MalwareTips
File verdict·Decided by the MT AI Engine
Our call

Safe

Legitimate Core Temp installer signed by ALCPU with only a single low-trust grayware flag and clean sandbox behaviour.

Verified · ALCPU
Trust score85High trust
MT AI confidence · 85%
Core-Temp-setup-v1.20.1.150.exe
1.6 MB
26e9a2b20608f00f43…078d9b5606
Antivirus engines
1 of 75 flagged
Code signing
Signed by ALCPU
Age
First seen 1mo ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

85%Confidence
Very high
Reasoning

The single malicious detection comes from a low-trust engine with a generic grayware label and no tier-1 support. The file is properly signed by ALCPU, shows typical Inno-Setup installer behaviour (process injection, persistence, direct-IP contact during install), and has no malicious dropped children or sandbox verdicts. Prevalence is high (common_new) with explicit researcher confirmation of no threat. These factors outweigh the heuristic triggers.

Key signals · 5

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. engines.onlyLowTrustFlagging=true and tier1Malicious=0 (CrowdStrike grayware only)

  2. signing.verified=true signer=ALCPU

  3. prevalence.classification=common_new (1507 submitters)

  4. communityComments: FileScan.IO NO_THREAT 100/100 installer tags

  5. behaviour.hasMaliciousSandboxVerdict=false and droppedChildren.hasMaliciousChild=false

Points in its favour
  • Verified signature by ALCPU
  • High prevalence common_new
  • Zero tier-1 malicious detections
  • Clean sandbox and dropped children
What to do

Treat as safe; install only from the official ALCPU/Core Temp website.

Sources disagree

1 contradiction resolved by the scoring engine

Only low-trust / heuristic engines flagged this file
1 engine from the heuristic / generic-AI set flagged it. No tier-1 engine agreed.
Verdict treated these as likely false positives.
Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
21

Adversary techniques mapped to the MITRE ATT&CK framework.

T1012T1027T1027.002T1033T1036T1055T1059T1070T1071T1082T1083T1129T1134T1485T1497T1497.001T1529T1539T1548T1614T1614.001
Spawned processes
15
$(unnamed)
"C:\Users\<USER>\Desktop\program.exe"
$(unnamed)
"C:\Users\<USER>\AppData\Local\Temp\is-MTBFD.tmp\program.tmp" /SL5="$40072,1264044,121344,C:\Users\<USER>\Desktop\program.exe"
$(unnamed)
C:\Windows\Explorer.EXE
$(unnamed)
"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\Core Temp\Readme.txt
$(unnamed)
"C:\Program Files\Core Temp\Core Temp.exe"
$(unnamed)
C:\Windows\system32\services.exe
$(unnamed)
C:\Windows\System32\svchost.exe -k NetworkService -p
$(unnamed)
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
+7 more processes captured.
Network activity
3
IP addresses2
  • 192.185.41.230
  • 162.159.36.2
URLs1
  • http://www.alcpu.com/CoreTemp/coretempver.xml
Persistence
1
Indicators1
  • ALSysIO
Filesystem & mutexes
40
Files written15
  • C:\Users\<USER>\AppData\Local\Temp\is-MTBFD.tmp\program.tmp
  • C:\Users\<USER>\AppData\Local\Temp\is-B3DT5.tmp\_isetup\_setup64.tmp
  • C:\Program Files\Core Temp\Core Temp.exe
  • C:\Program Files\Core Temp\unins000.dat
  • C:\Program Files\Core Temp\is-4OLTM.tmp
+10 more
Files deleted15
  • C:\Program Files\Core Temp\is-4OLTM.tmp
  • C:\Program Files\Core Temp\is-ND3OM.tmp
  • C:\Program Files\Core Temp\is-I6DOS.tmp
  • C:\Program Files\Core Temp\is-U5VO0.tmp
  • C:\Program Files\Core Temp\is-QF1AU.tmp
+10 more
Mutexes created10
  • cversions.3.m
  • DebugHelper
  • Global\Access_PCI
  • Global\Access_APIC_Clk_Measure
  • Global\Access_Intel_OC_Mailbox
+5 more
Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen
  • 9557fc1335568b246176…7db8a7Never scanned
    never seen before
  • 0b15b30d1cee7aa1196b…9bc244Never scanned
    never seen before
  • c2915702e142fa0da987…acf7ffNever scanned
    never seen before
  • b4b2afd4eb3c7c7de0a2…5342fcNever scanned
    never seen before
  • 673296a2ccf2322dc0be…b76493Never scanned
    never seen before
  • 86cf59301dbc6f1eca8c…d1d51aNever scanned
    never seen before
  • 88c7ffcca9585da2984a…13f500Never scanned
    never seen before
  • c142c01eefa9d341543e…a956d0Never scanned
    never seen before
  • f03c7d416242a4eee9e9…cb57f5Never scanned
    never seen before
  • cd6c153ba40f50a290d1…97c07dNever scanned
    never seen before
No researcher-database hits
External threat-intel sources were not collected for this scan.
Signature matches

YARA + heuristic rules that fired

A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.

4 synthesis
MITRE ATT&CK profile
Persistence× 1Defense evasion× 1Cred access× 1C2× 1
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • PersistenceScheduledTask
    T1053.005T1543.003
    medium

    Sandbox flagged persistence indicators (registry Run keys / services / scheduled tasks).

    Evidence
    ALSysIO
  • ProcessInjection
    T1055
    high

    MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.

    Evidence
    C:\Windows\Explorer.EXE
  • CredentialDumper
    T1003T1003.001
    medium

    Sandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.

    Evidence
    C:\Windows\system32\lsass.exe
  • DirectIpC2
    T1071
    medium

    Sample contacted 2 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.

    Evidence
    192.185.41.230 · 162.159.36.2
Antivirus engine breakdown

1 detection across 75 engines

1 malicious0 suspicious74 clean
Tier-117 engines
0flag
Top commercial AVs (low FP rate)
Tier-238 engines
0flag
Mainstream engines with mixed FP rates
Low-trust20 engines
1flag
Heuristic / generic-AI engines (high FP rate)
CrowdStrike
malicious
win/grayware_confidence_70% (W)
Hash 26e9a2b20608… cross-referenced against 75 AV engines via our AV network.
PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

ent 8.00Unpacked
Section entropy8 sections
.text
6.38
.itext
5.78
.data
2.30
.bss
0.00
.idata
4.60
.tls
0.00
.rdata
0.20
.rsrc
4.14
0.0Packed threshold 7.28.0
Prevalence

How often this file shows up in the wild

Lots of people are uploading this but it's recent — typical of newly-released legitimate software. Low prior for malware.

Common & new
Unique uploaders
1,507
Hundreds of people have uploaded this — common.
Total submissions
1,701
Includes repeat uploads by the same source.
First seen by VT
1mo ago
May 2, 2026
Prevalence quadrant
Rare · New
Targeted malware lives here
here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
5/2/2026, 7:03:53 AM
First seen (MalwareBazaar)
—
Last analysis (VT)
5/26/2026, 4:53:46 AM
Scanned here
5/26/2026, 8:44:40 AM
File name
Core-Temp-setup-v1.20.1.150.exe
Size
1.61 MB
MIME type
(unknown)
Detected type
Win32 EXE
SHA-256
26e9a2b20608f00f43a44d0f7fa57e70a832087c3d4a9aa1d8dc73078d9b5606
MD5
7edd792d56093efe9b7ad08fe3dcaf13
SHA-1
6159262aceeb14716e9027e99a2a3b12eb95d7e8
PE imphash
20dd26497880c05caed9305b3c8b9109
First seen (VT)
5/2/2026, 7:03:53 AM
Last analysis (VT)
5/26/2026, 4:53:46 AM
First scan (MalwareTips)
5/26/2026, 8:44:40 AM
Last scan (MalwareTips)
5/26/2026, 8:44:40 AM
Code signer
ALCPUverified
Community reputation
+4trusted
Behavior tags
overlaysignedpeexe
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scanned by
harlan4096Staff
Scan another
Check a different file
URL instead?
Check if a link is safe
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.