{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":11679,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:31:09.504382562Z | 48 | PC: 12a98 | Get DOS version |
| 2018-12-25T12:31:09.505881708Z | 54 | PC: 12aa6 | Get free disk space |
| 2018-12-25T12:31:09.51531696Z | 42 | PC: 12ab2 | Get date 0x12ab2: cmp cx, 0x7c9 0x12ab6: jae 0x12abb 0x12ab8: jmp 0x12b4c 0x12abb: push cs 0x12abc: pop ds 0x12abd: mov ah, 9 0x12abf: lea dx, word ptr [bp + 0x274] 0x12ac3: int 0x21 0x12ac5: mov ah, 0x1a 0x12ac7: mov dx, 0xfd00 0x12aca: int 0x21 0x12acc: mov ax, word ptr cs:[0x2c] 0x12ad0: mov ds, ax 0x12ad2: mov si, 0 0x12ad5: mov cx, 0x4000 0x12ad8: lodsb al, byte ptr [si] 0x12ad9: cmp al, 1 0x12adb: je 0x12adf 0x12add: loop 0x12ad8 0x12adf: inc si |
| 2018-12-25T12:31:09.517302885Z | 26 | PC: 12b53 | Set disk transfer address |
| 2018-12-25T12:31:09.519063775Z | 78 | PC: 12b5d | Find first file |
| 2018-12-25T12:31:09.524875313Z | 67 | PC: 12b6a | Get or set file attributes |
| 2018-12-25T12:31:09.530198108Z | 67 | PC: 12b72 | Get or set file attributes |
| 2018-12-25T12:31:10.246600848Z | 61 | PC: 12b77 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T12:31:10.260074343Z | 87 | PC: 12b7d | Get or set file date and time |
| 2018-12-25T12:31:10.261022064Z | 63 | PC: 12b8a | Read file or device (Read 4 bytes on handle 5) |
| 2018-12-25T12:31:10.266451456Z | 66 | PC: 12bb0 | Move file pointer |
| 2018-12-25T12:31:10.267570336Z | 66 | PC: 12bd1 | Move file pointer |
| 2018-12-25T12:31:10.268675446Z | 63 | PC: 12bdb | Read file or device (Read 52 bytes on handle 5) |
| 2018-12-25T12:31:10.271287233Z | 66 | PC: 12bb0 | Move file pointer (See above) |
| 2018-12-25T12:31:10.272755887Z | 44 | PC: 12c28 | Get time 0x12c28: cmp dl, 0 0x12c2b: jne 0x12c37 0x12c2d: mov ah, 9 0x12c2f: lea dx, word ptr [bp + 0x3d9] 0x12c33: int 0x21 0x12c35: jmp 0x12c24 0x12c37: mov byte ptr cs:[bp + 0x17], dl 0x12c3b: lea si, word ptr [bp + 4] 0x12c3e: mov di, 0xfb00 0x12c41: mov cx, 0x17 0x12c44: rep movsb byte ptr es:[di], byte ptr [si] 0x12c46: lea si, word ptr [bp + 0x1b] 0x12c49: mov cx, 0x41d 0x12c4c: lodsb al, byte ptr [si] 0x12c4d: xor al, dl 0x12c4f: stosb byte ptr es:[di], al 0x12c50: loop 0x12c4c 0x12c52: mov ah, 0x40 0x12c54: mov dx, 0xfb00 0x12c57: mov cx, 0x434 |
| 2018-12-25T12:31:10.274860142Z | 64 | PC: 12c5c | Write file or device (Write 1076 bytes on handle 5) |
| 2018-12-25T12:31:10.298110527Z | 66 | PC: 12bb0 | Move file pointer (See above) |
| 2018-12-25T12:31:10.299623498Z | 64 | PC: 12c6d | Write file or device (Write 4 bytes on handle 5) |
| 2018-12-25T12:31:10.305849359Z | 87 | PC: 12c9d | Get or set file date and time |
| 2018-12-25T12:31:10.307283047Z | 62 | PC: 12ca1 | Close file |
| 2018-12-25T12:31:10.342819678Z | 67 | PC: 12caa | Get or set file attributes |
| 2018-12-25T12:31:10.347568863Z | 65 | PC: 12cb2 | Delete file (Filename = 'chklist.cps') |
| 2018-12-25T12:31:10.354087385Z | 26 | PC: 12c77 | Set disk transfer address |
{"DateBased":true,"Day":1,"Month":1,"Year":1994,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":11679,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:31:09.70456487Z | 48 | PC: 12a98 | Get DOS version |
| 2018-12-25T12:31:09.70564674Z | 54 | PC: 12aa6 | Get free disk space |
| 2018-12-25T12:31:09.7137513Z | 42 | PC: 12ab2 | Get date 0x12ab2: cmp cx, 0x7c9 0x12ab6: jae 0x12abb 0x12ab8: jmp 0x12b4c 0x12abb: push cs 0x12abc: pop ds 0x12abd: mov ah, 9 0x12abf: lea dx, word ptr [bp + 0x274] 0x12ac3: int 0x21 0x12ac5: mov ah, 0x1a 0x12ac7: mov dx, 0xfd00 0x12aca: int 0x21 0x12acc: mov ax, word ptr cs:[0x2c] 0x12ad0: mov ds, ax 0x12ad2: mov si, 0 0x12ad5: mov cx, 0x4000 0x12ad8: lodsb al, byte ptr [si] 0x12ad9: cmp al, 1 0x12adb: je 0x12adf 0x12add: loop 0x12ad8 0x12adf: inc si |
| 2018-12-25T12:31:09.715725828Z | 9 | PC: 12ac5 | Display string (Could not find end pointer) |
| 2018-12-25T12:31:09.735307898Z | 26 | PC: 12acc | Set disk transfer address |
| 2018-12-25T12:31:09.736612494Z | 67 | PC: 12afc | Get or set file attributes |
| 2018-12-25T12:31:09.74219024Z | 67 | PC: 12b09 | Get or set file attributes |
| 2018-12-25T12:31:10.971363855Z | 61 | PC: 12b0e | Open file (Filename = 'A:\TEST.COM') |
| 2018-12-25T12:31:10.978736329Z | 87 | PC: 12b15 | Get or set file date and time |
| 2018-12-25T12:31:10.979981544Z | 62 | PC: 12b1b | Close file |
| 2018-12-25T12:31:10.982283725Z | 60 | PC: 12b24 | Create or truncate file |
| 2018-12-25T12:31:11.08845443Z | 64 | PC: 12b33 | Write file or device (Write 4 bytes on handle 5) |
| 2018-12-25T12:31:11.092288242Z | 87 | PC: 12b3a | Get or set file date and time |
| 2018-12-25T12:31:11.094100912Z | 62 | PC: 12b3e | Close file |
| 2018-12-25T12:31:11.16115811Z | 67 | PC: 12b47 | Get or set file attributes |
| 2018-12-25T12:31:11.235159304Z | 26 | PC: 12c77 | Set disk transfer address |