{"DateBased":true,"Day":1,"Month":1,"Year":1995,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":10382,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:27:52.299585877Z | 48 | PC: 12a98 | Get DOS version |
| 2018-12-25T12:27:52.301694092Z | 54 | PC: 12aa6 | Get free disk space |
| 2018-12-25T12:27:52.332672409Z | 42 | PC: 12ab2 | Get date 0x12ab2: cmp cx, 0x7ca 0x12ab6: jae 0x12abb 0x12ab8: jmp 0x12b4c 0x12abb: push cs 0x12abc: pop ds 0x12abd: mov ah, 9 0x12abf: lea dx, word ptr [bp + 0x264] 0x12ac3: int 0x21 0x12ac5: mov ah, 0x1a 0x12ac7: mov dx, 0xfd00 0x12aca: int 0x21 0x12acc: mov ax, word ptr cs:[0x2c] 0x12ad0: mov ds, ax 0x12ad2: mov si, 0 0x12ad5: mov cx, 0x4000 0x12ad8: lodsb al, byte ptr [si] 0x12ad9: cmp al, 1 0x12adb: je 0x12adf 0x12add: loop 0x12ad8 0x12adf: inc si |
| 2018-12-25T12:27:52.335725688Z | 9 | PC: 12ac5 | Display string (Could not find end pointer) |
| 2018-12-25T12:27:52.366773401Z | 26 | PC: 12acc | Set disk transfer address |
| 2018-12-25T12:27:52.377655583Z | 67 | PC: 12afc | Get or set file attributes |
| 2018-12-25T12:27:52.384750475Z | 67 | PC: 12b09 | Get or set file attributes |
| 2018-12-25T12:27:52.403297605Z | 61 | PC: 12b0e | Open file (Filename = 'A:\TEST.COM') |
| 2018-12-25T12:27:52.415598593Z | 87 | PC: 12b15 | Get or set file date and time |
| 2018-12-25T12:27:52.417298651Z | 62 | PC: 12b1b | Close file |
| 2018-12-25T12:27:52.419427446Z | 60 | PC: 12b24 | Create or truncate file |
| 2018-12-25T12:27:52.434322331Z | 64 | PC: 12b33 | Write file or device (Write 4 bytes on handle 5) |
| 2018-12-25T12:27:52.438816801Z | 87 | PC: 12b3a | Get or set file date and time |
| 2018-12-25T12:27:52.441067194Z | 62 | PC: 12b3e | Close file |
| 2018-12-25T12:27:52.458556765Z | 67 | PC: 12b47 | Get or set file attributes |
| 2018-12-25T12:27:52.47800896Z | 26 | PC: 12c6f | Set disk transfer address |
{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":10382,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:27:52.40296777Z | 48 | PC: 12a98 | Get DOS version |
| 2018-12-25T12:27:52.40911782Z | 54 | PC: 12aa6 | Get free disk space |
| 2018-12-25T12:27:52.419201839Z | 42 | PC: 12ab2 | Get date 0x12ab2: cmp cx, 0x7ca 0x12ab6: jae 0x12abb 0x12ab8: jmp 0x12b4c 0x12abb: push cs 0x12abc: pop ds 0x12abd: mov ah, 9 0x12abf: lea dx, word ptr [bp + 0x264] 0x12ac3: int 0x21 0x12ac5: mov ah, 0x1a 0x12ac7: mov dx, 0xfd00 0x12aca: int 0x21 0x12acc: mov ax, word ptr cs:[0x2c] 0x12ad0: mov ds, ax 0x12ad2: mov si, 0 0x12ad5: mov cx, 0x4000 0x12ad8: lodsb al, byte ptr [si] 0x12ad9: cmp al, 1 0x12adb: je 0x12adf 0x12add: loop 0x12ad8 0x12adf: inc si |
| 2018-12-25T12:27:52.422464554Z | 26 | PC: 12b53 | Set disk transfer address |
| 2018-12-25T12:27:52.424790251Z | 78 | PC: 12b5d | Find first file |
| 2018-12-25T12:27:52.432933613Z | 67 | PC: 12b6a | Get or set file attributes |
| 2018-12-25T12:27:52.439173533Z | 67 | PC: 12b72 | Get or set file attributes |
| 2018-12-25T12:27:52.458387856Z | 61 | PC: 12b77 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T12:27:52.466256638Z | 87 | PC: 12b7d | Get or set file date and time |
| 2018-12-25T12:27:52.467733861Z | 63 | PC: 12b8a | Read file or device (Read 4 bytes on handle 5) |
| 2018-12-25T12:27:52.475450589Z | 66 | PC: 12bb0 | Move file pointer |
| 2018-12-25T12:27:52.478069626Z | 66 | PC: 12bd1 | Move file pointer |
| 2018-12-25T12:27:52.479569299Z | 63 | PC: 12bdb | Read file or device (Read 52 bytes on handle 5) |
| 2018-12-25T12:27:52.482202542Z | 66 | PC: 12bb0 | Move file pointer (See above) |
| 2018-12-25T12:27:52.484103133Z | 44 | PC: 12c28 | Get time 0x12c28: cmp dl, 0 0x12c2b: jne 0x12c2f 0x12c2d: jmp 0x12c24 0x12c2f: mov byte ptr cs:[bp + 0x17], dl 0x12c33: lea si, word ptr [bp + 4] 0x12c36: mov di, 0xfb00 0x12c39: mov cx, 0x17 0x12c3c: rep movsb byte ptr es:[di], byte ptr [si] 0x12c3e: lea si, word ptr [bp + 0x1b] 0x12c41: mov cx, 0x3f5 0x12c44: lodsb al, byte ptr [si] 0x12c45: xor al, dl 0x12c47: stosb byte ptr es:[di], al 0x12c48: loop 0x12c44 0x12c4a: mov ah, 0x40 0x12c4c: mov dx, 0xfb00 0x12c4f: mov cx, 0x40c 0x12c52: int 0x21 0x12c54: mov ax, 0x4200 0x12c57: call 0x22baa |
| 2018-12-25T12:27:52.487924297Z | 64 | PC: 12c54 | Write file or device (Write 1036 bytes on handle 5) |
| 2018-12-25T12:27:52.497807129Z | 66 | PC: 12bb0 | Move file pointer (See above) |
| 2018-12-25T12:27:52.500568951Z | 64 | PC: 12c65 | Write file or device (Write 4 bytes on handle 5) |
| 2018-12-25T12:27:52.508412604Z | 87 | PC: 12c95 | Get or set file date and time |
| 2018-12-25T12:27:52.509987482Z | 62 | PC: 12c99 | Close file |
| 2018-12-25T12:27:52.524857984Z | 67 | PC: 12ca2 | Get or set file attributes |
| 2018-12-25T12:27:52.533062157Z | 26 | PC: 12c6f | Set disk transfer address |