Windows stores file names in Unicode on disk, therefore it allows Unicode characters in file names. Unicode allows for what's called a "Right to Left Override" (RTLO), and vice versa, by putting a special set of Unicode characters in the string. In this case, the * is representing those Unicode characters because Windows explorer doesn't display Unicode. The file name on disk is photo_W71765413082011_Coll[RTLO]gpj.exe (where the RTLO code is actually 0x202E in hex) which would cause it to display as photo_W71765413082011_Collexe.jpg in Windows Explorer. If the malware author is good, they will also associate the shell extension JPG icon with it so it will even look like a non-thumbnailed jpeg in Explorer rather than the default icon Windows puts with exe's that it doesn't have a shell icon for.