LocalTemperature.exe

Local Temperature

Core Systems

Part of an adware web browser extension that delivers advertisements such as coupons, price-comparisons, display media, affiliate links, banners, popups/popunders and other links. The application LocalTemperature.exe by Core Systems has been detected as adware by 11 anti-malware scanners. It runs as a scheduled task under the Windows Task Scheduler named McAfeeLogon triggered to execute each time a user logs in. This file is typically installed with the program Local Temperature by Core Systems which is a potentially unwanted software program.
Publisher:
Local Temperature, LLC  (signed by Core Systems)

Product:
Local Temperature

Version:
1.0.0.1

MD5:
41217717b45c30b8ceafe88feeac9f55

SHA-1:
528b39e62a80d03dd4dedf2d8bc949463ca3b6d9

SHA-256:
5f44528c2755a9968cb196dc0a9ebbacf38df1621f1ceb85ade98c337aebd0e7

Scanner detections:
11 / 68

Status:
Adware

Analysis date:
11/5/2024 4:34:17 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.Agent.PMA
453

Avira AntiVirus
TR/Trash.Gen
7.11.30.172

Bitdefender
Adware.Agent.PMA
1.0.20.1560

Emsisoft Anti-Malware
Adware.Agent.PMA
8.15.11.08.06

F-Secure
Adware.Agent.PMA
11.2015-08-11_1

G Data
Adware.Agent.PMA
15.11.25

Malwarebytes
PUP.Optional.LocalTemperature.C
v2015.11.08.06

MicroWorld eScan
Adware.Agent.PMA
16.0.0.936

Reason Heuristics
PUP.Weather.CoreSystems (M)
15.11.8.18

Trend Micro House Call
Suspicious_GEN.F47V0402
7.2.312

VIPRE Antivirus
Bonzuna
42742

File size:
121 KB (123,944 bytes)

Product version:
1.0.0.1

Copyright:
Copyright © 2015

Trademarks:
Local Temperature, LLC

Original file name:
LocalTemperature.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Program Files\localtemperature\localtemperature.exe

Digital Signature
Signed by:

Authority:
GoDaddy.com, Inc.

Valid from:
6/17/2014 4:26:02 PM

Valid to:
6/17/2015 4:26:02 PM

Subject:
CN=Core Systems, O=Core Systems, L=Austin, S=Texas, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
4B1F1B2C0AF57F

File PE Metadata
Compilation timestamp:
4/21/2015 3:31:55 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
1536:cDIcKPc04LyymW4LyymhClvLCG4x4Lyymyw:2WGLyy6LyywsR42Lyyq

Entry address:
0x1687E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
5.6309

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
82.5 KB (84,480 bytes)

Scheduled Task
Task name:
McAfeeLogon

Trigger:
Logon (Runs on logon)


The file LocalTemperature.exe has been discovered within the following program.

Local Temperature  by Core Systems
Install advertising in the browser. From the EULA/Terms: "The free version of the Software is supported by advertising. Accordingly, the Site and the free version of the Software may provide third party content, advertising and services, and links thereto (e.g.
localtemperature.net
68% remove it
 
Powered by Should I Remove It?

Remove LocalTemperature.exe - Powered by Reason Core Security