So where was it running from?

User it's running under?

It's not changing it's name I guess from your description but possibly generated that random name itself when it installed to prevent identification. That's certainly not rare or new...