.
Time | Syscall Op | Syscall Name |
---|---|---|
2018-12-17T23:07:51.591777154Z | 53 | PC: 12b3f | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
2018-12-17T23:07:51.593137601Z | 37 | PC: 12b51 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
2018-12-17T23:07:51.595209426Z | 71 | PC: 12b5c | Get current directory |
2018-12-17T23:07:51.598969458Z | 25 | PC: 12b61 | Get default drive |
2018-12-17T23:07:51.600120447Z | 26 | PC: 12b88 | Set disk transfer address |
2018-12-17T23:07:51.602100936Z | 42 | PC: 12b8c | Get date 0x12b8c: cmp dx, 0x202 0x12b90: jne 0x12b95 0x12b92: jmp 0x12d53 0x12b95: mov ah, 0x4e 0x12b97: lea dx, word ptr [si + 0x438] 0x12b9b: mov cx, 7 0x12b9e: int 0x21 0x12ba0: jae 0x12be6 0x12ba2: mov ah, 0x1a 0x12ba4: lea dx, word ptr [si + 0x518] 0x12ba8: int 0x21 0x12baa: mov ah, 0x3b 0x12bac: lea dx, word ptr [si + 0x442] 0x12bb0: int 0x21 0x12bb2: jb 0x12bb6 0x12bb4: jmp 0x12b80 0x12bb6: cmp byte ptr [si + 0x45d], 1 0x12bbb: je 0x12bd6 0x12bbd: mov al, 1 0x12bbf: mov byte ptr [si + 0x45d], al |
2018-12-17T23:07:51.604485905Z | 78 | PC: 12ba0 | Find first file |
2018-12-17T23:07:51.611358114Z | 67 | PC: 12bf9 | Get or set file attributes |
2018-12-17T23:07:51.628882005Z | 61 | PC: 12da1 | Open file (Filename = 'SLEEP.COM') |
2018-12-17T23:07:51.637654892Z | 63 | PC: 12c20 | Read file or device (Read 4 bytes on handle 5) |
2018-12-17T23:07:51.644819801Z | 66 | PC: 12d97 | Move file pointer |
2018-12-17T23:07:51.647093003Z | 44 | PC: 12c8b | Get time 0x12c8b: cmp dx, 0 0x12c8e: je 0x12c87 0x12c90: mov word ptr [si + 0x119], dx 0x12c94: mov cl, 8 0x12c96: ror dx, cl 0x12c98: mov word ptr [si + 0x45b], dx 0x12c9c: cmp dl, 0x1e 0x12c9f: jle 0x12ca4 0x12ca1: jmp 0x12cc3 0x12ca3: nop 0x12ca4: lea si, word ptr [bp + 0x143] 0x12ca8: lea di, word ptr [bp + 0x11b] 0x12cac: mov cx, 0x10 0x12caf: call 0x12d6a 0x12cb2: lea si, word ptr [bp + 0x153] 0x12cb6: lea di, word ptr [bp + 0x133] 0x12cba: mov cx, 6 0x12cbd: call 0x12d6a 0x12cc0: jmp 0x12cdf 0x12cc2: nop |
2018-12-17T23:07:51.649578568Z | 64 | PC: 12ad8 | Write file or device (Write 860 bytes on handle 5) |
2018-12-17T23:07:51.655424151Z | 66 | PC: 12d8d | Move file pointer |
2018-12-17T23:07:51.656897548Z | 64 | PC: 12d03 | Write file or device (Write 4 bytes on handle 5) |
2018-12-17T23:07:51.66445158Z | 87 | PC: 12d14 | Get or set file date and time |
2018-12-17T23:07:51.665940437Z | 62 | PC: 12d18 | Close file |
2018-12-17T23:07:51.674452105Z | 67 | PC: 12d27 | Get or set file attributes |
2018-12-17T23:07:51.685279694Z | 59 | PC: 12d2f | Change current directory |
2018-12-17T23:07:51.688130013Z | 26 | PC: 12d36 | Set disk transfer address |
2018-12-17T23:07:51.689264621Z | 37 | PC: 12d41 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
2018-12-17T23:07:51.691194585Z | 9 | PC: 12aa2 | Display string (String= 'This file is infected with the Marauder virus. 1992, Hellraiser Phalcon/Skism. ') |
.
Time | Syscall Op | Syscall Name |
---|---|---|
2018-12-25T12:45:04.013451605Z | 53 | PC: 12b3f | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
2018-12-25T12:45:04.014952579Z | 37 | PC: 12b51 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
2018-12-25T12:45:04.016142729Z | 71 | PC: 12b5c | Get current directory |
2018-12-25T12:45:04.019178029Z | 25 | PC: 12b61 | Get default drive |
2018-12-25T12:45:04.020796812Z | 26 | PC: 12b88 | Set disk transfer address |
2018-12-25T12:45:04.022151602Z | 42 | PC: 12b8c | Get date 0x12b8c: cmp dx, 0x202 0x12b90: jne 0x12b95 0x12b92: jmp 0x12d53 0x12b95: mov ah, 0x4e 0x12b97: lea dx, word ptr [si + 0x438] 0x12b9b: mov cx, 7 0x12b9e: int 0x21 0x12ba0: jae 0x12be6 0x12ba2: mov ah, 0x1a 0x12ba4: lea dx, word ptr [si + 0x518] 0x12ba8: int 0x21 0x12baa: mov ah, 0x3b 0x12bac: lea dx, word ptr [si + 0x442] 0x12bb0: int 0x21 0x12bb2: jb 0x12bb6 0x12bb4: jmp 0x12b80 0x12bb6: cmp byte ptr [si + 0x45d], 1 0x12bbb: je 0x12bd6 0x12bbd: mov al, 1 0x12bbf: mov byte ptr [si + 0x45d], al |
2018-12-25T12:45:04.024521444Z | 78 | PC: 12ba0 | Find first file |
2018-12-25T12:45:04.031120775Z | 67 | PC: 12bf9 | Get or set file attributes |
2018-12-25T12:45:04.82828021Z | 61 | PC: 12da1 | Open file (Filename = 'SLEEP.COM') |
2018-12-25T12:45:04.835774768Z | 63 | PC: 12c20 | Read file or device (Read 4 bytes on handle 5) |
2018-12-25T12:45:04.842885406Z | 66 | PC: 12d97 | Move file pointer |
2018-12-25T12:45:04.845430222Z | 44 | PC: 12c8b | Get time 0x12c8b: cmp dx, 0 0x12c8e: je 0x12c87 0x12c90: mov word ptr [si + 0x119], dx 0x12c94: mov cl, 8 0x12c96: ror dx, cl 0x12c98: mov word ptr [si + 0x45b], dx 0x12c9c: cmp dl, 0x1e 0x12c9f: jle 0x12ca4 0x12ca1: jmp 0x12cc3 0x12ca3: nop 0x12ca4: lea si, word ptr [bp + 0x143] 0x12ca8: lea di, word ptr [bp + 0x11b] 0x12cac: mov cx, 0x10 0x12caf: call 0x12d6a 0x12cb2: lea si, word ptr [bp + 0x153] 0x12cb6: lea di, word ptr [bp + 0x133] 0x12cba: mov cx, 6 0x12cbd: call 0x12d6a 0x12cc0: jmp 0x12cdf 0x12cc2: nop |
2018-12-25T12:45:04.848217888Z | 64 | PC: 12ad8 | Write file or device (Write 860 bytes on handle 5) |
2018-12-25T12:45:04.858332361Z | 66 | PC: 12d8d | Move file pointer |
2018-12-25T12:45:04.860185239Z | 64 | PC: 12d03 | Write file or device (Write 4 bytes on handle 5) |
2018-12-25T12:45:04.86460816Z | 87 | PC: 12d14 | Get or set file date and time |
2018-12-25T12:45:04.865733181Z | 62 | PC: 12d18 | Close file |
2018-12-25T12:45:04.876646906Z | 67 | PC: 12d27 | Get or set file attributes |
2018-12-25T12:45:04.887963129Z | 59 | PC: 12d2f | Change current directory |
2018-12-25T12:45:04.892790097Z | 26 | PC: 12d36 | Set disk transfer address |
2018-12-25T12:45:04.894411981Z | 37 | PC: 12d41 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
2018-12-25T12:45:04.897108693Z | 9 | PC: 12aa2 | Display string (String= 'This file is infected with the Marauder virus. 1992, Hellraiser Phalcon/Skism. ') |
.
Time | Syscall Op | Syscall Name |
---|---|---|
2018-12-25T12:45:04.199699661Z | 53 | PC: 12b3f | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
2018-12-25T12:45:04.210540793Z | 37 | PC: 12b51 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
2018-12-25T12:45:04.211752941Z | 71 | PC: 12b5c | Get current directory |
2018-12-25T12:45:04.214572455Z | 25 | PC: 12b61 | Get default drive |
2018-12-25T12:45:04.215587962Z | 26 | PC: 12b88 | Set disk transfer address |
2018-12-25T12:45:04.217173523Z | 42 | PC: 12b8c | Get date 0x12b8c: cmp dx, 0x202 0x12b90: jne 0x12b95 0x12b92: jmp 0x12d53 0x12b95: mov ah, 0x4e 0x12b97: lea dx, word ptr [si + 0x438] 0x12b9b: mov cx, 7 0x12b9e: int 0x21 0x12ba0: jae 0x12be6 0x12ba2: mov ah, 0x1a 0x12ba4: lea dx, word ptr [si + 0x518] 0x12ba8: int 0x21 0x12baa: mov ah, 0x3b 0x12bac: lea dx, word ptr [si + 0x442] 0x12bb0: int 0x21 0x12bb2: jb 0x12bb6 0x12bb4: jmp 0x12b80 0x12bb6: cmp byte ptr [si + 0x45d], 1 0x12bbb: je 0x12bd6 0x12bbd: mov al, 1 0x12bbf: mov byte ptr [si + 0x45d], al |
2018-12-25T12:45:04.219202873Z | 78 | PC: 12ba0 | Find first file |
2018-12-25T12:45:04.225110513Z | 67 | PC: 12bf9 | Get or set file attributes |
2018-12-25T12:45:04.242999348Z | 61 | PC: 12da1 | Open file (Filename = 'SLEEP.COM') |
2018-12-25T12:45:04.249554203Z | 63 | PC: 12c20 | Read file or device (Read 4 bytes on handle 5) |
2018-12-25T12:45:04.256236787Z | 66 | PC: 12d97 | Move file pointer |
2018-12-25T12:45:04.25845393Z | 44 | PC: 12c8b | Get time 0x12c8b: cmp dx, 0 0x12c8e: je 0x12c87 0x12c90: mov word ptr [si + 0x119], dx 0x12c94: mov cl, 8 0x12c96: ror dx, cl 0x12c98: mov word ptr [si + 0x45b], dx 0x12c9c: cmp dl, 0x1e 0x12c9f: jle 0x12ca4 0x12ca1: jmp 0x12cc3 0x12ca3: nop 0x12ca4: lea si, word ptr [bp + 0x143] 0x12ca8: lea di, word ptr [bp + 0x11b] 0x12cac: mov cx, 0x10 0x12caf: call 0x12d6a 0x12cb2: lea si, word ptr [bp + 0x153] 0x12cb6: lea di, word ptr [bp + 0x133] 0x12cba: mov cx, 6 0x12cbd: call 0x12d6a 0x12cc0: jmp 0x12cdf 0x12cc2: nop |
2018-12-25T12:45:04.261010441Z | 64 | PC: 12ad8 | Write file or device (Write 860 bytes on handle 5) |
2018-12-25T12:45:04.269568447Z | 66 | PC: 12d8d | Move file pointer |
2018-12-25T12:45:04.272019724Z | 64 | PC: 12d03 | Write file or device (Write 4 bytes on handle 5) |
2018-12-25T12:45:04.289944795Z | 87 | PC: 12d14 | Get or set file date and time |
2018-12-25T12:45:04.291658465Z | 62 | PC: 12d18 | Close file |
2018-12-25T12:45:04.300968823Z | 67 | PC: 12d27 | Get or set file attributes |
2018-12-25T12:45:04.311079416Z | 59 | PC: 12d2f | Change current directory |
2018-12-25T12:45:04.31496879Z | 26 | PC: 12d36 | Set disk transfer address |
2018-12-25T12:45:04.316031854Z | 37 | PC: 12d41 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
2018-12-25T12:45:04.317806522Z | 9 | PC: 12aa2 | Display string (String= 'This file is infected with the Marauder virus. 1992, Hellraiser Phalcon/Skism. ') |
.
Time | Syscall Op | Syscall Name |
---|---|---|
2018-12-25T12:45:04.367939598Z | 53 | PC: 12b3f | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
2018-12-25T12:45:04.369484402Z | 37 | PC: 12b51 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
2018-12-25T12:45:04.37062987Z | 71 | PC: 12b5c | Get current directory |
2018-12-25T12:45:04.374784304Z | 25 | PC: 12b61 | Get default drive |
2018-12-25T12:45:04.376353776Z | 26 | PC: 12b88 | Set disk transfer address |
2018-12-25T12:45:04.37745996Z | 42 | PC: 12b8c | Get date 0x12b8c: cmp dx, 0x202 0x12b90: jne 0x12b95 0x12b92: jmp 0x12d53 0x12b95: mov ah, 0x4e 0x12b97: lea dx, word ptr [si + 0x438] 0x12b9b: mov cx, 7 0x12b9e: int 0x21 0x12ba0: jae 0x12be6 0x12ba2: mov ah, 0x1a 0x12ba4: lea dx, word ptr [si + 0x518] 0x12ba8: int 0x21 0x12baa: mov ah, 0x3b 0x12bac: lea dx, word ptr [si + 0x442] 0x12bb0: int 0x21 0x12bb2: jb 0x12bb6 0x12bb4: jmp 0x12b80 0x12bb6: cmp byte ptr [si + 0x45d], 1 0x12bbb: je 0x12bd6 0x12bbd: mov al, 1 0x12bbf: mov byte ptr [si + 0x45d], al |
2018-12-25T12:45:04.37962805Z | 78 | PC: 12ba0 | Find first file |
2018-12-25T12:45:04.386374828Z | 67 | PC: 12bf9 | Get or set file attributes |
2018-12-25T12:45:04.401354544Z | 61 | PC: 12da1 | Open file (Filename = 'SLEEP.COM') |
2018-12-25T12:45:04.407824397Z | 63 | PC: 12c20 | Read file or device (Read 4 bytes on handle 5) |
2018-12-25T12:45:04.414004179Z | 66 | PC: 12d97 | Move file pointer |
2018-12-25T12:45:04.416118137Z | 44 | PC: 12c8b | Get time 0x12c8b: cmp dx, 0 0x12c8e: je 0x12c87 0x12c90: mov word ptr [si + 0x119], dx 0x12c94: mov cl, 8 0x12c96: ror dx, cl 0x12c98: mov word ptr [si + 0x45b], dx 0x12c9c: cmp dl, 0x1e 0x12c9f: jle 0x12ca4 0x12ca1: jmp 0x12cc3 0x12ca3: nop 0x12ca4: lea si, word ptr [bp + 0x143] 0x12ca8: lea di, word ptr [bp + 0x11b] 0x12cac: mov cx, 0x10 0x12caf: call 0x12d6a 0x12cb2: lea si, word ptr [bp + 0x153] 0x12cb6: lea di, word ptr [bp + 0x133] 0x12cba: mov cx, 6 0x12cbd: call 0x12d6a 0x12cc0: jmp 0x12cdf 0x12cc2: nop |
2018-12-25T12:45:04.418514371Z | 64 | PC: 12ad8 | Write file or device (Write 860 bytes on handle 5) |
2018-12-25T12:45:04.427514127Z | 66 | PC: 12d8d | Move file pointer |
2018-12-25T12:45:04.429304925Z | 64 | PC: 12d03 | Write file or device (Write 4 bytes on handle 5) |
2018-12-25T12:45:04.435962956Z | 87 | PC: 12d14 | Get or set file date and time |
2018-12-25T12:45:04.438540728Z | 62 | PC: 12d18 | Close file |
2018-12-25T12:45:04.446937762Z | 67 | PC: 12d27 | Get or set file attributes |
2018-12-25T12:45:04.456711304Z | 59 | PC: 12d2f | Change current directory |
2018-12-25T12:45:04.460644281Z | 26 | PC: 12d36 | Set disk transfer address |
2018-12-25T12:45:04.463236163Z | 37 | PC: 12d41 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
2018-12-25T12:45:04.464720442Z | 9 | PC: 12aa2 | Display string (String= 'This file is infected with the Marauder virus. 1992, Hellraiser Phalcon/Skism. ') |
.
Time | Syscall Op | Syscall Name |
---|---|---|
2018-12-25T12:45:05.337774699Z | 53 | PC: 12b3f | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
2018-12-25T12:45:05.338876427Z | 37 | PC: 12b51 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
2018-12-25T12:45:05.339989501Z | 71 | PC: 12b5c | Get current directory |
2018-12-25T12:45:05.341897364Z | 25 | PC: 12b61 | Get default drive |
2018-12-25T12:45:05.342761449Z | 26 | PC: 12b88 | Set disk transfer address |
2018-12-25T12:45:05.343681743Z | 42 | PC: 12b8c | Get date 0x12b8c: cmp dx, 0x202 0x12b90: jne 0x12b95 0x12b92: jmp 0x12d53 0x12b95: mov ah, 0x4e 0x12b97: lea dx, word ptr [si + 0x438] 0x12b9b: mov cx, 7 0x12b9e: int 0x21 0x12ba0: jae 0x12be6 0x12ba2: mov ah, 0x1a 0x12ba4: lea dx, word ptr [si + 0x518] 0x12ba8: int 0x21 0x12baa: mov ah, 0x3b 0x12bac: lea dx, word ptr [si + 0x442] 0x12bb0: int 0x21 0x12bb2: jb 0x12bb6 0x12bb4: jmp 0x12b80 0x12bb6: cmp byte ptr [si + 0x45d], 1 0x12bbb: je 0x12bd6 0x12bbd: mov al, 1 0x12bbf: mov byte ptr [si + 0x45d], al |
2018-12-25T12:45:05.345237465Z | 78 | PC: 12ba0 | Find first file |
2018-12-25T12:45:05.349155888Z | 67 | PC: 12bf9 | Get or set file attributes |
2018-12-25T12:45:05.364556787Z | 61 | PC: 12da1 | Open file (Filename = 'SLEEP.COM') |
2018-12-25T12:45:05.371507849Z | 63 | PC: 12c20 | Read file or device (Read 4 bytes on handle 5) |
2018-12-25T12:45:05.378314303Z | 66 | PC: 12d97 | Move file pointer |
2018-12-25T12:45:05.382015528Z | 44 | PC: 12c8b | Get time 0x12c8b: cmp dx, 0 0x12c8e: je 0x12c87 0x12c90: mov word ptr [si + 0x119], dx 0x12c94: mov cl, 8 0x12c96: ror dx, cl 0x12c98: mov word ptr [si + 0x45b], dx 0x12c9c: cmp dl, 0x1e 0x12c9f: jle 0x12ca4 0x12ca1: jmp 0x12cc3 0x12ca3: nop 0x12ca4: lea si, word ptr [bp + 0x143] 0x12ca8: lea di, word ptr [bp + 0x11b] 0x12cac: mov cx, 0x10 0x12caf: call 0x12d6a 0x12cb2: lea si, word ptr [bp + 0x153] 0x12cb6: lea di, word ptr [bp + 0x133] 0x12cba: mov cx, 6 0x12cbd: call 0x12d6a 0x12cc0: jmp 0x12cdf 0x12cc2: nop |
2018-12-25T12:45:05.384725654Z | 64 | PC: 12ad8 | Write file or device (Write 860 bytes on handle 5) |
2018-12-25T12:45:05.394738934Z | 66 | PC: 12d8d | Move file pointer |
2018-12-25T12:45:05.396458421Z | 64 | PC: 12d03 | Write file or device (Write 4 bytes on handle 5) |
2018-12-25T12:45:05.40361675Z | 87 | PC: 12d14 | Get or set file date and time |
2018-12-25T12:45:05.405053326Z | 62 | PC: 12d18 | Close file |
2018-12-25T12:45:05.413879415Z | 67 | PC: 12d27 | Get or set file attributes |
2018-12-25T12:45:05.424895275Z | 59 | PC: 12d2f | Change current directory |
2018-12-25T12:45:05.429642565Z | 26 | PC: 12d36 | Set disk transfer address |
2018-12-25T12:45:05.432246917Z | 37 | PC: 12d41 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
2018-12-25T12:45:05.433504425Z | 9 | PC: 12aa2 | Display string (String= 'This file is infected with the Marauder virus. 1992, Hellraiser Phalcon/Skism. ') |