Sample viewer

vx.netlux.org/Virus.DOS.Slovakia.1956

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:05:39.664957309Z 44 PC: 13df3 | Get time 0x13df3: call 0x23a46
0x13df6: mov bx, dx
0x13df8: mov ax, 0x2c42
0x13dfb: mov cx, 0x15f7
0x13dfe: int 0x21
0x13e00: cmp dh, bh
0x13e02: jae 0x13e07
0x13e04: add dh, 0x3b
0x13e07: sub dh, bh
0x13e09: cmp dh, 2
0x13e0c: ja 0x13e11
0x13e0e: jmp 0x13a55
0x13e11: call 0x23c27
0x13e14: ret
0x13e15: cmp byte ptr [0x754], 3
0x13e1a: jb 0x13e14
0x13e1c: cmp byte ptr [0x7a2], 0xf
0x13e21: jbe 0x13e14
0x13e23: mov ah, 0x2a
0x13e25: call 0x23dd8
2018-12-17T23:05:39.668331222Z 44 PC: 13e00 | Get time 0x13e00: cmp dh, bh
0x13e02: jae 0x13e07
0x13e04: add dh, 0x3b
0x13e07: sub dh, bh
0x13e09: cmp dh, 2
0x13e0c: ja 0x13e11
0x13e0e: jmp 0x13a55
0x13e11: call 0x23c27
0x13e14: ret
0x13e15: cmp byte ptr [0x754], 3
0x13e1a: jb 0x13e14
0x13e1c: cmp byte ptr [0x7a2], 0xf
0x13e21: jbe 0x13e14
0x13e23: mov ah, 0x2a
0x13e25: call 0x23dd8
0x13e28: cmp cx, 0x7c8
0x13e2c: jb 0x13e14
0x13e2e: ja 0x13e35
0x13e30: cmp dh, 2
0x13e33: jb 0x13e14
2018-12-17T23:05:39.671276431Z 67 PC: 13dda | Get or set file attributes
2018-12-17T23:05:39.678481381Z 42 PC: 13dda | Get date 0x13dda: ret
0x13ddb: push dx
0x13ddc: push cx
0x13ddd: mov ah, 0x2c
0x13ddf: call 0x23dd8
0x13de2: mov ah, 0
0x13de4: mov al, dl
0x13de6: pop cx
0x13de7: pop dx
0x13de8: ret
0x13de9: xor cx, cx
0x13deb: mov dx, 0x36
0x13dee: mov ax, 0x2c21
0x13df1: int 0x21
0x13df3: call 0x23a46
0x13df6: mov bx, dx
0x13df8: mov ax, 0x2c42
0x13dfb: mov cx, 0x15f7
0x13dfe: int 0x21
0x13e00: cmp dh, bh
2018-12-17T23:05:39.681322599Z 48 PC: 13dda | Get DOS version
2018-12-17T23:05:39.68331967Z 37 PC: 13dda | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:05:39.684666129Z 47 PC: 13dda | Get disk transfer address
2018-12-17T23:05:39.686161115Z 26 PC: 13dda | Set disk transfer address
2018-12-17T23:05:39.688300917Z 71 PC: 13dda | Get current directory
2018-12-17T23:05:39.699114041Z 78 PC: 13dda | Find first file
2018-12-17T23:05:39.709466122Z 67 PC: 13dda | Get or set file attributes
2018-12-17T23:05:39.725041117Z 67 PC: 13dda | Get or set file attributes
2018-12-17T23:05:40.073159281Z 61 PC: 13dda | Open file (Filename = 'C:\DOS\ATTRIB.EXE')
2018-12-17T23:05:40.080946423Z 87 PC: 13dda | Get or set file date and time
2018-12-17T23:05:40.083112215Z 63 PC: 13dda | Read file or device (Read 24 bytes on handle 5)
2018-12-17T23:05:40.090065087Z 66 PC: 13dda | Move file pointer
2018-12-17T23:05:40.092068052Z 44 PC: 13dda | Get time 0x13dda: ret
0x13ddb: push dx
0x13ddc: push cx
0x13ddd: mov ah, 0x2c
0x13ddf: call 0x23dd8
0x13de2: mov ah, 0
0x13de4: mov al, dl
0x13de6: pop cx
0x13de7: pop dx
0x13de8: ret
0x13de9: xor cx, cx
0x13deb: mov dx, 0x36
0x13dee: mov ax, 0x2c21
0x13df1: int 0x21
0x13df3: call 0x23a46
0x13df6: mov bx, dx
0x13df8: mov ax, 0x2c42
0x13dfb: mov cx, 0x15f7
0x13dfe: int 0x21
0x13e00: cmp dh, bh
2018-12-17T23:05:40.095412862Z 64 PC: 13dda | Write file or device (Write 72 bytes on handle 5)
2018-12-17T23:05:40.103914257Z 44 PC: 13dda | Get time 0x13dda: ret
0x13ddb: push dx
0x13ddc: push cx
0x13ddd: mov ah, 0x2c
0x13ddf: call 0x23dd8
0x13de2: mov ah, 0
0x13de4: mov al, dl
0x13de6: pop cx
0x13de7: pop dx
0x13de8: ret
0x13de9: xor cx, cx
0x13deb: mov dx, 0x36
0x13dee: mov ax, 0x2c21
0x13df1: int 0x21
0x13df3: call 0x23a46
0x13df6: mov bx, dx
0x13df8: mov ax, 0x2c42
0x13dfb: mov cx, 0x15f7
0x13dfe: int 0x21
0x13e00: cmp dh, bh
2018-12-17T23:05:40.106683157Z 44 PC: 13dda | Get time 0x13dda: ret
0x13ddb: push dx
0x13ddc: push cx
0x13ddd: mov ah, 0x2c
0x13ddf: call 0x23dd8
0x13de2: mov ah, 0
0x13de4: mov al, dl
0x13de6: pop cx
0x13de7: pop dx
0x13de8: ret
0x13de9: xor cx, cx
0x13deb: mov dx, 0x36
0x13dee: mov ax, 0x2c21
0x13df1: int 0x21
0x13df3: call 0x23a46
0x13df6: mov bx, dx
0x13df8: mov ax, 0x2c42
0x13dfb: mov cx, 0x15f7
0x13dfe: int 0x21
0x13e00: cmp dh, bh
2018-12-17T23:05:40.11043984Z 44 PC: 13dda | Get time 0x13dda: ret
0x13ddb: push dx
0x13ddc: push cx
0x13ddd: mov ah, 0x2c
0x13ddf: call 0x23dd8
0x13de2: mov ah, 0
0x13de4: mov al, dl
0x13de6: pop cx
0x13de7: pop dx
0x13de8: ret
0x13de9: xor cx, cx
0x13deb: mov dx, 0x36
0x13dee: mov ax, 0x2c21
0x13df1: int 0x21
0x13df3: call 0x23a46
0x13df6: mov bx, dx
0x13df8: mov ax, 0x2c42
0x13dfb: mov cx, 0x15f7
0x13dfe: int 0x21
0x13e00: cmp dh, bh
2018-12-17T23:05:40.113292421Z 44 PC: 13dda | Get time 0x13dda: ret
0x13ddb: push dx
0x13ddc: push cx
0x13ddd: mov ah, 0x2c
0x13ddf: call 0x23dd8
0x13de2: mov ah, 0
0x13de4: mov al, dl
0x13de6: pop cx
0x13de7: pop dx
0x13de8: ret
0x13de9: xor cx, cx
0x13deb: mov dx, 0x36
0x13dee: mov ax, 0x2c21
0x13df1: int 0x21
0x13df3: call 0x23a46
0x13df6: mov bx, dx
0x13df8: mov ax, 0x2c42
0x13dfb: mov cx, 0x15f7
0x13dfe: int 0x21
0x13e00: cmp dh, bh
2018-12-17T23:05:40.116224988Z 64 PC: 13dda | Write file or device (Write 1981 bytes on handle 5)
2018-12-17T23:05:40.128806303Z 66 PC: 13dda | Move file pointer
2018-12-17T23:05:40.130826412Z 64 PC: 13dda | Write file or device (Write 24 bytes on handle 5)
2018-12-17T23:05:40.134754641Z 87 PC: 13dda | Get or set file date and time
2018-12-17T23:05:40.136335832Z 62 PC: 13dda | Close file
2018-12-17T23:05:40.145234437Z 67 PC: 13dda | Get or set file attributes
2018-12-17T23:05:40.157280164Z 26 PC: 13dda | Set disk transfer address
2018-12-17T23:05:40.159067601Z 37 PC: 13dda | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:05:40.161142118Z 42 PC: 13dda | Get date 0x13dda: ret
0x13ddb: push dx
0x13ddc: push cx
0x13ddd: mov ah, 0x2c
0x13ddf: call 0x23dd8
0x13de2: mov ah, 0
0x13de4: mov al, dl
0x13de6: pop cx
0x13de7: pop dx
0x13de8: ret
0x13de9: xor cx, cx
0x13deb: mov dx, 0x36
0x13dee: mov ax, 0x2c21
0x13df1: int 0x21
0x13df3: call 0x23a46
0x13df6: mov bx, dx
0x13df8: mov ax, 0x2c42
0x13dfb: mov cx, 0x15f7
0x13dfe: int 0x21
0x13e00: cmp dh, bh
2018-12-17T23:05:40.163742393Z 44 PC: 13dda | Get time 0x13dda: ret
0x13ddb: push dx
0x13ddc: push cx
0x13ddd: mov ah, 0x2c
0x13ddf: call 0x23dd8
0x13de2: mov ah, 0
0x13de4: mov al, dl
0x13de6: pop cx
0x13de7: pop dx
0x13de8: ret
0x13de9: xor cx, cx
0x13deb: mov dx, 0x36
0x13dee: mov ax, 0x2c21
0x13df1: int 0x21
0x13df3: call 0x23a46
0x13df6: mov bx, dx
0x13df8: mov ax, 0x2c42
0x13dfb: mov cx, 0x15f7
0x13dfe: int 0x21
0x13e00: cmp dh, bh
2018-12-17T23:05:40.166512011Z 76 PC: 139e4 | Terminate with return code (Return code = '2')

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":4,"TimeBased":true,"OriginalID":15285,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:43:06.978894641Z 44 PC: 13df3 | Get time 0x13df3: call 0x23a46
0x13df6: mov bx, dx
0x13df8: mov ax, 0x2c42
0x13dfb: mov cx, 0x15f7
0x13dfe: int 0x21
0x13e00: cmp dh, bh
0x13e02: jae 0x13e07
0x13e04: add dh, 0x3b
0x13e07: sub dh, bh
0x13e09: cmp dh, 2
0x13e0c: ja 0x13e11
0x13e0e: jmp 0x13a55
0x13e11: call 0x23c27
0x13e14: ret
0x13e15: cmp byte ptr [0x754], 3
0x13e1a: jb 0x13e14
0x13e1c: cmp byte ptr [0x7a2], 0xf
0x13e21: jbe 0x13e14
0x13e23: mov ah, 0x2a
0x13e25: call 0x23dd8
2018-12-25T12:43:06.985951399Z 44 PC: 13e00 | Get time 0x13e00: cmp dh, bh
0x13e02: jae 0x13e07
0x13e04: add dh, 0x3b
0x13e07: sub dh, bh
0x13e09: cmp dh, 2
0x13e0c: ja 0x13e11
0x13e0e: jmp 0x13a55
0x13e11: call 0x23c27
0x13e14: ret
0x13e15: cmp byte ptr [0x754], 3
0x13e1a: jb 0x13e14
0x13e1c: cmp byte ptr [0x7a2], 0xf
0x13e21: jbe 0x13e14
0x13e23: mov ah, 0x2a
0x13e25: call 0x23dd8
0x13e28: cmp cx, 0x7c8
0x13e2c: jb 0x13e14
0x13e2e: ja 0x13e35
0x13e30: cmp dh, 2
0x13e33: jb 0x13e14
2018-12-25T12:43:06.988994459Z 67 PC: 13dda | Get or set file attributes
2018-12-25T12:43:06.994593906Z 42 PC: 13dda | Get date (See above)
2018-12-25T12:43:06.99776941Z 48 PC: 13dda | Get DOS version (See above)
2018-12-25T12:43:06.999034572Z 37 PC: 13dda | Set interrupt vector (See above)
2018-12-25T12:43:07.00010446Z 47 PC: 13dda | Get disk transfer address (See above)
2018-12-25T12:43:07.001379656Z 26 PC: 13dda | Set disk transfer address (See above)
2018-12-25T12:43:07.002934977Z 71 PC: 13dda | Get current directory (See above)
2018-12-25T12:43:07.013442748Z 78 PC: 13dda | Find first file (See above)
2018-12-25T12:43:07.022340779Z 67 PC: 13dda | Get or set file attributes (See above)
2018-12-25T12:43:07.029080632Z 67 PC: 13dda | Get or set file attributes (See above)
2018-12-25T12:43:08.016028018Z 61 PC: 13dda | Open file (See above)
2018-12-25T12:43:08.021820346Z 87 PC: 13dda | Get or set file date and time (See above)
2018-12-25T12:43:08.023492932Z 63 PC: 13dda | Read file or device (See above)
2018-12-25T12:43:08.027491875Z 66 PC: 13dda | Move file pointer (See above)
2018-12-25T12:43:08.02863286Z 44 PC: 13dda | Get time (See above)
2018-12-25T12:43:08.030595936Z 64 PC: 13dda | Write file or device (See above)
2018-12-25T12:43:08.035044791Z 44 PC: 13dda | Get time (See above)
2018-12-25T12:43:08.037105498Z 44 PC: 13dda | Get time (See above)
2018-12-25T12:43:08.055724763Z 44 PC: 13dda | Get time (See above)
2018-12-25T12:43:08.058204612Z 44 PC: 13dda | Get time (See above)
2018-12-25T12:43:08.060768234Z 64 PC: 13dda | Write file or device (See above)
2018-12-25T12:43:08.082581151Z 66 PC: 13dda | Move file pointer (See above)
2018-12-25T12:43:08.084002095Z 64 PC: 13dda | Write file or device (See above)
2018-12-25T12:43:08.08676264Z 87 PC: 13dda | Get or set file date and time (See above)
2018-12-25T12:43:08.089291492Z 62 PC: 13dda | Close file (See above)
2018-12-25T12:43:08.096312307Z 67 PC: 13dda | Get or set file attributes (See above)
2018-12-25T12:43:08.106078008Z 26 PC: 13dda | Set disk transfer address (See above)
2018-12-25T12:43:08.108257063Z 37 PC: 13dda | Set interrupt vector (See above)
2018-12-25T12:43:08.109799859Z 42 PC: 13dda | Get date (See above)
2018-12-25T12:43:08.112415795Z 76 PC: 139e4 | Terminate with return code (Return code = '2')

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":15285,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:43:07.021098694Z 44 PC: 13df3 | Get time 0x13df3: call 0x23a46
0x13df6: mov bx, dx
0x13df8: mov ax, 0x2c42
0x13dfb: mov cx, 0x15f7
0x13dfe: int 0x21
0x13e00: cmp dh, bh
0x13e02: jae 0x13e07
0x13e04: add dh, 0x3b
0x13e07: sub dh, bh
0x13e09: cmp dh, 2
0x13e0c: ja 0x13e11
0x13e0e: jmp 0x13a55
0x13e11: call 0x23c27
0x13e14: ret
0x13e15: cmp byte ptr [0x754], 3
0x13e1a: jb 0x13e14
0x13e1c: cmp byte ptr [0x7a2], 0xf
0x13e21: jbe 0x13e14
0x13e23: mov ah, 0x2a
0x13e25: call 0x23dd8
2018-12-25T12:43:07.02403565Z 44 PC: 13e00 | Get time 0x13e00: cmp dh, bh
0x13e02: jae 0x13e07
0x13e04: add dh, 0x3b
0x13e07: sub dh, bh
0x13e09: cmp dh, 2
0x13e0c: ja 0x13e11
0x13e0e: jmp 0x13a55
0x13e11: call 0x23c27
0x13e14: ret
0x13e15: cmp byte ptr [0x754], 3
0x13e1a: jb 0x13e14
0x13e1c: cmp byte ptr [0x7a2], 0xf
0x13e21: jbe 0x13e14
0x13e23: mov ah, 0x2a
0x13e25: call 0x23dd8
0x13e28: cmp cx, 0x7c8
0x13e2c: jb 0x13e14
0x13e2e: ja 0x13e35
0x13e30: cmp dh, 2
0x13e33: jb 0x13e14
2018-12-25T12:43:07.026302038Z 67 PC: 13dda | Get or set file attributes
2018-12-25T12:43:07.031665851Z 42 PC: 13dda | Get date (See above)
2018-12-25T12:43:07.034593848Z 48 PC: 13dda | Get DOS version (See above)
2018-12-25T12:43:07.036685791Z 37 PC: 13dda | Set interrupt vector (See above)
2018-12-25T12:43:07.037636248Z 47 PC: 13dda | Get disk transfer address (See above)
2018-12-25T12:43:07.038768906Z 26 PC: 13dda | Set disk transfer address (See above)
2018-12-25T12:43:07.040277578Z 71 PC: 13dda | Get current directory (See above)
2018-12-25T12:43:07.042869036Z 78 PC: 13dda | Find first file (See above)
2018-12-25T12:43:07.051011383Z 67 PC: 13dda | Get or set file attributes (See above)
2018-12-25T12:43:07.055619397Z 67 PC: 13dda | Get or set file attributes (See above)
2018-12-25T12:43:08.016006614Z 61 PC: 13dda | Open file (See above)
2018-12-25T12:43:08.024541775Z 87 PC: 13dda | Get or set file date and time (See above)
2018-12-25T12:43:08.02743617Z 63 PC: 13dda | Read file or device (See above)
2018-12-25T12:43:08.034271236Z 66 PC: 13dda | Move file pointer (See above)
2018-12-25T12:43:08.036294464Z 44 PC: 13dda | Get time (See above)
2018-12-25T12:43:08.039862047Z 64 PC: 13dda | Write file or device (See above)
2018-12-25T12:43:08.047501268Z 44 PC: 13dda | Get time (See above)
2018-12-25T12:43:08.050530956Z 44 PC: 13dda | Get time (See above)
2018-12-25T12:43:08.053592573Z 44 PC: 13dda | Get time (See above)
2018-12-25T12:43:08.055759148Z 44 PC: 13dda | Get time (See above)
2018-12-25T12:43:08.058210277Z 64 PC: 13dda | Write file or device (See above)
2018-12-25T12:43:08.069161733Z 66 PC: 13dda | Move file pointer (See above)
2018-12-25T12:43:08.070497551Z 64 PC: 13dda | Write file or device (See above)
2018-12-25T12:43:08.073551325Z 87 PC: 13dda | Get or set file date and time (See above)
2018-12-25T12:43:08.075595077Z 62 PC: 13dda | Close file (See above)
2018-12-25T12:43:08.082552737Z 67 PC: 13dda | Get or set file attributes (See above)
2018-12-25T12:43:08.092999181Z 26 PC: 13dda | Set disk transfer address (See above)
2018-12-25T12:43:08.095256304Z 37 PC: 13dda | Set interrupt vector (See above)
2018-12-25T12:43:08.096888265Z 42 PC: 13dda | Get date (See above)
2018-12-25T12:43:08.099323101Z 76 PC: 139e4 | Terminate with return code (Return code = '2')

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":3,"TimeBased":true,"OriginalID":15285,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:43:07.333220582Z 44 PC: 13df3 | Get time 0x13df3: call 0x23a46
0x13df6: mov bx, dx
0x13df8: mov ax, 0x2c42
0x13dfb: mov cx, 0x15f7
0x13dfe: int 0x21
0x13e00: cmp dh, bh
0x13e02: jae 0x13e07
0x13e04: add dh, 0x3b
0x13e07: sub dh, bh
0x13e09: cmp dh, 2
0x13e0c: ja 0x13e11
0x13e0e: jmp 0x13a55
0x13e11: call 0x23c27
0x13e14: ret
0x13e15: cmp byte ptr [0x754], 3
0x13e1a: jb 0x13e14
0x13e1c: cmp byte ptr [0x7a2], 0xf
0x13e21: jbe 0x13e14
0x13e23: mov ah, 0x2a
0x13e25: call 0x23dd8
2018-12-25T12:43:07.336636706Z 44 PC: 13e00 | Get time 0x13e00: cmp dh, bh
0x13e02: jae 0x13e07
0x13e04: add dh, 0x3b
0x13e07: sub dh, bh
0x13e09: cmp dh, 2
0x13e0c: ja 0x13e11
0x13e0e: jmp 0x13a55
0x13e11: call 0x23c27
0x13e14: ret
0x13e15: cmp byte ptr [0x754], 3
0x13e1a: jb 0x13e14
0x13e1c: cmp byte ptr [0x7a2], 0xf
0x13e21: jbe 0x13e14
0x13e23: mov ah, 0x2a
0x13e25: call 0x23dd8
0x13e28: cmp cx, 0x7c8
0x13e2c: jb 0x13e14
0x13e2e: ja 0x13e35
0x13e30: cmp dh, 2
0x13e33: jb 0x13e14
2018-12-25T12:43:07.33873255Z 67 PC: 13dda | Get or set file attributes
2018-12-25T12:43:07.34393318Z 42 PC: 13dda | Get date (See above)
2018-12-25T12:43:07.347446815Z 48 PC: 13dda | Get DOS version (See above)
2018-12-25T12:43:07.348993536Z 37 PC: 13dda | Set interrupt vector (See above)
2018-12-25T12:43:07.350453782Z 47 PC: 13dda | Get disk transfer address (See above)
2018-12-25T12:43:07.352960664Z 26 PC: 13dda | Set disk transfer address (See above)
2018-12-25T12:43:07.354357024Z 71 PC: 13dda | Get current directory (See above)
2018-12-25T12:43:07.357634583Z 78 PC: 13dda | Find first file (See above)
2018-12-25T12:43:07.366694292Z 67 PC: 13dda | Get or set file attributes (See above)
2018-12-25T12:43:07.373222562Z 67 PC: 13dda | Get or set file attributes (See above)
2018-12-25T12:43:08.016679809Z 61 PC: 13dda | Open file (See above)
2018-12-25T12:43:08.032241749Z 87 PC: 13dda | Get or set file date and time (See above)
2018-12-25T12:43:08.036631992Z 63 PC: 13dda | Read file or device (See above)
2018-12-25T12:43:08.042251329Z 66 PC: 13dda | Move file pointer (See above)
2018-12-25T12:43:08.044231687Z 44 PC: 13dda | Get time (See above)
2018-12-25T12:43:08.047086242Z 64 PC: 13dda | Write file or device (See above)
2018-12-25T12:43:08.062156982Z 44 PC: 13dda | Get time (See above)
2018-12-25T12:43:08.065308088Z 44 PC: 13dda | Get time (See above)
2018-12-25T12:43:08.07171115Z 44 PC: 13dda | Get time (See above)
2018-12-25T12:43:08.080357311Z 44 PC: 13dda | Get time (See above)
2018-12-25T12:43:08.082442366Z 64 PC: 13dda | Write file or device (See above)
2018-12-25T12:43:08.099637336Z 66 PC: 13dda | Move file pointer (See above)
2018-12-25T12:43:08.107684703Z 64 PC: 13dda | Write file or device (See above)
2018-12-25T12:43:08.111625629Z 87 PC: 13dda | Get or set file date and time (See above)
2018-12-25T12:43:08.11475581Z 62 PC: 13dda | Close file (See above)
2018-12-25T12:43:08.13592471Z 67 PC: 13dda | Get or set file attributes (See above)
2018-12-25T12:43:08.146432544Z 26 PC: 13dda | Set disk transfer address (See above)
2018-12-25T12:43:08.14870224Z 37 PC: 13dda | Set interrupt vector (See above)
2018-12-25T12:43:08.15023122Z 42 PC: 13dda | Get date (See above)
2018-12-25T12:43:08.15318451Z 76 PC: 139e4 | Terminate with return code (Return code = '2')