OK, thanks for the quick reply.
Since the program's website provides a number of mirrors, I grabbed them all and ran them through VirusTotal, to see if it was just one compromised mirror. Turns out that the installer I originally sent to you was the version from the website itself (!), but the files from the mirrors were only flagged by 2/67 engines on VirusTotal (and weren't flagged by my local Malwarebytes copy), so I don't know if those are false positives or if they just contain a new variant of InstallCore/Fusioncore. I'll attach one of the mirrored files, so you can run your own ana