jfiag3g_gg.exe C:\Users\test22\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\test22\AppData\Local\Temp\fj4ghga23_fsa.txt
3724jfiag3g_gg.exe C:\Users\test22\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\test22\AppData\Local\Temp\fj4ghga23_fsa.txt
8908RunWW.exe "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"
72325931879.exe "C:\Users\test22\AppData\Roaming\5931879.exe"
560rundll32.exe "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\test22\AppData\Local\Temp\install.dll",install
1892LabPicV3.tmp "C:\Users\test22\AppData\Local\Temp\is-HLUV2.tmp\LabPicV3.tmp" /SL5="$5603FE,506127,422400,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"
7664prolab.tmp "C:\Users\test22\AppData\Local\Temp\is-G0C0S.tmp\prolab.tmp" /SL5="$27036A,575243,216576,C:\Program Files\Microsoft Office\VPAXNZKLLZ\prolab.exe" /VERYSILENT
2720Nehaetaepiwae.exe "C:\Users\test22\AppData\Local\Temp\c9-6d08d-f12-2f1a2-8c3ee8b034afe\Nehaetaepiwae.exe"
5424Syruzhulyso.exe "C:\Users\test22\AppData\Local\Temp\89-c69b5-0b0-9d9b4-f8e2a18de3e26\Syruzhulyso.exe"
8836lylal220.tmp "C:\Users\test22\AppData\Local\Temp\is-OI7OR.tmp\lylal220.tmp" /SL5="$8602BC,237286,153600,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"
4368irecord.tmp "C:\Users\test22\AppData\Local\Temp\is-SF1FM.tmp\irecord.tmp" /SL5="$3601A8,6139911,56832,C:\Program Files\Internet Explorer\UYTTXGEVIT\irecord.exe" /VERYSILENT
5956i-record.exe "C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu
4808Soricurijae.exe "C:\Users\test22\AppData\Local\Temp\53-2a4df-783-e8e83-ece411c6b8600\Soricurijae.exe"
7836Naesurygoqa.exe "C:\Users\test22\AppData\Local\Temp\35-ee468-37b-64bb7-869fa1b301d69\Naesurygoqa.exe"
4436Versium.tmp "C:\Users\test22\AppData\Local\Temp\is-T3D23.tmp\Versium.tmp" /SL5="$790248,138429,56832,C:\Program Files (x86)\Data Finder\Versium Research\Versium.exe" /Verysilent
6744AddInProcess32.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
1912explorer.exe C:\Windows\Explorer.EXE
1848