.
Time | Syscall Op | Syscall Name |
---|---|---|
2018-12-17T23:08:01.337089097Z | 42 | PC: 12a4f | Get date 0x12a4f: cmp dx, 0x101 0x12a53: jne 0x12a62 0x12a55: mov ah, 9 0x12a57: mov dx, 0x282 0x12a5a: int 0x21 0x12a5c: mov ah, 1 0x12a5e: int 0x21 0x12a60: int 0x19 0x12a62: call 0x12a7c 0x12a65: jmp 0x12a8f 0x12a67: nop 0x12a68: add byte ptr [bx + si], al 0x12a6a: call 0x12a7c 0x12a6d: mov ah, 0x40 0x12a6f: mov cx, 0x1a2 0x12a72: lea dx, word ptr [bp + 0x103] 0x12a76: int 0x21 0x12a78: call 0x12a7c 0x12a7b: ret 0x12a7c: mov bx, word ptr ds:[bp + 0x128] |
2018-12-17T23:08:01.34142129Z | 26 | PC: 12aa0 | Set disk transfer address |
2018-12-17T23:08:01.343180497Z | 71 | PC: 12aa9 | Get current directory |
2018-12-17T23:08:01.346319587Z | 78 | PC: 12ab4 | Find first file |
2018-12-17T23:08:01.356984223Z | 67 | PC: 12ac5 | Get or set file attributes |
2018-12-17T23:08:01.375201396Z | 61 | PC: 12ad3 | Open file (Filename = 'SLEEP.COM') |
2018-12-17T23:08:01.382705501Z | 63 | PC: 12ae1 | Read file or device (Read 3 bytes on handle 5) |
2018-12-17T23:08:01.390015301Z | 66 | PC: 12af6 | Move file pointer |
2018-12-17T23:08:01.394589609Z | 44 | PC: 12b04 | Get time 0x12b04: add dl, dh 0x12b06: cmp bx, 0 0x12b09: je 0x12b00 0x12b0b: mov word ptr ds:[bp + 0x128], bx 0x12b10: call 0x22a6a 0x12b13: mov ax, 0x4200 0x12b16: mov cx, 0 0x12b19: mov dx, 0 0x12b1c: int 0x21 0x12b1e: jb 0x12b2b 0x12b20: mov ah, 0x40 0x12b22: mov cx, 3 0x12b25: lea dx, word ptr [bp + 0x27f] 0x12b29: int 0x21 0x12b2b: mov ax, 0x4301 0x12b2e: mov cx, word ptr ds:[bp + 0x2ba] 0x12b33: lea dx, word ptr [bp + 0x2c3] 0x12b37: int 0x21 0x12b39: mov ax, 0x5701 0x12b3c: mov cx, word ptr ds:[bp + 0x2bb] |
2018-12-17T23:08:01.397248828Z | 64 | PC: 12a78 | Write file or device (Write 418 bytes on handle 5) |
2018-12-17T23:08:01.407106417Z | 66 | PC: 12b1e | Move file pointer |
2018-12-17T23:08:01.409605203Z | 64 | PC: 12b2b | Write file or device (Write 3 bytes on handle 5) |
2018-12-17T23:08:01.416695241Z | 67 | PC: 12b39 | Get or set file attributes |
2018-12-17T23:08:01.421821507Z | 87 | PC: 12b48 | Get or set file date and time |
2018-12-17T23:08:01.425092175Z | 62 | PC: 12b4c | Close file |
2018-12-17T23:08:01.431635964Z | 79 | PC: 12ab4 | Find next file |
2018-12-17T23:08:01.434039933Z | 67 | PC: 12ac5 | Get or set file attributes |
2018-12-17T23:08:01.444045841Z | 61 | PC: 12ad3 | Open file (Filename = 'PRINT.COM') |
2018-12-17T23:08:01.451843117Z | 63 | PC: 12ae1 | Read file or device (Read 3 bytes on handle 5) |
2018-12-17T23:08:01.459261091Z | 66 | PC: 12af6 | Move file pointer |
2018-12-17T23:08:01.461933263Z | 44 | PC: 12b04 | Get time 0x12b04: add dl, dh 0x12b06: cmp bx, 0 0x12b09: je 0x12b00 0x12b0b: mov word ptr ds:[bp + 0x128], bx 0x12b10: call 0x22a6a 0x12b13: mov ax, 0x4200 0x12b16: mov cx, 0 0x12b19: mov dx, 0 0x12b1c: int 0x21 0x12b1e: jb 0x12b2b 0x12b20: mov ah, 0x40 0x12b22: mov cx, 3 0x12b25: lea dx, word ptr [bp + 0x27f] 0x12b29: int 0x21 0x12b2b: mov ax, 0x4301 0x12b2e: mov cx, word ptr ds:[bp + 0x2ba] 0x12b33: lea dx, word ptr [bp + 0x2c3] 0x12b37: int 0x21 0x12b39: mov ax, 0x5701 0x12b3c: mov cx, word ptr ds:[bp + 0x2bb] |
2018-12-17T23:08:01.464738085Z | 64 | PC: 12a78 | Write file or device (Write 418 bytes on handle 5) |
2018-12-17T23:08:01.468141152Z | 66 | PC: 12b1e | Move file pointer |
2018-12-17T23:08:01.470327161Z | 64 | PC: 12b2b | Write file or device (Write 3 bytes on handle 5) |
2018-12-17T23:08:01.474230118Z | 67 | PC: 12b39 | Get or set file attributes |
2018-12-17T23:08:01.482547591Z | 87 | PC: 12b48 | Get or set file date and time |
2018-12-17T23:08:01.484397348Z | 62 | PC: 12b4c | Close file |
2018-12-17T23:08:01.493139842Z | 79 | PC: 12ab4 | Find next file |
2018-12-17T23:08:01.496056283Z | 67 | PC: 12ac5 | Get or set file attributes |
2018-12-17T23:08:01.506487291Z | 61 | PC: 12ad3 | Open file (Filename = 'HELLO.COM') |
2018-12-17T23:08:01.514847294Z | 63 | PC: 12ae1 | Read file or device (Read 3 bytes on handle 5) |
2018-12-17T23:08:01.521864424Z | 66 | PC: 12af6 | Move file pointer |
2018-12-17T23:08:01.523575591Z | 44 | PC: 12b04 | Get time 0x12b04: add dl, dh 0x12b06: cmp bx, 0 0x12b09: je 0x12b00 0x12b0b: mov word ptr ds:[bp + 0x128], bx 0x12b10: call 0x22a6a 0x12b13: mov ax, 0x4200 0x12b16: mov cx, 0 0x12b19: mov dx, 0 0x12b1c: int 0x21 0x12b1e: jb 0x12b2b 0x12b20: mov ah, 0x40 0x12b22: mov cx, 3 0x12b25: lea dx, word ptr [bp + 0x27f] 0x12b29: int 0x21 0x12b2b: mov ax, 0x4301 0x12b2e: mov cx, word ptr ds:[bp + 0x2ba] 0x12b33: lea dx, word ptr [bp + 0x2c3] 0x12b37: int 0x21 0x12b39: mov ax, 0x5701 0x12b3c: mov cx, word ptr ds:[bp + 0x2bb] |
2018-12-17T23:08:01.527486873Z | 64 | PC: 12a78 | Write file or device (Write 418 bytes on handle 5) |
2018-12-17T23:08:01.530819446Z | 66 | PC: 12b1e | Move file pointer |
2018-12-17T23:08:01.532460662Z | 64 | PC: 12b2b | Write file or device (Write 3 bytes on handle 5) |
2018-12-17T23:08:01.536106304Z | 67 | PC: 12b39 | Get or set file attributes |
2018-12-17T23:08:01.541731178Z | 87 | PC: 12b48 | Get or set file date and time |
2018-12-17T23:08:01.543970006Z | 62 | PC: 12b4c | Close file |
2018-12-17T23:08:01.554264816Z | 79 | PC: 12ab4 | Find next file |
2018-12-17T23:08:01.557834837Z | 67 | PC: 12ac5 | Get or set file attributes |
2018-12-17T23:08:01.569098318Z | 61 | PC: 12ad3 | Open file (Filename = 'PHANG.COM') |
2018-12-17T23:08:01.578349338Z | 63 | PC: 12ae1 | Read file or device (Read 3 bytes on handle 5) |
2018-12-17T23:08:01.586293069Z | 66 | PC: 12af6 | Move file pointer |
2018-12-17T23:08:01.588417933Z | 44 | PC: 12b04 | Get time 0x12b04: add dl, dh 0x12b06: cmp bx, 0 0x12b09: je 0x12b00 0x12b0b: mov word ptr ds:[bp + 0x128], bx 0x12b10: call 0x22a6a 0x12b13: mov ax, 0x4200 0x12b16: mov cx, 0 0x12b19: mov dx, 0 0x12b1c: int 0x21 0x12b1e: jb 0x12b2b 0x12b20: mov ah, 0x40 0x12b22: mov cx, 3 0x12b25: lea dx, word ptr [bp + 0x27f] 0x12b29: int 0x21 0x12b2b: mov ax, 0x4301 0x12b2e: mov cx, word ptr ds:[bp + 0x2ba] 0x12b33: lea dx, word ptr [bp + 0x2c3] 0x12b37: int 0x21 0x12b39: mov ax, 0x5701 0x12b3c: mov cx, word ptr ds:[bp + 0x2bb] |
2018-12-17T23:08:01.591429284Z | 64 | PC: 12a78 | Write file or device (Write 418 bytes on handle 5) |
2018-12-17T23:08:01.595150057Z | 66 | PC: 12b1e | Move file pointer |
2018-12-17T23:08:01.596799958Z | 64 | PC: 12b2b | Write file or device (Write 3 bytes on handle 5) |
2018-12-17T23:08:01.600107816Z | 67 | PC: 12b39 | Get or set file attributes |
2018-12-17T23:08:01.606738079Z | 87 | PC: 12b48 | Get or set file date and time |
2018-12-17T23:08:01.609074781Z | 62 | PC: 12b4c | Close file |
2018-12-17T23:08:01.62254467Z | 79 | PC: 12ab4 | Find next file |
2018-12-17T23:08:01.626905578Z | 67 | PC: 12ac5 | Get or set file attributes |
2018-12-17T23:08:01.638080492Z | 61 | PC: 12ad3 | Open file (Filename = 'PRINTA~1.COM') |
2018-12-17T23:08:01.645476174Z | 63 | PC: 12ae1 | Read file or device (Read 3 bytes on handle 5) |
2018-12-17T23:08:01.653173783Z | 66 | PC: 12af6 | Move file pointer |
2018-12-17T23:08:01.655487492Z | 44 | PC: 12b04 | Get time 0x12b04: add dl, dh 0x12b06: cmp bx, 0 0x12b09: je 0x12b00 0x12b0b: mov word ptr ds:[bp + 0x128], bx 0x12b10: call 0x22a6a 0x12b13: mov ax, 0x4200 0x12b16: mov cx, 0 0x12b19: mov dx, 0 0x12b1c: int 0x21 0x12b1e: jb 0x12b2b 0x12b20: mov ah, 0x40 0x12b22: mov cx, 3 0x12b25: lea dx, word ptr [bp + 0x27f] 0x12b29: int 0x21 0x12b2b: mov ax, 0x4301 0x12b2e: mov cx, word ptr ds:[bp + 0x2ba] 0x12b33: lea dx, word ptr [bp + 0x2c3] 0x12b37: int 0x21 0x12b39: mov ax, 0x5701 0x12b3c: mov cx, word ptr ds:[bp + 0x2bb] |
2018-12-17T23:08:01.658266886Z | 64 | PC: 12a78 | Write file or device (Write 418 bytes on handle 5) |
2018-12-17T23:08:01.661778537Z | 66 | PC: 12b1e | Move file pointer |
2018-12-17T23:08:01.664444458Z | 64 | PC: 12b2b | Write file or device (Write 3 bytes on handle 5) |
2018-12-17T23:08:01.667598306Z | 67 | PC: 12b39 | Get or set file attributes |
2018-12-17T23:08:01.672905101Z | 87 | PC: 12b48 | Get or set file date and time |
2018-12-17T23:08:01.675534584Z | 62 | PC: 12b4c | Close file |
2018-12-17T23:08:01.683255116Z | 79 | PC: 12ab4 | Find next file |
2018-12-17T23:08:01.686990217Z | 67 | PC: 12ac5 | Get or set file attributes |
2018-12-17T23:08:01.698710898Z | 61 | PC: 12ad3 | Open file (Filename = 'MANDEL.COM') |
2018-12-17T23:08:01.706015508Z | 63 | PC: 12ae1 | Read file or device (Read 3 bytes on handle 5) |
2018-12-17T23:08:01.713018472Z | 66 | PC: 12af6 | Move file pointer |
2018-12-17T23:08:01.715698569Z | 44 | PC: 12b04 | Get time 0x12b04: add dl, dh 0x12b06: cmp bx, 0 0x12b09: je 0x12b00 0x12b0b: mov word ptr ds:[bp + 0x128], bx 0x12b10: call 0x22a6a 0x12b13: mov ax, 0x4200 0x12b16: mov cx, 0 0x12b19: mov dx, 0 0x12b1c: int 0x21 0x12b1e: jb 0x12b2b 0x12b20: mov ah, 0x40 0x12b22: mov cx, 3 0x12b25: lea dx, word ptr [bp + 0x27f] 0x12b29: int 0x21 0x12b2b: mov ax, 0x4301 0x12b2e: mov cx, word ptr ds:[bp + 0x2ba] 0x12b33: lea dx, word ptr [bp + 0x2c3] 0x12b37: int 0x21 0x12b39: mov ax, 0x5701 0x12b3c: mov cx, word ptr ds:[bp + 0x2bb] |
2018-12-17T23:08:01.718868537Z | 64 | PC: 12a78 | Write file or device (Write 418 bytes on handle 5) |
2018-12-17T23:08:01.727944788Z | 66 | PC: 12b1e | Move file pointer |
2018-12-17T23:08:01.730497527Z | 64 | PC: 12b2b | Write file or device (Write 3 bytes on handle 5) |
2018-12-17T23:08:01.738153958Z | 67 | PC: 12b39 | Get or set file attributes |
2018-12-17T23:08:01.74343797Z | 87 | PC: 12b48 | Get or set file date and time |
2018-12-17T23:08:01.745376193Z | 62 | PC: 12b4c | Close file |
2018-12-17T23:08:01.755489904Z | 79 | PC: 12ab4 | Find next file |
2018-12-17T23:08:01.758645656Z | 67 | PC: 12ac5 | Get or set file attributes |
2018-12-17T23:08:01.769214Z | 61 | PC: 12ad3 | Open file (Filename = 'PAH.COM') |
2018-12-17T23:08:01.77751315Z | 63 | PC: 12ae1 | Read file or device (Read 3 bytes on handle 5) |
2018-12-17T23:08:01.784602295Z | 66 | PC: 12af6 | Move file pointer |
2018-12-17T23:08:01.786417437Z | 44 | PC: 12b04 | Get time 0x12b04: add dl, dh 0x12b06: cmp bx, 0 0x12b09: je 0x12b00 0x12b0b: mov word ptr ds:[bp + 0x128], bx 0x12b10: call 0x22a6a 0x12b13: mov ax, 0x4200 0x12b16: mov cx, 0 0x12b19: mov dx, 0 0x12b1c: int 0x21 0x12b1e: jb 0x12b2b 0x12b20: mov ah, 0x40 0x12b22: mov cx, 3 0x12b25: lea dx, word ptr [bp + 0x27f] 0x12b29: int 0x21 0x12b2b: mov ax, 0x4301 0x12b2e: mov cx, word ptr ds:[bp + 0x2ba] 0x12b33: lea dx, word ptr [bp + 0x2c3] 0x12b37: int 0x21 0x12b39: mov ax, 0x5701 0x12b3c: mov cx, word ptr ds:[bp + 0x2bb] |
2018-12-17T23:08:01.790016602Z | 64 | PC: 12a78 | Write file or device (Write 418 bytes on handle 5) |
2018-12-17T23:08:01.793287972Z | 66 | PC: 12b1e | Move file pointer |
2018-12-17T23:08:01.795055484Z | 64 | PC: 12b2b | Write file or device (Write 3 bytes on handle 5) |
2018-12-17T23:08:01.798944044Z | 67 | PC: 12b39 | Get or set file attributes |
2018-12-17T23:08:01.804313897Z | 87 | PC: 12b48 | Get or set file date and time |
2018-12-17T23:08:01.806234417Z | 62 | PC: 12b4c | Close file |
2018-12-17T23:08:01.814467743Z | 79 | PC: 12ab4 | Find next file |
2018-12-17T23:08:01.818667878Z | 67 | PC: 12ac5 | Get or set file attributes |
2018-12-17T23:08:01.829594927Z | 61 | PC: 12ad3 | Open file (Filename = 'TEST.COM') |
2018-12-17T23:08:01.836613469Z | 63 | PC: 12ae1 | Read file or device (Read 3 bytes on handle 5) |
2018-12-17T23:08:01.840227102Z | 67 | PC: 12b39 | Get or set file attributes |
2018-12-17T23:08:01.845277475Z | 87 | PC: 12b48 | Get or set file date and time |
2018-12-17T23:08:01.847033356Z | 62 | PC: 12b4c | Close file |
2018-12-17T23:08:01.855047399Z | 79 | PC: 12ab4 | Find next file |
2018-12-17T23:08:01.858366137Z | 59 | PC: 12b64 | Change current directory |
2018-12-17T23:08:01.863029152Z | 59 | PC: 12b70 | Change current directory |
2018-12-17T23:08:01.873528648Z | 26 | PC: 12b58 | Set disk transfer address |
.
Time | Syscall Op | Syscall Name |
---|---|---|
2018-12-25T12:45:14.270711715Z | 42 | PC: 12a4f | Get date 0x12a4f: cmp dx, 0x101 0x12a53: jne 0x12a62 0x12a55: mov ah, 9 0x12a57: mov dx, 0x282 0x12a5a: int 0x21 0x12a5c: mov ah, 1 0x12a5e: int 0x21 0x12a60: int 0x19 0x12a62: call 0x12a7c 0x12a65: jmp 0x12a8f 0x12a67: nop 0x12a68: add byte ptr [bx + si], al 0x12a6a: call 0x12a7c 0x12a6d: mov ah, 0x40 0x12a6f: mov cx, 0x1a2 0x12a72: lea dx, word ptr [bp + 0x103] 0x12a76: int 0x21 0x12a78: call 0x12a7c 0x12a7b: ret 0x12a7c: mov bx, word ptr ds:[bp + 0x128] |
2018-12-25T12:45:14.273340241Z | 9 | PC: 12a5c | Display string (String= '[Gelf] Virus written by EXE-Gency!') |
2018-12-25T12:45:14.275749104Z | 1 | PC: 12a60 | Character input |
.
Time | Syscall Op | Syscall Name |
---|---|---|
2018-12-25T12:45:14.682340265Z | 42 | PC: 12a4f | Get date 0x12a4f: cmp dx, 0x101 0x12a53: jne 0x12a62 0x12a55: mov ah, 9 0x12a57: mov dx, 0x282 0x12a5a: int 0x21 0x12a5c: mov ah, 1 0x12a5e: int 0x21 0x12a60: int 0x19 0x12a62: call 0x12a7c 0x12a65: jmp 0x12a8f 0x12a67: nop 0x12a68: add byte ptr [bx + si], al 0x12a6a: call 0x12a7c 0x12a6d: mov ah, 0x40 0x12a6f: mov cx, 0x1a2 0x12a72: lea dx, word ptr [bp + 0x103] 0x12a76: int 0x21 0x12a78: call 0x12a7c 0x12a7b: ret 0x12a7c: mov bx, word ptr ds:[bp + 0x128] |
2018-12-25T12:45:14.685481584Z | 26 | PC: 12aa0 | Set disk transfer address |
2018-12-25T12:45:14.686879094Z | 71 | PC: 12aa9 | Get current directory |
2018-12-25T12:45:14.689816596Z | 78 | PC: 12ab4 | Find first file |
2018-12-25T12:45:14.695919034Z | 67 | PC: 12ac5 | Get or set file attributes |
2018-12-25T12:45:14.714010084Z | 61 | PC: 12ad3 | Open file (Filename = 'SLEEP.COM') |
2018-12-25T12:45:14.724839114Z | 63 | PC: 12ae1 | Read file or device (Read 3 bytes on handle 5) |
2018-12-25T12:45:14.731243978Z | 66 | PC: 12af6 | Move file pointer |
2018-12-25T12:45:14.733393237Z | 44 | PC: 12b04 | Get time 0x12b04: add dl, dh 0x12b06: cmp bx, 0 0x12b09: je 0x12b00 0x12b0b: mov word ptr ds:[bp + 0x128], bx 0x12b10: call 0x22a6a 0x12b13: mov ax, 0x4200 0x12b16: mov cx, 0 0x12b19: mov dx, 0 0x12b1c: int 0x21 0x12b1e: jb 0x12b2b 0x12b20: mov ah, 0x40 0x12b22: mov cx, 3 0x12b25: lea dx, word ptr [bp + 0x27f] 0x12b29: int 0x21 0x12b2b: mov ax, 0x4301 0x12b2e: mov cx, word ptr ds:[bp + 0x2ba] 0x12b33: lea dx, word ptr [bp + 0x2c3] 0x12b37: int 0x21 0x12b39: mov ax, 0x5701 0x12b3c: mov cx, word ptr ds:[bp + 0x2bb] |
2018-12-25T12:45:14.7362583Z | 64 | PC: 12a78 | Write file or device (Write 418 bytes on handle 5) |
2018-12-25T12:45:14.744066077Z | 66 | PC: 12b1e | Move file pointer |
2018-12-25T12:45:14.745972668Z | 64 | PC: 12b2b | Write file or device (Write 3 bytes on handle 5) |
2018-12-25T12:45:14.752221276Z | 67 | PC: 12b39 | Get or set file attributes |
2018-12-25T12:45:14.756695064Z | 87 | PC: 12b48 | Get or set file date and time |
2018-12-25T12:45:14.758851875Z | 62 | PC: 12b4c | Close file |
2018-12-25T12:45:14.766354434Z | 79 | PC: 12ab4 | Find next file (See above) |
2018-12-25T12:45:14.768913455Z | 67 | PC: 12ac5 | Get or set file attributes (See above) |
2018-12-25T12:45:14.779593804Z | 61 | PC: 12ad3 | Open file (See above) |
2018-12-25T12:45:14.78609715Z | 63 | PC: 12ae1 | Read file or device (See above) |
2018-12-25T12:45:14.792727951Z | 66 | PC: 12af6 | Move file pointer (See above) |
2018-12-25T12:45:14.795480154Z | 44 | PC: 12b04 | Get time (See above) |
2018-12-25T12:45:14.798191801Z | 64 | PC: 12a78 | Write file or device (See above) |
2018-12-25T12:45:14.8012019Z | 66 | PC: 12b1e | Move file pointer (See above) |
2018-12-25T12:45:14.803479439Z | 64 | PC: 12b2b | Write file or device (See above) |
2018-12-25T12:45:14.80630465Z | 67 | PC: 12b39 | Get or set file attributes (See above) |
2018-12-25T12:45:14.811197034Z | 87 | PC: 12b48 | Get or set file date and time (See above) |
2018-12-25T12:45:14.813731197Z | 62 | PC: 12b4c | Close file (See above) |
2018-12-25T12:45:14.831702736Z | 79 | PC: 12ab4 | Find next file (See above) |
2018-12-25T12:45:14.834380826Z | 67 | PC: 12ac5 | Get or set file attributes (See above) |
2018-12-25T12:45:14.845901656Z | 61 | PC: 12ad3 | Open file (See above) |
2018-12-25T12:45:14.852685358Z | 63 | PC: 12ae1 | Read file or device (See above) |
2018-12-25T12:45:14.859334035Z | 66 | PC: 12af6 | Move file pointer (See above) |
2018-12-25T12:45:14.860875588Z | 44 | PC: 12b04 | Get time (See above) |
2018-12-25T12:45:14.863758956Z | 64 | PC: 12a78 | Write file or device (See above) |
2018-12-25T12:45:14.866759812Z | 66 | PC: 12b1e | Move file pointer (See above) |
2018-12-25T12:45:14.868968357Z | 64 | PC: 12b2b | Write file or device (See above) |
2018-12-25T12:45:14.871885198Z | 67 | PC: 12b39 | Get or set file attributes (See above) |
2018-12-25T12:45:14.876449176Z | 87 | PC: 12b48 | Get or set file date and time (See above) |
2018-12-25T12:45:14.878026464Z | 62 | PC: 12b4c | Close file (See above) |
2018-12-25T12:45:14.885982425Z | 79 | PC: 12ab4 | Find next file (See above) |
2018-12-25T12:45:14.888496301Z | 67 | PC: 12ac5 | Get or set file attributes (See above) |
2018-12-25T12:45:14.898055081Z | 61 | PC: 12ad3 | Open file (See above) |
2018-12-25T12:45:14.904884476Z | 63 | PC: 12ae1 | Read file or device (See above) |
2018-12-25T12:45:14.911003204Z | 66 | PC: 12af6 | Move file pointer (See above) |
2018-12-25T12:45:14.912321952Z | 44 | PC: 12b04 | Get time (See above) |
2018-12-25T12:45:14.915170833Z | 64 | PC: 12a78 | Write file or device (See above) |
2018-12-25T12:45:14.917818154Z | 66 | PC: 12b1e | Move file pointer (See above) |
2018-12-25T12:45:14.919073121Z | 64 | PC: 12b2b | Write file or device (See above) |
2018-12-25T12:45:14.922813474Z | 67 | PC: 12b39 | Get or set file attributes (See above) |
2018-12-25T12:45:14.927954209Z | 87 | PC: 12b48 | Get or set file date and time (See above) |
2018-12-25T12:45:14.929400974Z | 62 | PC: 12b4c | Close file (See above) |
2018-12-25T12:45:14.937076742Z | 79 | PC: 12ab4 | Find next file (See above) |
2018-12-25T12:45:14.93954021Z | 67 | PC: 12ac5 | Get or set file attributes (See above) |
2018-12-25T12:45:14.94905777Z | 61 | PC: 12ad3 | Open file (See above) |
2018-12-25T12:45:14.955972768Z | 63 | PC: 12ae1 | Read file or device (See above) |
2018-12-25T12:45:14.962613092Z | 66 | PC: 12af6 | Move file pointer (See above) |
2018-12-25T12:45:14.963831391Z | 44 | PC: 12b04 | Get time (See above) |
2018-12-25T12:45:14.96658814Z | 64 | PC: 12a78 | Write file or device (See above) |
2018-12-25T12:45:14.969270161Z | 66 | PC: 12b1e | Move file pointer (See above) |
2018-12-25T12:45:14.970591378Z | 64 | PC: 12b2b | Write file or device (See above) |
2018-12-25T12:45:14.973584737Z | 67 | PC: 12b39 | Get or set file attributes (See above) |
2018-12-25T12:45:14.978018827Z | 87 | PC: 12b48 | Get or set file date and time (See above) |
2018-12-25T12:45:14.979619949Z | 62 | PC: 12b4c | Close file (See above) |
2018-12-25T12:45:14.987134162Z | 79 | PC: 12ab4 | Find next file (See above) |
2018-12-25T12:45:14.989576071Z | 67 | PC: 12ac5 | Get or set file attributes (See above) |
2018-12-25T12:45:15.002181071Z | 61 | PC: 12ad3 | Open file (See above) |
2018-12-25T12:45:15.009314483Z | 63 | PC: 12ae1 | Read file or device (See above) |
2018-12-25T12:45:15.015536184Z | 66 | PC: 12af6 | Move file pointer (See above) |
2018-12-25T12:45:15.01674608Z | 44 | PC: 12b04 | Get time (See above) |
2018-12-25T12:45:15.019304305Z | 64 | PC: 12a78 | Write file or device (See above) |
2018-12-25T12:45:15.027613394Z | 66 | PC: 12b1e | Move file pointer (See above) |
2018-12-25T12:45:15.028775091Z | 64 | PC: 12b2b | Write file or device (See above) |
2018-12-25T12:45:15.035722476Z | 67 | PC: 12b39 | Get or set file attributes (See above) |
2018-12-25T12:45:15.040222263Z | 87 | PC: 12b48 | Get or set file date and time (See above) |
2018-12-25T12:45:15.041655403Z | 62 | PC: 12b4c | Close file (See above) |
2018-12-25T12:45:15.04944905Z | 79 | PC: 12ab4 | Find next file (See above) |
2018-12-25T12:45:15.051135129Z | 67 | PC: 12ac5 | Get or set file attributes (See above) |
2018-12-25T12:45:15.057252351Z | 61 | PC: 12ad3 | Open file (See above) |
2018-12-25T12:45:15.061734117Z | 63 | PC: 12ae1 | Read file or device (See above) |
2018-12-25T12:45:15.065553954Z | 66 | PC: 12af6 | Move file pointer (See above) |
2018-12-25T12:45:15.066476567Z | 44 | PC: 12b04 | Get time (See above) |
2018-12-25T12:45:15.068442509Z | 64 | PC: 12a78 | Write file or device (See above) |
2018-12-25T12:45:15.070354149Z | 66 | PC: 12b1e | Move file pointer (See above) |
2018-12-25T12:45:15.071344454Z | 64 | PC: 12b2b | Write file or device (See above) |
2018-12-25T12:45:15.073691468Z | 67 | PC: 12b39 | Get or set file attributes (See above) |
2018-12-25T12:45:15.078137261Z | 87 | PC: 12b48 | Get or set file date and time (See above) |
2018-12-25T12:45:15.079315968Z | 62 | PC: 12b4c | Close file (See above) |
2018-12-25T12:45:15.086697337Z | 79 | PC: 12ab4 | Find next file (See above) |
2018-12-25T12:45:15.089120275Z | 67 | PC: 12ac5 | Get or set file attributes (See above) |
2018-12-25T12:45:15.098721635Z | 61 | PC: 12ad3 | Open file (See above) |
2018-12-25T12:45:15.110821155Z | 63 | PC: 12ae1 | Read file or device (See above) |
2018-12-25T12:45:15.117253615Z | 67 | PC: 12b39 | Get or set file attributes (See above) |
2018-12-25T12:45:15.122450574Z | 87 | PC: 12b48 | Get or set file date and time (See above) |
2018-12-25T12:45:15.124925941Z | 62 | PC: 12b4c | Close file (See above) |
2018-12-25T12:45:15.131903706Z | 79 | PC: 12ab4 | Find next file (See above) |
2018-12-25T12:45:15.134163508Z | 59 | PC: 12b64 | Change current directory |
2018-12-25T12:45:15.138329915Z | 59 | PC: 12b70 | Change current directory |
2018-12-25T12:45:15.142860235Z | 26 | PC: 12b58 | Set disk transfer address |
.
Time | Syscall Op | Syscall Name |
---|---|---|
2018-12-25T12:45:14.663575221Z | 42 | PC: 12a4f | Get date 0x12a4f: cmp dx, 0x101 0x12a53: jne 0x12a62 0x12a55: mov ah, 9 0x12a57: mov dx, 0x282 0x12a5a: int 0x21 0x12a5c: mov ah, 1 0x12a5e: int 0x21 0x12a60: int 0x19 0x12a62: call 0x12a7c 0x12a65: jmp 0x12a8f 0x12a67: nop 0x12a68: add byte ptr [bx + si], al 0x12a6a: call 0x12a7c 0x12a6d: mov ah, 0x40 0x12a6f: mov cx, 0x1a2 0x12a72: lea dx, word ptr [bp + 0x103] 0x12a76: int 0x21 0x12a78: call 0x12a7c 0x12a7b: ret 0x12a7c: mov bx, word ptr ds:[bp + 0x128] |
2018-12-25T12:45:14.666068151Z | 9 | PC: 12a5c | Display string (String= '[Gelf] Virus written by EXE-Gency!') |
2018-12-25T12:45:14.669285413Z | 1 | PC: 12a60 | Character input |
.
Time | Syscall Op | Syscall Name |
---|---|---|
2018-12-25T12:45:14.671087654Z | 42 | PC: 12a4f | Get date 0x12a4f: cmp dx, 0x101 0x12a53: jne 0x12a62 0x12a55: mov ah, 9 0x12a57: mov dx, 0x282 0x12a5a: int 0x21 0x12a5c: mov ah, 1 0x12a5e: int 0x21 0x12a60: int 0x19 0x12a62: call 0x12a7c 0x12a65: jmp 0x12a8f 0x12a67: nop 0x12a68: add byte ptr [bx + si], al 0x12a6a: call 0x12a7c 0x12a6d: mov ah, 0x40 0x12a6f: mov cx, 0x1a2 0x12a72: lea dx, word ptr [bp + 0x103] 0x12a76: int 0x21 0x12a78: call 0x12a7c 0x12a7b: ret 0x12a7c: mov bx, word ptr ds:[bp + 0x128] |
2018-12-25T12:45:14.67388078Z | 26 | PC: 12aa0 | Set disk transfer address |
2018-12-25T12:45:14.674989657Z | 71 | PC: 12aa9 | Get current directory |
2018-12-25T12:45:14.67793344Z | 78 | PC: 12ab4 | Find first file |
2018-12-25T12:45:14.684465298Z | 67 | PC: 12ac5 | Get or set file attributes |
2018-12-25T12:45:14.703014436Z | 61 | PC: 12ad3 | Open file (Filename = 'SLEEP.COM') |
2018-12-25T12:45:14.709824003Z | 63 | PC: 12ae1 | Read file or device (Read 3 bytes on handle 5) |
2018-12-25T12:45:14.716609882Z | 66 | PC: 12af6 | Move file pointer |
2018-12-25T12:45:14.717913874Z | 44 | PC: 12b04 | Get time 0x12b04: add dl, dh 0x12b06: cmp bx, 0 0x12b09: je 0x12b00 0x12b0b: mov word ptr ds:[bp + 0x128], bx 0x12b10: call 0x22a6a 0x12b13: mov ax, 0x4200 0x12b16: mov cx, 0 0x12b19: mov dx, 0 0x12b1c: int 0x21 0x12b1e: jb 0x12b2b 0x12b20: mov ah, 0x40 0x12b22: mov cx, 3 0x12b25: lea dx, word ptr [bp + 0x27f] 0x12b29: int 0x21 0x12b2b: mov ax, 0x4301 0x12b2e: mov cx, word ptr ds:[bp + 0x2ba] 0x12b33: lea dx, word ptr [bp + 0x2c3] 0x12b37: int 0x21 0x12b39: mov ax, 0x5701 0x12b3c: mov cx, word ptr ds:[bp + 0x2bb] |
2018-12-25T12:45:14.720074375Z | 64 | PC: 12a78 | Write file or device (Write 418 bytes on handle 5) |
2018-12-25T12:45:14.728799789Z | 66 | PC: 12b1e | Move file pointer |
2018-12-25T12:45:14.730045714Z | 64 | PC: 12b2b | Write file or device (Write 3 bytes on handle 5) |
2018-12-25T12:45:14.73636318Z | 67 | PC: 12b39 | Get or set file attributes |
2018-12-25T12:45:14.740994235Z | 87 | PC: 12b48 | Get or set file date and time |
2018-12-25T12:45:14.742805259Z | 62 | PC: 12b4c | Close file |
2018-12-25T12:45:14.750459408Z | 79 | PC: 12ab4 | Find next file (See above) |
2018-12-25T12:45:14.753094451Z | 67 | PC: 12ac5 | Get or set file attributes (See above) |
2018-12-25T12:45:14.762913201Z | 61 | PC: 12ad3 | Open file (See above) |
2018-12-25T12:45:14.769234337Z | 63 | PC: 12ae1 | Read file or device (See above) |
2018-12-25T12:45:14.775270023Z | 66 | PC: 12af6 | Move file pointer (See above) |
2018-12-25T12:45:14.777032955Z | 44 | PC: 12b04 | Get time (See above) |
2018-12-25T12:45:14.779095465Z | 64 | PC: 12a78 | Write file or device (See above) |
2018-12-25T12:45:14.78171806Z | 66 | PC: 12b1e | Move file pointer (See above) |
2018-12-25T12:45:14.78388931Z | 64 | PC: 12b2b | Write file or device (See above) |
2018-12-25T12:45:14.78703825Z | 67 | PC: 12b39 | Get or set file attributes (See above) |
2018-12-25T12:45:14.791556504Z | 87 | PC: 12b48 | Get or set file date and time (See above) |
2018-12-25T12:45:14.794017161Z | 62 | PC: 12b4c | Close file (See above) |
2018-12-25T12:45:14.801541264Z | 79 | PC: 12ab4 | Find next file (See above) |
2018-12-25T12:45:14.804020156Z | 67 | PC: 12ac5 | Get or set file attributes (See above) |
2018-12-25T12:45:14.813971076Z | 61 | PC: 12ad3 | Open file (See above) |
2018-12-25T12:45:14.820332972Z | 63 | PC: 12ae1 | Read file or device (See above) |
2018-12-25T12:45:14.826439369Z | 66 | PC: 12af6 | Move file pointer (See above) |
2018-12-25T12:45:14.828236469Z | 44 | PC: 12b04 | Get time (See above) |
2018-12-25T12:45:14.8310264Z | 64 | PC: 12a78 | Write file or device (See above) |
2018-12-25T12:45:14.833688465Z | 66 | PC: 12b1e | Move file pointer (See above) |
2018-12-25T12:45:14.835577439Z | 64 | PC: 12b2b | Write file or device (See above) |
2018-12-25T12:45:14.837983923Z | 67 | PC: 12b39 | Get or set file attributes (See above) |
2018-12-25T12:45:14.842432462Z | 87 | PC: 12b48 | Get or set file date and time (See above) |
2018-12-25T12:45:14.845508153Z | 62 | PC: 12b4c | Close file (See above) |
2018-12-25T12:45:14.854919843Z | 79 | PC: 12ab4 | Find next file (See above) |
2018-12-25T12:45:14.857726236Z | 67 | PC: 12ac5 | Get or set file attributes (See above) |
2018-12-25T12:45:14.867621531Z | 61 | PC: 12ad3 | Open file (See above) |
2018-12-25T12:45:14.874634238Z | 63 | PC: 12ae1 | Read file or device (See above) |
2018-12-25T12:45:14.881114812Z | 66 | PC: 12af6 | Move file pointer (See above) |
2018-12-25T12:45:14.882927223Z | 44 | PC: 12b04 | Get time (See above) |
2018-12-25T12:45:14.886002057Z | 64 | PC: 12a78 | Write file or device (See above) |
2018-12-25T12:45:14.888962669Z | 66 | PC: 12b1e | Move file pointer (See above) |
2018-12-25T12:45:14.890531109Z | 64 | PC: 12b2b | Write file or device (See above) |
2018-12-25T12:45:14.894346012Z | 67 | PC: 12b39 | Get or set file attributes (See above) |
2018-12-25T12:45:14.89901425Z | 87 | PC: 12b48 | Get or set file date and time (See above) |
2018-12-25T12:45:14.90074161Z | 62 | PC: 12b4c | Close file (See above) |
2018-12-25T12:45:14.909075029Z | 79 | PC: 12ab4 | Find next file (See above) |
2018-12-25T12:45:14.912094484Z | 67 | PC: 12ac5 | Get or set file attributes (See above) |
2018-12-25T12:45:14.922146035Z | 61 | PC: 12ad3 | Open file (See above) |
2018-12-25T12:45:14.929606298Z | 63 | PC: 12ae1 | Read file or device (See above) |
2018-12-25T12:45:14.935883536Z | 66 | PC: 12af6 | Move file pointer (See above) |
2018-12-25T12:45:14.937698947Z | 44 | PC: 12b04 | Get time (See above) |
2018-12-25T12:45:14.941193829Z | 64 | PC: 12a78 | Write file or device (See above) |
2018-12-25T12:45:14.943975629Z | 66 | PC: 12b1e | Move file pointer (See above) |
2018-12-25T12:45:14.945343888Z | 64 | PC: 12b2b | Write file or device (See above) |
2018-12-25T12:45:14.948645255Z | 67 | PC: 12b39 | Get or set file attributes (See above) |
2018-12-25T12:45:14.953267292Z | 87 | PC: 12b48 | Get or set file date and time (See above) |
2018-12-25T12:45:14.954618671Z | 62 | PC: 12b4c | Close file (See above) |
2018-12-25T12:45:14.961733531Z | 79 | PC: 12ab4 | Find next file (See above) |
2018-12-25T12:45:14.964678923Z | 67 | PC: 12ac5 | Get or set file attributes (See above) |
2018-12-25T12:45:14.974130658Z | 61 | PC: 12ad3 | Open file (See above) |
2018-12-25T12:45:14.985624724Z | 63 | PC: 12ae1 | Read file or device (See above) |
2018-12-25T12:45:14.992065068Z | 66 | PC: 12af6 | Move file pointer (See above) |
2018-12-25T12:45:14.993332824Z | 44 | PC: 12b04 | Get time (See above) |
2018-12-25T12:45:14.995450272Z | 64 | PC: 12a78 | Write file or device (See above) |
2018-12-25T12:45:15.004017984Z | 66 | PC: 12b1e | Move file pointer (See above) |
2018-12-25T12:45:15.005237757Z | 64 | PC: 12b2b | Write file or device (See above) |
2018-12-25T12:45:15.011594573Z | 67 | PC: 12b39 | Get or set file attributes (See above) |
2018-12-25T12:45:15.016711874Z | 87 | PC: 12b48 | Get or set file date and time (See above) |
2018-12-25T12:45:15.018059076Z | 62 | PC: 12b4c | Close file (See above) |
2018-12-25T12:45:15.025523167Z | 79 | PC: 12ab4 | Find next file (See above) |
2018-12-25T12:45:15.028875482Z | 67 | PC: 12ac5 | Get or set file attributes (See above) |
2018-12-25T12:45:15.03832948Z | 61 | PC: 12ad3 | Open file (See above) |
2018-12-25T12:45:15.04477677Z | 63 | PC: 12ae1 | Read file or device (See above) |
2018-12-25T12:45:15.052504434Z | 66 | PC: 12af6 | Move file pointer (See above) |
2018-12-25T12:45:15.054119681Z | 44 | PC: 12b04 | Get time (See above) |
2018-12-25T12:45:15.056605366Z | 64 | PC: 12a78 | Write file or device (See above) |
2018-12-25T12:45:15.060356715Z | 66 | PC: 12b1e | Move file pointer (See above) |
2018-12-25T12:45:15.062305017Z | 64 | PC: 12b2b | Write file or device (See above) |
2018-12-25T12:45:15.065062757Z | 67 | PC: 12b39 | Get or set file attributes (See above) |
2018-12-25T12:45:15.070683838Z | 87 | PC: 12b48 | Get or set file date and time (See above) |
2018-12-25T12:45:15.072362998Z | 62 | PC: 12b4c | Close file (See above) |
2018-12-25T12:45:15.079854614Z | 79 | PC: 12ab4 | Find next file (See above) |
2018-12-25T12:45:15.083134022Z | 67 | PC: 12ac5 | Get or set file attributes (See above) |
2018-12-25T12:45:15.092647707Z | 61 | PC: 12ad3 | Open file (See above) |
2018-12-25T12:45:15.099166042Z | 63 | PC: 12ae1 | Read file or device (See above) |
2018-12-25T12:45:15.1068424Z | 67 | PC: 12b39 | Get or set file attributes (See above) |
2018-12-25T12:45:15.116816554Z | 87 | PC: 12b48 | Get or set file date and time (See above) |
2018-12-25T12:45:15.118205274Z | 62 | PC: 12b4c | Close file (See above) |
2018-12-25T12:45:15.126009608Z | 79 | PC: 12ab4 | Find next file (See above) |
2018-12-25T12:45:15.128961209Z | 59 | PC: 12b64 | Change current directory |
2018-12-25T12:45:15.1331808Z | 59 | PC: 12b70 | Change current directory |
2018-12-25T12:45:15.137304587Z | 26 | PC: 12b58 | Set disk transfer address |