I have to look a bit further at the link you provided. Filemon also shows that there is a process starVW.exe.local

What does that mean? Does it make a temporary unencryted exe?