{"DateBased":true,"Day":8,"Month":10,"Year":1994,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":10770,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:29:10.490230145Z | 78 | PC: 13fb3 | Find first file |
| 2018-12-25T12:29:10.494456715Z | 67 | PC: 13ff9 | Get or set file attributes |
| 2018-12-25T12:29:10.507206266Z | 61 | PC: 14003 | Open file |
| 2018-12-25T12:29:10.513020919Z | 63 | PC: 1401a | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-25T12:29:10.518970529Z | 66 | PC: 14047 | Move file pointer |
| 2018-12-25T12:29:10.520590202Z | 87 | PC: 1402b | Get or set file date and time |
| 2018-12-25T12:29:10.522101014Z | 62 | PC: 1402f | Close file |
| 2018-12-25T12:29:10.529193619Z | 67 | PC: 1403d | Get or set file attributes |
| 2018-12-25T12:29:10.53973173Z | 79 | PC: 13fc0 | Find next file |
| 2018-12-25T12:29:10.541794158Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:10.553418764Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:10.559692556Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:10.566582389Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:10.568040091Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:10.569967084Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:10.576390496Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:10.586527791Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:10.590064469Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:10.599819403Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:10.609906844Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:10.61701265Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:10.61836822Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:10.619782711Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:10.627186737Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:10.637189247Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:10.639998893Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:10.650869189Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:10.657373148Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:10.663966146Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:10.666091422Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:10.667527979Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:10.677117349Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:10.683897778Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:10.686209095Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:10.694134132Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:10.700703736Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:10.707194429Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:10.708941565Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:10.710662652Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:10.717313181Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:10.729342821Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:10.73188389Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:10.744353459Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:10.751090802Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:10.757071679Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:10.758273068Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:10.75994314Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:10.766512207Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:10.780688917Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:10.783863396Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:10.793288467Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:10.8043423Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:10.811305585Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:10.81259076Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:10.813887682Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:10.821117981Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:10.830768603Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:10.833137826Z | 78 | PC: 13fb3 | Find first file (See above) |
| 2018-12-25T12:29:10.839522068Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:10.848888165Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:10.859990624Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:10.861764462Z | 66 | PC: 14159 | Move file pointer |
| 2018-12-25T12:29:10.863203293Z | 63 | PC: 14167 | Read file or device (Read 22 bytes on handle 5) |
| 2018-12-25T12:29:10.86984398Z | 66 | PC: 141ba | Move file pointer |
| 2018-12-25T12:29:10.871759241Z | 63 | PC: 141c9 | Read file or device (Read 1 bytes on handle 5) |
| 2018-12-25T12:29:10.878624366Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:10.88049184Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:10.888278997Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:10.897211528Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:10.899997652Z | 53 | PC: 13e5c | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive') |
| 2018-12-25T12:29:10.902191743Z | 42 | PC: 13e6e | Get date 0x13e6e: cmp dx, 0x312 0x13e72: je 0x13ea4 0x13e74: cmp cx, 0x7ca 0x13e78: je 0x13e7f 0x13e7a: jg 0x13e88 0x13e7c: jmp 0x13f3b 0x13e7f: cmp dx, 0xa08 0x13e83: jge 0x13e88 0x13e85: jmp 0x13f3b 0x13e88: test dl, 0xe3 0x13e8b: je 0x13e90 0x13e8d: jmp 0x13f3b 0x13e90: mov ah, 0x2c 0x13e92: int 0x21 0x13e94: test ch, 0xe3 0x13e97: je 0x13e9c 0x13e99: jmp 0x13f3b 0x13e9c: cmp cl, 0xa 0x13e9f: jle 0x13ea4 0x13ea1: jmp 0x13f3b |
| 2018-12-25T12:29:10.904496825Z | 44 | PC: 13e94 | Get time 0x13e94: test ch, 0xe3 0x13e97: je 0x13e9c 0x13e99: jmp 0x13f3b 0x13e9c: cmp cl, 0xa 0x13e9f: jle 0x13ea4 0x13ea1: jmp 0x13f3b 0x13ea4: mov bx, 0xffff 0x13ea7: xor cl, cl 0x13ea9: mov ah, 0x48 0x13eab: int 0x21 0x13ead: cmp cl, 0x20 0x13eb0: jne 0x13eb5 0x13eb2: jmp 0x13f3b 0x13eb5: cmp bx, 0 0x13eb8: jne 0x13ea9 0x13eba: dec bx 0x13ebb: mov ah, 0x4a 0x13ebd: int 0x21 0x13ebf: mov dx, 0x496 0x13ec2: xor dl, dl |
| 2018-12-25T12:29:10.906850017Z | 9 | PC: 13bc2 | Display string (Could not find end pointer) |
| 2018-12-25T12:29:10.913064582Z | 76 | PC: 13bc8 | Terminate with return code (Return code = '0') |
{"DateBased":true,"Day":1,"Month":1,"Year":1995,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":10770,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:29:10.935378799Z | 78 | PC: 13fb3 | Find first file |
| 2018-12-25T12:29:10.947362108Z | 67 | PC: 13ff9 | Get or set file attributes |
| 2018-12-25T12:29:10.964715994Z | 61 | PC: 14003 | Open file |
| 2018-12-25T12:29:10.972492387Z | 63 | PC: 1401a | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-25T12:29:10.980098052Z | 66 | PC: 14047 | Move file pointer |
| 2018-12-25T12:29:10.98150927Z | 87 | PC: 1402b | Get or set file date and time |
| 2018-12-25T12:29:10.982909952Z | 62 | PC: 1402f | Close file |
| 2018-12-25T12:29:10.988368519Z | 67 | PC: 1403d | Get or set file attributes |
| 2018-12-25T12:29:10.999804867Z | 79 | PC: 13fc0 | Find next file |
| 2018-12-25T12:29:11.003935409Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.017595157Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.025137223Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.033103489Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.035155676Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.037632046Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.045628986Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.057217397Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.060904274Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.071894437Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.079282452Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.086888439Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.088776679Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.090379652Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.106248385Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.116987587Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.119837672Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.135127507Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.144182355Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.151728243Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.154297708Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.156426848Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.164822455Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.1763175Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.179563357Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.191022654Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.198620228Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.206486771Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.208366834Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.210445507Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.21894332Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.231270979Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.23444744Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.24595409Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.259206371Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.26656182Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.269521636Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.271270654Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.278912949Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.290451875Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.293466739Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.304397947Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.311788323Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.319807527Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.321534158Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.32341331Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.332253299Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.343310303Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.346271759Z | 78 | PC: 13fb3 | Find first file (See above) |
| 2018-12-25T12:29:11.353629497Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.36488882Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.377347304Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.379441769Z | 66 | PC: 14159 | Move file pointer |
| 2018-12-25T12:29:11.381789151Z | 63 | PC: 14167 | Read file or device (Read 22 bytes on handle 5) |
| 2018-12-25T12:29:11.388778679Z | 66 | PC: 141ba | Move file pointer |
| 2018-12-25T12:29:11.390610671Z | 63 | PC: 141c9 | Read file or device (Read 1 bytes on handle 5) |
| 2018-12-25T12:29:11.397844945Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.399494818Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.408957147Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.420093175Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.423187979Z | 53 | PC: 13e5c | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive') |
| 2018-12-25T12:29:11.425909827Z | 42 | PC: 13e6e | Get date 0x13e6e: cmp dx, 0x312 0x13e72: je 0x13ea4 0x13e74: cmp cx, 0x7ca 0x13e78: je 0x13e7f 0x13e7a: jg 0x13e88 0x13e7c: jmp 0x13f3b 0x13e7f: cmp dx, 0xa08 0x13e83: jge 0x13e88 0x13e85: jmp 0x13f3b 0x13e88: test dl, 0xe3 0x13e8b: je 0x13e90 0x13e8d: jmp 0x13f3b 0x13e90: mov ah, 0x2c 0x13e92: int 0x21 0x13e94: test ch, 0xe3 0x13e97: je 0x13e9c 0x13e99: jmp 0x13f3b 0x13e9c: cmp cl, 0xa 0x13e9f: jle 0x13ea4 0x13ea1: jmp 0x13f3b |
| 2018-12-25T12:29:11.428791992Z | 9 | PC: 13bc2 | Display string (Could not find end pointer) |
| 2018-12-25T12:29:11.434836955Z | 76 | PC: 13bc8 | Terminate with return code (Return code = '0') |
{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":10770,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:29:11.500168378Z | 78 | PC: 13fb3 | Find first file |
| 2018-12-25T12:29:11.507617352Z | 67 | PC: 13ff9 | Get or set file attributes |
| 2018-12-25T12:29:11.524349977Z | 61 | PC: 14003 | Open file |
| 2018-12-25T12:29:11.531117908Z | 63 | PC: 1401a | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-25T12:29:11.538170113Z | 66 | PC: 14047 | Move file pointer |
| 2018-12-25T12:29:11.540128299Z | 87 | PC: 1402b | Get or set file date and time |
| 2018-12-25T12:29:11.541925127Z | 62 | PC: 1402f | Close file |
| 2018-12-25T12:29:11.549288632Z | 67 | PC: 1403d | Get or set file attributes |
| 2018-12-25T12:29:11.560523331Z | 79 | PC: 13fc0 | Find next file |
| 2018-12-25T12:29:11.563250268Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.579849843Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.594948838Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.601400069Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.603090584Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.606845553Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.614361331Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.631136524Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.635971343Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.65004409Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.656486759Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.665012891Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.666494102Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.667862845Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.67579401Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.68568859Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.688242441Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.698368981Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.70976372Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.715878644Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.71736192Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.719475067Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.726536873Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.73640382Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.73991936Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.749296696Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.755632055Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.762267964Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.763442587Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.764599643Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.774318921Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.783765284Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.786269065Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.796318271Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.802911215Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.808962241Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.81101732Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.812407226Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.819157416Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.831774614Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.834374656Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.844154053Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.851365785Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.857878766Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.859206391Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.860733533Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.868229186Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.878016867Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.880862762Z | 78 | PC: 13fb3 | Find first file (See above) |
| 2018-12-25T12:29:11.887442263Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.89990572Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.906581127Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.90878507Z | 66 | PC: 14159 | Move file pointer |
| 2018-12-25T12:29:11.910326582Z | 63 | PC: 14167 | Read file or device (Read 22 bytes on handle 5) |
| 2018-12-25T12:29:11.916721981Z | 66 | PC: 141ba | Move file pointer |
| 2018-12-25T12:29:11.919122579Z | 63 | PC: 141c9 | Read file or device (Read 1 bytes on handle 5) |
| 2018-12-25T12:29:11.925628854Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.927051239Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.934140736Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.944089382Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.946273007Z | 53 | PC: 13e5c | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive') |
| 2018-12-25T12:29:11.948430487Z | 42 | PC: 13e6e | Get date 0x13e6e: cmp dx, 0x312 0x13e72: je 0x13ea4 0x13e74: cmp cx, 0x7ca 0x13e78: je 0x13e7f 0x13e7a: jg 0x13e88 0x13e7c: jmp 0x13f3b 0x13e7f: cmp dx, 0xa08 0x13e83: jge 0x13e88 0x13e85: jmp 0x13f3b 0x13e88: test dl, 0xe3 0x13e8b: je 0x13e90 0x13e8d: jmp 0x13f3b 0x13e90: mov ah, 0x2c 0x13e92: int 0x21 0x13e94: test ch, 0xe3 0x13e97: je 0x13e9c 0x13e99: jmp 0x13f3b 0x13e9c: cmp cl, 0xa 0x13e9f: jle 0x13ea4 0x13ea1: jmp 0x13f3b |
| 2018-12-25T12:29:11.950508991Z | 9 | PC: 13bc2 | Display string (Could not find end pointer) |
| 2018-12-25T12:29:11.955410601Z | 76 | PC: 13bc8 | Terminate with return code (Return code = '0') |
{"DateBased":true,"Day":18,"Month":3,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":10770,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:29:11.502100376Z | 78 | PC: 13fb3 | Find first file |
| 2018-12-25T12:29:11.509376609Z | 67 | PC: 13ff9 | Get or set file attributes |
| 2018-12-25T12:29:11.523693399Z | 61 | PC: 14003 | Open file |
| 2018-12-25T12:29:11.531460717Z | 63 | PC: 1401a | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-25T12:29:11.539165542Z | 66 | PC: 14047 | Move file pointer |
| 2018-12-25T12:29:11.541550508Z | 87 | PC: 1402b | Get or set file date and time |
| 2018-12-25T12:29:11.54325114Z | 62 | PC: 1402f | Close file |
| 2018-12-25T12:29:11.551003631Z | 67 | PC: 1403d | Get or set file attributes |
| 2018-12-25T12:29:11.570586708Z | 79 | PC: 13fc0 | Find next file |
| 2018-12-25T12:29:11.573373773Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.584765532Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.595692435Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.602660718Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.604349039Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.606784973Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.620658902Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.632120893Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.636164781Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.648599495Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.655648567Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.663859501Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.665526546Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.667072469Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.674757425Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.686198017Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.690240146Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.70086931Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.708856044Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.715815741Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.717432247Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.719429098Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.727419686Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.738555401Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.742908192Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.75519111Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.762862148Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.770795345Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.772704544Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.774446792Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.782983604Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.79363089Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.796075913Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.807755607Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.822627478Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.830214673Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.832205548Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.834908848Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.84281324Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.854242999Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.858538394Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.870080418Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.877400487Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.886391167Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.888105902Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.889814127Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.89802055Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.909290976Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.912575606Z | 78 | PC: 13fb3 | Find first file (See above) |
| 2018-12-25T12:29:11.91996777Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.931389315Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.944672868Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.946608717Z | 66 | PC: 14159 | Move file pointer |
| 2018-12-25T12:29:11.948714129Z | 63 | PC: 14167 | Read file or device (Read 22 bytes on handle 5) |
| 2018-12-25T12:29:11.956680418Z | 66 | PC: 141ba | Move file pointer |
| 2018-12-25T12:29:11.95865578Z | 63 | PC: 141c9 | Read file or device (Read 1 bytes on handle 5) |
| 2018-12-25T12:29:11.967072875Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.969180309Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.977583183Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.989904816Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.993065986Z | 53 | PC: 13e5c | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive') |
| 2018-12-25T12:29:11.994828262Z | 42 | PC: 13e6e | Get date 0x13e6e: cmp dx, 0x312 0x13e72: je 0x13ea4 0x13e74: cmp cx, 0x7ca 0x13e78: je 0x13e7f 0x13e7a: jg 0x13e88 0x13e7c: jmp 0x13f3b 0x13e7f: cmp dx, 0xa08 0x13e83: jge 0x13e88 0x13e85: jmp 0x13f3b 0x13e88: test dl, 0xe3 0x13e8b: je 0x13e90 0x13e8d: jmp 0x13f3b 0x13e90: mov ah, 0x2c 0x13e92: int 0x21 0x13e94: test ch, 0xe3 0x13e97: je 0x13e9c 0x13e99: jmp 0x13f3b 0x13e9c: cmp cl, 0xa 0x13e9f: jle 0x13ea4 0x13ea1: jmp 0x13f3b |
| 2018-12-25T12:29:11.99854661Z | 72 | PC: 13ead | Allocate memory |
| 2018-12-25T12:29:12.00125386Z | 74 | PC: 13ebf | Reallocate memory |
| 2018-12-25T12:29:12.003472386Z | 74 | PC: 13ecf | Reallocate memory |
| 2018-12-25T12:29:12.006217119Z | 72 | PC: 13ed7 | Allocate memory |
| 2018-12-25T12:29:12.008843169Z | 9 | PC: 13f19 | Display string (String= ' I love you, girls ! You are so beautiful ! ') |
| 2018-12-25T12:29:12.016088536Z | 9 | PC: 13bc2 | Display string (Could not find end pointer) |
| 2018-12-25T12:29:12.022725684Z | 76 | PC: 13bc8 | Terminate with return code (Return code = '0') |
{"DateBased":true,"Day":1,"Month":1,"Year":1994,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":10770,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:29:11.622377523Z | 78 | PC: 13fb3 | Find first file |
| 2018-12-25T12:29:11.631130825Z | 67 | PC: 13ff9 | Get or set file attributes |
| 2018-12-25T12:29:11.649149505Z | 61 | PC: 14003 | Open file |
| 2018-12-25T12:29:11.661658359Z | 63 | PC: 1401a | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-25T12:29:11.669456405Z | 66 | PC: 14047 | Move file pointer |
| 2018-12-25T12:29:11.671273038Z | 87 | PC: 1402b | Get or set file date and time |
| 2018-12-25T12:29:11.673046129Z | 62 | PC: 1402f | Close file |
| 2018-12-25T12:29:11.681168468Z | 67 | PC: 1403d | Get or set file attributes |
| 2018-12-25T12:29:11.692916144Z | 79 | PC: 13fc0 | Find next file |
| 2018-12-25T12:29:11.695761939Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.706241108Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.71437902Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.721597834Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.724172918Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.726737205Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.73839134Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.749342944Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.754469746Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.766232855Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.773838458Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.781840351Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.783923387Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.785997842Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.794549442Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.803661539Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.806625384Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.817198732Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.825587171Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.832616038Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.834248796Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.836385409Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.84549588Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.856598863Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.860128439Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.873314672Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.878057944Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.883405151Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.884848073Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.886343455Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.892220885Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.898909681Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.901200742Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.912263753Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.924578685Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.932006805Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.933798751Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.935830179Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.943350748Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.954044158Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:11.957219963Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:11.967671948Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:11.974759911Z | 63 | PC: 1401a | Read file or device (See above) |
| 2018-12-25T12:29:11.982179673Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:11.983847541Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:11.985456273Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:11.996509317Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:12.007051156Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:12.009623935Z | 78 | PC: 13fb3 | Find first file (See above) |
| 2018-12-25T12:29:12.016795589Z | 67 | PC: 13ff9 | Get or set file attributes (See above) |
| 2018-12-25T12:29:12.027394861Z | 61 | PC: 14003 | Open file (See above) |
| 2018-12-25T12:29:12.034955816Z | 66 | PC: 14047 | Move file pointer (See above) |
| 2018-12-25T12:29:12.037715981Z | 66 | PC: 14159 | Move file pointer |
| 2018-12-25T12:29:12.039592476Z | 63 | PC: 14167 | Read file or device (Read 22 bytes on handle 5) |
| 2018-12-25T12:29:12.046692908Z | 66 | PC: 141ba | Move file pointer |
| 2018-12-25T12:29:12.048613838Z | 63 | PC: 141c9 | Read file or device (Read 1 bytes on handle 5) |
| 2018-12-25T12:29:12.056599632Z | 87 | PC: 1402b | Get or set file date and time (See above) |
| 2018-12-25T12:29:12.05812509Z | 62 | PC: 1402f | Close file (See above) |
| 2018-12-25T12:29:12.065982937Z | 67 | PC: 1403d | Get or set file attributes (See above) |
| 2018-12-25T12:29:12.076990951Z | 79 | PC: 13fc0 | Find next file (See above) |
| 2018-12-25T12:29:12.07982043Z | 53 | PC: 13e5c | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive') |
| 2018-12-25T12:29:12.081386173Z | 42 | PC: 13e6e | Get date 0x13e6e: cmp dx, 0x312 0x13e72: je 0x13ea4 0x13e74: cmp cx, 0x7ca 0x13e78: je 0x13e7f 0x13e7a: jg 0x13e88 0x13e7c: jmp 0x13f3b 0x13e7f: cmp dx, 0xa08 0x13e83: jge 0x13e88 0x13e85: jmp 0x13f3b 0x13e88: test dl, 0xe3 0x13e8b: je 0x13e90 0x13e8d: jmp 0x13f3b 0x13e90: mov ah, 0x2c 0x13e92: int 0x21 0x13e94: test ch, 0xe3 0x13e97: je 0x13e9c 0x13e99: jmp 0x13f3b 0x13e9c: cmp cl, 0xa 0x13e9f: jle 0x13ea4 0x13ea1: jmp 0x13f3b |
| 2018-12-25T12:29:12.083991459Z | 9 | PC: 13bc2 | Display string (Could not find end pointer) |
| 2018-12-25T12:29:12.090043782Z | 76 | PC: 13bc8 | Terminate with return code (Return code = '0') |