It was filling up my disk space in "C:\Windows\Temp\tmp00005ddc" at 30MB/s.
The files started deleting themselves after I disabled the protection shield, but I managed to copy some samples to somewhere else.
The files have same size and all have same description (Gridcoin-Qt (OSS GUI client for Gridcoin)) and same hash, but different file name.
(Yeah I was trying to set up a Gridcoin wallet)
This happens every single time I have protection shield on and trying to run Gridcoin wallet software.
This is a headache for me, because I can't white list Gridcoin wallet.
Sample