{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13429,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:38:11.745252388Z | 78 | PC: 12a4a | Find first file |
| 2018-12-25T12:38:11.753621865Z | 67 | PC: 12a8e | Get or set file attributes |
| 2018-12-25T12:38:11.75798889Z | 67 | PC: 12a9a | Get or set file attributes |
| 2018-12-25T12:38:11.78059428Z | 61 | PC: 12aa0 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T12:38:11.788100988Z | 87 | PC: 12aaa | Get or set file date and time |
| 2018-12-25T12:38:11.790407672Z | 64 | PC: 12abd | Write file or device (Write 263 bytes on handle 5) |
| 2018-12-25T12:38:11.797679214Z | 87 | PC: 12acb | Get or set file date and time |
| 2018-12-25T12:38:11.799164502Z | 62 | PC: 12acf | Close file |
| 2018-12-25T12:38:11.808230824Z | 67 | PC: 12adc | Get or set file attributes |
| 2018-12-25T12:38:11.819128342Z | 79 | PC: 12a59 | Find next file |
| 2018-12-25T12:38:11.828615021Z | 67 | PC: 12a8e | Get or set file attributes (See above) |
| 2018-12-25T12:38:11.837170713Z | 67 | PC: 12a9a | Get or set file attributes (See above) |
| 2018-12-25T12:38:11.850662425Z | 61 | PC: 12aa0 | Open file (See above) |
| 2018-12-25T12:38:11.860826409Z | 87 | PC: 12aaa | Get or set file date and time (See above) |
| 2018-12-25T12:38:11.865741877Z | 64 | PC: 12abd | Write file or device (See above) |
| 2018-12-25T12:38:11.874981394Z | 87 | PC: 12acb | Get or set file date and time (See above) |
| 2018-12-25T12:38:11.877064761Z | 62 | PC: 12acf | Close file (See above) |
| 2018-12-25T12:38:11.884603682Z | 67 | PC: 12adc | Get or set file attributes (See above) |
| 2018-12-25T12:38:11.896429637Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T12:38:11.899299917Z | 67 | PC: 12a8e | Get or set file attributes (See above) |
| 2018-12-25T12:38:11.905561336Z | 67 | PC: 12a9a | Get or set file attributes (See above) |
| 2018-12-25T12:38:11.923543324Z | 61 | PC: 12aa0 | Open file (See above) |
| 2018-12-25T12:38:11.936568664Z | 87 | PC: 12aaa | Get or set file date and time (See above) |
| 2018-12-25T12:38:11.939102381Z | 64 | PC: 12abd | Write file or device (See above) |
| 2018-12-25T12:38:11.947563939Z | 87 | PC: 12acb | Get or set file date and time (See above) |
| 2018-12-25T12:38:11.949733327Z | 62 | PC: 12acf | Close file (See above) |
| 2018-12-25T12:38:11.958448507Z | 67 | PC: 12adc | Get or set file attributes (See above) |
| 2018-12-25T12:38:11.970335333Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T12:38:11.973247277Z | 67 | PC: 12a8e | Get or set file attributes (See above) |
| 2018-12-25T12:38:11.979499139Z | 67 | PC: 12a9a | Get or set file attributes (See above) |
| 2018-12-25T12:38:11.999659925Z | 61 | PC: 12aa0 | Open file (See above) |
| 2018-12-25T12:38:12.01342627Z | 87 | PC: 12aaa | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.015427155Z | 64 | PC: 12abd | Write file or device (See above) |
| 2018-12-25T12:38:12.023820809Z | 87 | PC: 12acb | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.025633869Z | 62 | PC: 12acf | Close file (See above) |
| 2018-12-25T12:38:12.033876595Z | 67 | PC: 12adc | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.044695879Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T12:38:12.048166756Z | 67 | PC: 12a8e | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.054340606Z | 67 | PC: 12a9a | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.064894323Z | 61 | PC: 12aa0 | Open file (See above) |
| 2018-12-25T12:38:12.078553897Z | 87 | PC: 12aaa | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.080118491Z | 64 | PC: 12abd | Write file or device (See above) |
| 2018-12-25T12:38:12.087282065Z | 87 | PC: 12acb | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.089952342Z | 62 | PC: 12acf | Close file (See above) |
| 2018-12-25T12:38:12.097898559Z | 67 | PC: 12adc | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.108814497Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T12:38:12.11238159Z | 67 | PC: 12a8e | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.118834062Z | 67 | PC: 12a9a | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.129760535Z | 61 | PC: 12aa0 | Open file (See above) |
| 2018-12-25T12:38:12.14421865Z | 87 | PC: 12aaa | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.146239226Z | 64 | PC: 12abd | Write file or device (See above) |
| 2018-12-25T12:38:12.153936686Z | 87 | PC: 12acb | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.155805143Z | 62 | PC: 12acf | Close file (See above) |
| 2018-12-25T12:38:12.164195476Z | 67 | PC: 12adc | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.175460561Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T12:38:12.178665919Z | 67 | PC: 12a8e | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.185632667Z | 67 | PC: 12a9a | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.196633161Z | 61 | PC: 12aa0 | Open file (See above) |
| 2018-12-25T12:38:12.205025724Z | 87 | PC: 12aaa | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.207602429Z | 64 | PC: 12abd | Write file or device (See above) |
| 2018-12-25T12:38:12.21518456Z | 87 | PC: 12acb | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.217167125Z | 62 | PC: 12acf | Close file (See above) |
| 2018-12-25T12:38:12.226748388Z | 67 | PC: 12adc | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.238026896Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T12:38:12.241324238Z | 67 | PC: 12a8e | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.24874769Z | 67 | PC: 12a9a | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.259548355Z | 61 | PC: 12aa0 | Open file (See above) |
| 2018-12-25T12:38:12.270589742Z | 87 | PC: 12aaa | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.272486472Z | 64 | PC: 12abd | Write file or device (See above) |
| 2018-12-25T12:38:12.278769669Z | 87 | PC: 12acb | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.280286104Z | 62 | PC: 12acf | Close file (See above) |
| 2018-12-25T12:38:12.287488752Z | 67 | PC: 12adc | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.296947088Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T12:38:12.299283268Z | 42 | PC: 12a64 | Get date 0x12a64: cmp al, 2 0x12a66: je 0x12a73 0x12a68: mov ah, 9 0x12a6a: mov dx, 0x1de 0x12a6d: int 0x21 0x12a6f: mov ah, 0x4c 0x12a71: int 0x21 0x12a73: mov ah, 0x56 0x12a75: mov dx, 0x1fa 0x12a78: mov di, 0x1ed 0x12a7b: int 0x21 0x12a7d: mov ah, 9 0x12a7f: mov dx, 0x1b3 0x12a82: int 0x21 0x12a84: jmp 0x12a6f 0x12a86: mov dx, 0x9e 0x12a89: mov ax, 0x4300 0x12a8c: int 0x21 0x12a8e: mov word ptr [0x1a7], cx 0x12a92: nop |
| 2018-12-25T12:38:12.301416784Z | 86 | PC: 12a7d | Rename file |
| 2018-12-25T12:38:12.308248834Z | 9 | PC: 12a84 | Display string (String= ' Error reading drive C: BillMeTuesday! ') |
| 2018-12-25T12:38:12.317103833Z | 76 | PC: 12a73 | Terminate with return code (Return code = '36') |
{"DateBased":true,"Day":2,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":13429,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:38:11.751353071Z | 78 | PC: 12a4a | Find first file |
| 2018-12-25T12:38:11.757486855Z | 67 | PC: 12a8e | Get or set file attributes |
| 2018-12-25T12:38:11.762891323Z | 67 | PC: 12a9a | Get or set file attributes |
| 2018-12-25T12:38:12.036637391Z | 61 | PC: 12aa0 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T12:38:12.043889495Z | 87 | PC: 12aaa | Get or set file date and time |
| 2018-12-25T12:38:12.046385256Z | 64 | PC: 12abd | Write file or device (Write 263 bytes on handle 5) |
| 2018-12-25T12:38:12.053094319Z | 87 | PC: 12acb | Get or set file date and time |
| 2018-12-25T12:38:12.054583878Z | 62 | PC: 12acf | Close file |
| 2018-12-25T12:38:12.062533702Z | 67 | PC: 12adc | Get or set file attributes |
| 2018-12-25T12:38:12.073169994Z | 79 | PC: 12a59 | Find next file |
| 2018-12-25T12:38:12.075773574Z | 67 | PC: 12a8e | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.082179917Z | 67 | PC: 12a9a | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.094714754Z | 61 | PC: 12aa0 | Open file (See above) |
| 2018-12-25T12:38:12.101343035Z | 87 | PC: 12aaa | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.103778454Z | 64 | PC: 12abd | Write file or device (See above) |
| 2018-12-25T12:38:12.110304195Z | 87 | PC: 12acb | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.111884253Z | 62 | PC: 12acf | Close file (See above) |
| 2018-12-25T12:38:12.127898266Z | 67 | PC: 12adc | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.137783214Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T12:38:12.140366653Z | 67 | PC: 12a8e | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.147075061Z | 67 | PC: 12a9a | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.159661117Z | 61 | PC: 12aa0 | Open file (See above) |
| 2018-12-25T12:38:12.166202419Z | 87 | PC: 12aaa | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.167516065Z | 64 | PC: 12abd | Write file or device (See above) |
| 2018-12-25T12:38:12.174671549Z | 87 | PC: 12acb | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.176520788Z | 62 | PC: 12acf | Close file (See above) |
| 2018-12-25T12:38:12.184070912Z | 67 | PC: 12adc | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.194603898Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T12:38:12.197598317Z | 67 | PC: 12a8e | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.204073259Z | 67 | PC: 12a9a | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.217360016Z | 61 | PC: 12aa0 | Open file (See above) |
| 2018-12-25T12:38:12.229193749Z | 87 | PC: 12aaa | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.230859918Z | 64 | PC: 12abd | Write file or device (See above) |
| 2018-12-25T12:38:12.23841917Z | 87 | PC: 12acb | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.240199718Z | 62 | PC: 12acf | Close file (See above) |
| 2018-12-25T12:38:12.247732387Z | 67 | PC: 12adc | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.257990107Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T12:38:12.261003305Z | 67 | PC: 12a8e | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.266826465Z | 67 | PC: 12a9a | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.2945127Z | 61 | PC: 12aa0 | Open file (See above) |
| 2018-12-25T12:38:12.30651622Z | 87 | PC: 12aaa | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.308249963Z | 64 | PC: 12abd | Write file or device (See above) |
| 2018-12-25T12:38:12.315835378Z | 87 | PC: 12acb | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.317799862Z | 62 | PC: 12acf | Close file (See above) |
| 2018-12-25T12:38:12.32526591Z | 67 | PC: 12adc | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.335209616Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T12:38:12.338115203Z | 67 | PC: 12a8e | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.343612985Z | 67 | PC: 12a9a | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.353630641Z | 61 | PC: 12aa0 | Open file (See above) |
| 2018-12-25T12:38:12.365430684Z | 87 | PC: 12aaa | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.367772493Z | 64 | PC: 12abd | Write file or device (See above) |
| 2018-12-25T12:38:12.37514051Z | 87 | PC: 12acb | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.377622779Z | 62 | PC: 12acf | Close file (See above) |
| 2018-12-25T12:38:12.384984766Z | 67 | PC: 12adc | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.394895035Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T12:38:12.398352353Z | 67 | PC: 12a8e | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.404236306Z | 67 | PC: 12a9a | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.414047429Z | 61 | PC: 12aa0 | Open file (See above) |
| 2018-12-25T12:38:12.426184457Z | 87 | PC: 12aaa | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.427860167Z | 64 | PC: 12abd | Write file or device (See above) |
| 2018-12-25T12:38:12.435093715Z | 87 | PC: 12acb | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.43744845Z | 62 | PC: 12acf | Close file (See above) |
| 2018-12-25T12:38:12.444556545Z | 67 | PC: 12adc | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.460827889Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T12:38:12.464582624Z | 67 | PC: 12a8e | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.470805852Z | 67 | PC: 12a9a | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.480620035Z | 61 | PC: 12aa0 | Open file (See above) |
| 2018-12-25T12:38:12.492798427Z | 87 | PC: 12aaa | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.495867472Z | 64 | PC: 12abd | Write file or device (See above) |
| 2018-12-25T12:38:12.503011441Z | 87 | PC: 12acb | Get or set file date and time (See above) |
| 2018-12-25T12:38:12.505377417Z | 62 | PC: 12acf | Close file (See above) |
| 2018-12-25T12:38:12.512985414Z | 67 | PC: 12adc | Get or set file attributes (See above) |
| 2018-12-25T12:38:12.522979803Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T12:38:12.526516021Z | 42 | PC: 12a64 | Get date 0x12a64: cmp al, 2 0x12a66: je 0x12a73 0x12a68: mov ah, 9 0x12a6a: mov dx, 0x1de 0x12a6d: int 0x21 0x12a6f: mov ah, 0x4c 0x12a71: int 0x21 0x12a73: mov ah, 0x56 0x12a75: mov dx, 0x1fa 0x12a78: mov di, 0x1ed 0x12a7b: int 0x21 0x12a7d: mov ah, 9 0x12a7f: mov dx, 0x1b3 0x12a82: int 0x21 0x12a84: jmp 0x12a6f 0x12a86: mov dx, 0x9e 0x12a89: mov ax, 0x4300 0x12a8c: int 0x21 0x12a8e: mov word ptr [0x1a7], cx 0x12a92: nop |
| 2018-12-25T12:38:12.52872187Z | 9 | PC: 12a6f | Display string (String= 'EXEC Failure ') |
| 2018-12-25T12:38:12.533002742Z | 76 | PC: 12a73 | Terminate with return code (Return code = '36') |