,926,287 bytes)

Product version:
v.2.08.0

Copyright:
Copyright ©2003-2015 Pixelab All rights reserved.

Trademarks:
XXCLONE is a trademark of Pixelab.

Original file name:
xxclone.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Windows\System32\xxclone.exe

Digital Signature
Signed by:
Pixelab, Inc.

Authority:
The USERTRUST Network

Valid from:
2/17/2011 12:00:00 AM

Valid to:
2/17/2016 11:59:59 PM

Subject:
CN="Pixelab, Inc.", O="Pixelab, Inc.", STREET=1117 E. Gartner Road, L=Naperville, S=IL, PostalCode=60540, C=US

Issuer:
CN=UTN-USERFirst-Object, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, S=UT, C=US

Serial number:
0092A2603EF5348AA5824626E61B3C76FF

File PE Metadata
Compilation timestamp:
12/4/2015 6:45:42 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
49152:Lib8RmX28fArgc7QGPyL9PBQm7ez7VCEvC2VoO0rdLSpJ4no:ObMmXpugsQq8PBjswwero

Entry address:
0x37EF5

Entry point:
BB, 14, A8, EE, B9, 93, E9, 20, 01, 00, 00, 71, 17, 7A, 76, 22, A6, 7A, 76, 5A, 25, 24, FA, FA, 7A, FA, FA, 8B, FA, FA, FA, 59, 2B, 30, 2B, 2A, 2B, 33, 31, 30, FA, FA, FA, 6E, 5B, 74, 5F, 5C, 5B, 67, 5B, 28, 5E, 66, 66, FA, FA, FA, FA, 56, FA, FA, FA, 40, 6C, 5F, 5F, 46, 63, 5C, 6C, 5B, 6C, 73, FA, 3D, 6C, 5F, 5B, 6E, 5F, 3E, 63, 6C, 5F, 5D, 6E, 69, 6C, 73, 3B, FA, FA, FA, FA, 41, 5F, 6E, 51, 63, 68, 5E, 69, 71, 6D, 3E, 63, 6C, 5F, 5D, 6E, 69, 6C, 73, 3B, FA, FA, FA, FA, 41, 5F, 6E, 47, 69, 5E, 6F, 66, 5F...
 
[+]

Code size:
283.5 KB (290,304 bytes)

Program Uninstaller
Program name:
XXClone ver 2.08.0

Display publisher:
Pixelab

Display version:
2.08.0

Uninstall string:
C:\Windows\SYSTEM32\xxclone.exe /uninst


Remove xxclone.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.