I was looking to disable some startup programs and found these:
http://i.imgur.com/xrze4i3.png
https://www.virustotal.com/en/file/eb338411bd35ebfe65d0847f2c9255325b9df0112598e11a8d5e4708d59d3316/analysis/1394346191/
Publisher: Yn1XCngpjqm2Ls
Product: 7p§7Iphskto$Sv
Original name: 123.exe
Internal name: 123.exe
File version: 4.1.5.?0
Description: Yn1XCngpjqm2Ls
MD5: 11847a0fe49ee5457bd67f97acd4e616
SHA1: 71a9814a93369a15a0dd7a54f01465e4a7485b30
SHA256: eb338411bd35ebfe65d0847f2c9255325b9df0112598e11a8d5e4708d59d3316
ssdeep:12288:nOcS7bIsfBNWbUr4uz6P3oduhoCNFKhE35w0czBxguAzcEA3myugFGEUMon0D:nfsfBnj6gcoCNpJeKuAzLA2lgFGfMo
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
Installation Directory:
search-ms:displayname=Search%20Results%20in%20Temp&crumb=fileextension%3A~<.exe%20OR%20System.Generic.String%3A.exe&crumb=location:C%3A%5CUsers%5CKai%5CAppData%5CLocal%5CTemp
http://i.imgur.com/xrze4i3.png
https://www.virustotal.com/en/file/eb338411bd35ebfe65d0847f2c9255325b9df0112598e11a8d5e4708d59d3316/analysis/1394346191/
Publisher: Yn1XCngpjqm2Ls
Product: 7p§7Iphskto$Sv
Original name: 123.exe
Internal name: 123.exe
File version: 4.1.5.?0
Description: Yn1XCngpjqm2Ls
MD5: 11847a0fe49ee5457bd67f97acd4e616
SHA1: 71a9814a93369a15a0dd7a54f01465e4a7485b30
SHA256: eb338411bd35ebfe65d0847f2c9255325b9df0112598e11a8d5e4708d59d3316
ssdeep:12288:nOcS7bIsfBNWbUr4uz6P3oduhoCNFKhE35w0czBxguAzcEA3myugFGEUMon0D:nfsfBnj6gcoCNpJeKuAzLA2lgFGfMo
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
Installation Directory:
search-ms:displayname=Search%20Results%20in%20Temp&crumb=fileextension%3A~<.exe%20OR%20System.Generic.String%3A.exe&crumb=location:C%3A%5CUsers%5CKai%5CAppData%5CLocal%5CTemp
Facebook
Twitter
Instagram