Hi, in the support channel we often see the extension "Download Protect"
The install path, the file name is every time different.
For example: http://pastebin.com/raw.php?i=nb1KRrh8
here one of the extension | Download: https://www.msi.to/file/86323
Please can you check it for Malware?
Thanks Andy