{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":12050,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:31:55.09912526Z | 78 | PC: 12b6e | Find first file |
| 2018-12-25T12:31:55.105803663Z | 78 | PC: 12b7d | Find first file |
| 2018-12-25T12:31:55.113586008Z | 67 | PC: 12bad | Get or set file attributes |
| 2018-12-25T12:31:55.131887932Z | 61 | PC: 12bb2 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T12:31:55.139554867Z | 63 | PC: 12bc1 | Read file or device (Read 20 bytes on handle 5) |
| 2018-12-25T12:31:55.149263168Z | 62 | PC: 12bec | Close file |
| 2018-12-25T12:31:55.151434078Z | 61 | PC: 12bf4 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T12:31:55.166176478Z | 64 | PC: 12a5a | Write file or device (Write 648 bytes on handle 5) |
| 2018-12-25T12:31:55.188755349Z | 87 | PC: 12c24 | Get or set file date and time |
| 2018-12-25T12:31:55.190172606Z | 62 | PC: 12c28 | Close file |
| 2018-12-25T12:31:55.198584685Z | 67 | PC: 12c34 | Get or set file attributes |
| 2018-12-25T12:31:55.204954501Z | 79 | PC: 12be1 | Find next file |
| 2018-12-25T12:31:55.21687806Z | 67 | PC: 12bad | Get or set file attributes (See above) |
| 2018-12-25T12:31:55.224837028Z | 61 | PC: 12bb2 | Open file (See above) |
| 2018-12-25T12:31:55.230616442Z | 63 | PC: 12bc1 | Read file or device (See above) |
| 2018-12-25T12:31:55.23557673Z | 62 | PC: 12bec | Close file (See above) |
| 2018-12-25T12:31:55.246553244Z | 61 | PC: 12bf4 | Open file (See above) |
| 2018-12-25T12:31:55.271375553Z | 64 | PC: 12a5a | Write file or device (See above) |
| 2018-12-25T12:31:55.28215718Z | 87 | PC: 12c24 | Get or set file date and time (See above) |
| 2018-12-25T12:31:55.28470304Z | 62 | PC: 12c28 | Close file (See above) |
| 2018-12-25T12:31:55.298154579Z | 67 | PC: 12c34 | Get or set file attributes (See above) |
| 2018-12-25T12:31:55.314005103Z | 79 | PC: 12be1 | Find next file (See above) |
| 2018-12-25T12:31:55.317079856Z | 67 | PC: 12bad | Get or set file attributes (See above) |
| 2018-12-25T12:31:55.32916168Z | 61 | PC: 12bb2 | Open file (See above) |
| 2018-12-25T12:31:55.337716855Z | 63 | PC: 12bc1 | Read file or device (See above) |
| 2018-12-25T12:31:55.34542195Z | 62 | PC: 12bec | Close file (See above) |
| 2018-12-25T12:31:55.34743569Z | 61 | PC: 12bf4 | Open file (See above) |
| 2018-12-25T12:31:55.356451197Z | 64 | PC: 12a5a | Write file or device (See above) |
| 2018-12-25T12:31:55.366293382Z | 87 | PC: 12c24 | Get or set file date and time (See above) |
| 2018-12-25T12:31:55.368341523Z | 62 | PC: 12c28 | Close file (See above) |
| 2018-12-25T12:31:55.377484916Z | 67 | PC: 12c34 | Get or set file attributes (See above) |
| 2018-12-25T12:31:55.38395369Z | 9 | PC: 12c6c | Display string (String= 'Program too big to fit in memory ') |
{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":56,"TimeBased":true,"OriginalID":12050,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:31:55.113678358Z | 78 | PC: 12b6e | Find first file |
| 2018-12-25T12:31:55.120260112Z | 78 | PC: 12b7d | Find first file |
| 2018-12-25T12:31:55.125928306Z | 67 | PC: 12bad | Get or set file attributes |
| 2018-12-25T12:31:55.144130533Z | 61 | PC: 12bb2 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T12:31:55.151631038Z | 63 | PC: 12bc1 | Read file or device (Read 20 bytes on handle 5) |
| 2018-12-25T12:31:55.157739093Z | 62 | PC: 12bec | Close file |
| 2018-12-25T12:31:55.159311734Z | 61 | PC: 12bf4 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T12:31:55.167081433Z | 64 | PC: 12a5a | Write file or device (Write 648 bytes on handle 5) |
| 2018-12-25T12:31:55.175263112Z | 87 | PC: 12c24 | Get or set file date and time |
| 2018-12-25T12:31:55.177006513Z | 62 | PC: 12c28 | Close file |
| 2018-12-25T12:31:55.184838Z | 67 | PC: 12c34 | Get or set file attributes |
| 2018-12-25T12:31:55.189602914Z | 79 | PC: 12be1 | Find next file |
| 2018-12-25T12:31:55.192087451Z | 67 | PC: 12bad | Get or set file attributes (See above) |
| 2018-12-25T12:31:55.201558564Z | 61 | PC: 12bb2 | Open file (See above) |
| 2018-12-25T12:31:55.21405523Z | 63 | PC: 12bc1 | Read file or device (See above) |
| 2018-12-25T12:31:55.220214658Z | 62 | PC: 12bec | Close file (See above) |
| 2018-12-25T12:31:55.22168981Z | 61 | PC: 12bf4 | Open file (See above) |
| 2018-12-25T12:31:55.234613896Z | 64 | PC: 12a5a | Write file or device (See above) |
| 2018-12-25T12:31:55.251344969Z | 87 | PC: 12c24 | Get or set file date and time (See above) |
| 2018-12-25T12:31:55.252759582Z | 62 | PC: 12c28 | Close file (See above) |
| 2018-12-25T12:31:55.261373321Z | 67 | PC: 12c34 | Get or set file attributes (See above) |
| 2018-12-25T12:31:55.265891957Z | 79 | PC: 12be1 | Find next file (See above) |
| 2018-12-25T12:31:55.268287268Z | 67 | PC: 12bad | Get or set file attributes (See above) |
| 2018-12-25T12:31:55.277882577Z | 61 | PC: 12bb2 | Open file (See above) |
| 2018-12-25T12:31:55.284651977Z | 63 | PC: 12bc1 | Read file or device (See above) |
| 2018-12-25T12:31:55.29053209Z | 62 | PC: 12bec | Close file (See above) |
| 2018-12-25T12:31:55.292896547Z | 61 | PC: 12bf4 | Open file (See above) |
| 2018-12-25T12:31:55.302911935Z | 64 | PC: 12a5a | Write file or device (See above) |
| 2018-12-25T12:31:55.311122124Z | 87 | PC: 12c24 | Get or set file date and time (See above) |
| 2018-12-25T12:31:55.313464179Z | 62 | PC: 12c28 | Close file (See above) |
| 2018-12-25T12:31:55.32192426Z | 67 | PC: 12c34 | Get or set file attributes (See above) |
| 2018-12-25T12:31:55.326987851Z | 9 | PC: 12c6c | Display string (String= 'Program too big to fit in memory ') |