{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":1304,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:43:22.745846415Z | 78 | PC: 151c0 | Find first file |
| 2018-12-25T11:43:22.752511018Z | 47 | PC: 151d4 | Get disk transfer address |
| 2018-12-25T11:43:22.753728427Z | 67 | PC: 151f5 | Get or set file attributes |
| 2018-12-25T11:43:22.759363246Z | 67 | PC: 151fe | Get or set file attributes |
| 2018-12-25T11:43:22.777580433Z | 61 | PC: 15203 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T11:43:22.797370153Z | 66 | PC: 1520f | Move file pointer |
| 2018-12-25T11:43:22.798775464Z | 66 | PC: 1521e | Move file pointer |
| 2018-12-25T11:43:22.801089741Z | 63 | PC: 1522a | Read file or device (Read 2 bytes on handle 5) |
| 2018-12-25T11:43:22.807335807Z | 87 | PC: 1525d | Get or set file date and time |
| 2018-12-25T11:43:22.808754534Z | 66 | PC: 1526b | Move file pointer |
| 2018-12-25T11:43:22.810632896Z | 63 | PC: 15277 | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-25T11:43:22.813118082Z | 66 | PC: 15282 | Move file pointer |
| 2018-12-25T11:43:22.814406207Z | 66 | PC: 15292 | Move file pointer |
| 2018-12-25T11:43:22.816250924Z | 64 | PC: 152a8 | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-25T11:43:22.819154984Z | 66 | PC: 152b3 | Move file pointer |
| 2018-12-25T11:43:22.82070608Z | 64 | PC: 152cd | Write file or device (Write 1056 bytes on handle 5) |
| 2018-12-25T11:43:22.829897309Z | 62 | PC: 152d1 | Close file |
| 2018-12-25T11:43:22.837948573Z | 67 | PC: 152dd | Get or set file attributes |
| 2018-12-25T11:43:22.847910508Z | 61 | PC: 152e2 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T11:43:22.854907151Z | 87 | PC: 152ef | Get or set file date and time |
| 2018-12-25T11:43:22.856987082Z | 62 | PC: 152f3 | Close file |
| 2018-12-25T11:43:22.864139196Z | 67 | PC: 152ff | Get or set file attributes |
| 2018-12-25T11:43:22.874228361Z | 42 | PC: 15306 | Get date 0x15306: cmp dl, 0x1b 0x15309: jne 0x1530e 0x1530b: call 0x15502 0x1530e: mov ax, 0xdeca 0x15311: int 0x21 0x15313: cmp ax, 0xaced 0x15316: jne 0x1531b 0x15318: jmp 0x154fa 0x1531b: push ds 0x1531c: push es 0x1531d: push cs 0x1531e: pop ax 0x1531f: dec ax 0x15320: mov es, ax 0x15322: mov dl, byte ptr es:[0] 0x15327: mov ax, word ptr es:[3] 0x1532b: mov bx, cs 0x1532d: add ax, bx 0x1532f: sub ax, 0x15 0x15332: mov ds, ax |
| 2018-12-25T11:43:22.876826805Z | 222 | PC: 15313 | UNKNOWN! |
| 2018-12-25T11:43:22.877943999Z | 76 | PC: 15144 | Terminate with return code (Return code = '0') |
{"DateBased":true,"Day":27,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":1304,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:43:22.862857922Z | 78 | PC: 151c0 | Find first file |
| 2018-12-25T11:43:22.884260644Z | 47 | PC: 151d4 | Get disk transfer address |
| 2018-12-25T11:43:22.885575163Z | 67 | PC: 151f5 | Get or set file attributes |
| 2018-12-25T11:43:22.891700981Z | 67 | PC: 151fe | Get or set file attributes |
| 2018-12-25T11:43:23.331430338Z | 61 | PC: 15203 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T11:43:23.339994522Z | 66 | PC: 1520f | Move file pointer |
| 2018-12-25T11:43:23.341849278Z | 66 | PC: 1521e | Move file pointer |
| 2018-12-25T11:43:23.343861041Z | 63 | PC: 1522a | Read file or device (Read 2 bytes on handle 5) |
| 2018-12-25T11:43:23.352520261Z | 87 | PC: 1525d | Get or set file date and time |
| 2018-12-25T11:43:23.354436145Z | 66 | PC: 1526b | Move file pointer |
| 2018-12-25T11:43:23.356384251Z | 63 | PC: 15277 | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-25T11:43:23.361157237Z | 66 | PC: 15282 | Move file pointer |
| 2018-12-25T11:43:23.363663523Z | 66 | PC: 15292 | Move file pointer |
| 2018-12-25T11:43:23.365645949Z | 64 | PC: 152a8 | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-25T11:43:23.369611535Z | 66 | PC: 152b3 | Move file pointer |
| 2018-12-25T11:43:23.372031197Z | 64 | PC: 152cd | Write file or device (Write 1056 bytes on handle 5) |
| 2018-12-25T11:43:23.392388521Z | 62 | PC: 152d1 | Close file |
| 2018-12-25T11:43:23.403320315Z | 67 | PC: 152dd | Get or set file attributes |
| 2018-12-25T11:43:23.414900381Z | 61 | PC: 152e2 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T11:43:23.422339126Z | 87 | PC: 152ef | Get or set file date and time |
| 2018-12-25T11:43:23.424318891Z | 62 | PC: 152f3 | Close file |
| 2018-12-25T11:43:23.43242008Z | 67 | PC: 152ff | Get or set file attributes |
| 2018-12-25T11:43:23.442374947Z | 42 | PC: 15306 | Get date 0x15306: cmp dl, 0x1b 0x15309: jne 0x1530e 0x1530b: call 0x15502 0x1530e: mov ax, 0xdeca 0x15311: int 0x21 0x15313: cmp ax, 0xaced 0x15316: jne 0x1531b 0x15318: jmp 0x154fa 0x1531b: push ds 0x1531c: push es 0x1531d: push cs 0x1531e: pop ax 0x1531f: dec ax 0x15320: mov es, ax 0x15322: mov dl, byte ptr es:[0] 0x15327: mov ax, word ptr es:[3] 0x1532b: mov bx, cs 0x1532d: add ax, bx 0x1532f: sub ax, 0x15 0x15332: mov ds, ax |
| 2018-12-25T11:43:23.780975124Z | 222 | PC: 15313 | UNKNOWN! |
| 2018-12-25T11:43:23.783609636Z | 76 | PC: 15144 | Terminate with return code (Return code = '0') |