| ZeroBOX

clr.exe "C:\Users\test22\AppData\Local\Temp\clr.exe"
1836
- cmd.exe cmd /c ""C:\Windows\clrinst.bat" "
  108
  - taskkill.exe taskkill /f /im miter.exe
    2140
  - instsrv.exe instsrv.exe alark C:\Windows\alark.exe
    2240
  - PING.EXE ping 127.0.0.1 -n 2
    2304
  - reg.exe Reg Add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "Description" /t REG_SZ /d "Alarm service for default browser." /f
    2368
  - reg.exe Reg Add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "DisplayName" /t REG_SZ /d "Alarm Key Service" /f
    2412
  - reg.exe Reg Add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "ObjectName" /t REG_SZ /d "LocalSystem" /f
    2456
  - reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "Start" /t REG_DWORD /d "2" /f
    2500
  - reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "Type" /t REG_DWORD /d "16" /f
    2544
  - reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "ErrorControl" /t REG_DWORD /d "1" /f
    2588
  - reg.exe reg add "HKLM\SYSTEM\CurrentControlSet\services\alark" /v "ImagePath" /t REG_EXPAND_SZ /d "C:\Windows\alark.exe" /f
    2632
  - reg.exe Reg Add "HKLM\SYSTEM\CurrentControlSet\services\alark\Parameters" /v "Application" /t REG_SZ /d "cmd /c start C:\Windows\miter.exe -t3010 C:\Windows\sysclr.bat" /f
    2676
  - PING.EXE ping 127.0.0.1 -n 2
    2724
  - net.exe net start alark
    2788
    - net1.exe C:\Windows\system32\net1 start alark
      2832
  - PING.EXE ping 127.0.0.1 -n 4
    2972
  - timeout.exe timeout 4 /NOBREAK
    508
  - taskkill.exe taskkill /f /im alark.exe
    2416

No process loaded Click on a process in the tree above to load its data.

PID
Parent PID

default registry file network process services synchronisation iexplore office pdf

Behavioral Analysis

Process tree

Process contents