| ZeroBOX

Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

| ZeroBOX

BaldiTrojan-x64.exe "C:\Users\test22\AppData\Local\Temp\BaldiTrojan-x64.exe"
1932
- cmd.exe cmd /c CleanZUpdater.bat
  2196
  - Baldi.exe C:\Baldi\Baldi.exe
    2260
    - taskkill.exe "C:\Windows\System32\taskkill.exe" /f /im explorer.exe
      2344
  - DisableUAC.exe C:\Baldi\DisableUAC.exe
    2476
    - cmd.exe "C:\Windows\system32\cmd" /c "C:\Users\test22\AppData\Local\Temp\D22F.tmp\D240.bat C:\Baldi\DisableUAC.exe"
      2564
      - reg.exe reg ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
        2608
      - shutdown.exe shutdown -r -t 1 -c "BALDI EVIL..."
        2656

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf