Is Esif_assist_64.exe legit intel file or malware?


	 

	I did run a scan with few of antivirus/antimalware programs that I use, none found anything except for Roguekiller. Each time I run roguekiller in normal mode, it finds esif_assist_64.exe in C:/Windows/Temp/DPTF/ folder. Folder cannot be deleted.

	DPTF folder along with that file and 2 others was not there after fresh reinstall, but it appeared after windows updates.

		

		Detection in Roguekiller is labeled as Suspicious.Path, and type is Process.

		

		Each time I click on delete it does not get deleted, instead it gets "killed".

		

		File shows up every time I boot computer and shows time of creation time I booted the computer.

		

		Description of the file is: Intel (R) Dynamic Platform and Thermal Framework Utility Application.

		

		File does not show up in the folder when I boot computer in safe mode, and neither does it get detected by roguekiller. It gets detected by it only when I run it in normal mode.

		

		I ran it through virustotal and it came in clean, however I checked the details and it shows all certificates as legit except the first one:

	Intel (R) Software - Certificate Intel external basic issuing CA 3B. It is expired certificate that expired on 7/15/2016.

	 

	Also, it specified it as a Portable execution file.

	

		I have questions:

	1. Is it legit?

	2. Is it possible that file with Intel Dynamic Platform and Thermal Framework was installed along with windows updates? That is only explanation that I have, but I would need a verification that this file is part of normal windows updates. That is when it actually showed up. Could it be malware or something perhaps?

	 

	Thanks.