{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":16619,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:53:33.808502372Z | 48 | PC: 12a98 | Get DOS version |
| 2018-12-25T12:53:33.810290475Z | 54 | PC: 12aa6 | Get free disk space |
| 2018-12-25T12:53:33.820029188Z | 42 | PC: 12ab2 | Get date 0x12ab2: cmp cx, 0x7ca 0x12ab6: jae 0x12abb 0x12ab8: jmp 0x12b4c 0x12abb: push cs 0x12abc: pop ds 0x12abd: mov ah, 9 0x12abf: lea dx, word ptr [bp + 0x274] 0x12ac3: int 0x21 0x12ac5: mov ah, 0x1a 0x12ac7: mov dx, 0xfd00 0x12aca: int 0x21 0x12acc: mov ax, word ptr cs:[0x2c] 0x12ad0: mov ds, ax 0x12ad2: mov si, 0 0x12ad5: mov cx, 0x4000 0x12ad8: lodsb al, byte ptr [si] 0x12ad9: cmp al, 1 0x12adb: je 0x12adf 0x12add: loop 0x12ad8 0x12adf: inc si |
| 2018-12-25T12:53:33.822284154Z | 26 | PC: 12b53 | Set disk transfer address |
| 2018-12-25T12:53:33.823984971Z | 78 | PC: 12b5d | Find first file |
| 2018-12-25T12:53:33.830678908Z | 67 | PC: 12b6a | Get or set file attributes |
| 2018-12-25T12:53:33.836820576Z | 67 | PC: 12b72 | Get or set file attributes |
| 2018-12-25T12:53:33.854007365Z | 61 | PC: 12b77 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T12:53:33.862258374Z | 87 | PC: 12b7d | Get or set file date and time |
| 2018-12-25T12:53:33.863924845Z | 63 | PC: 12b8a | Read file or device (Read 4 bytes on handle 5) |
| 2018-12-25T12:53:33.872673977Z | 66 | PC: 12bb0 | Move file pointer |
| 2018-12-25T12:53:33.875575951Z | 66 | PC: 12bd1 | Move file pointer |
| 2018-12-25T12:53:33.877007263Z | 63 | PC: 12bdb | Read file or device (Read 52 bytes on handle 5) |
| 2018-12-25T12:53:33.879653668Z | 66 | PC: 12bb0 | Move file pointer (See above) |
| 2018-12-25T12:53:33.882093729Z | 44 | PC: 12c28 | Get time 0x12c28: cmp dl, 0 0x12c2b: jne 0x12c37 0x12c2d: mov ah, 9 0x12c2f: lea dx, word ptr [bp + 0x3cd] 0x12c33: int 0x21 0x12c35: jmp 0x12c24 0x12c37: mov byte ptr cs:[bp + 0x17], dl 0x12c3b: lea si, word ptr [bp + 4] 0x12c3e: mov di, 0xfb00 0x12c41: mov cx, 0x17 0x12c44: rep movsb byte ptr es:[di], byte ptr [si] 0x12c46: lea si, word ptr [bp + 0x1b] 0x12c49: mov cx, 0x413 0x12c4c: lodsb al, byte ptr [si] 0x12c4d: xor al, dl 0x12c4f: stosb byte ptr es:[di], al 0x12c50: loop 0x12c4c 0x12c52: mov ah, 0x40 0x12c54: mov dx, 0xfb00 0x12c57: mov cx, 0x42a |
| 2018-12-25T12:53:33.884287772Z | 64 | PC: 12c5c | Write file or device (Write 1066 bytes on handle 5) |
| 2018-12-25T12:53:33.890624165Z | 66 | PC: 12bb0 | Move file pointer (See above) |
| 2018-12-25T12:53:33.892527841Z | 64 | PC: 12c6d | Write file or device (Write 4 bytes on handle 5) |
| 2018-12-25T12:53:33.899578393Z | 87 | PC: 12c9d | Get or set file date and time |
| 2018-12-25T12:53:33.90105586Z | 62 | PC: 12ca1 | Close file |
| 2018-12-25T12:53:33.91109363Z | 67 | PC: 12caa | Get or set file attributes |
| 2018-12-25T12:53:33.917038265Z | 65 | PC: 12cb2 | Delete file (Filename = 'chklist.cps') |
| 2018-12-25T12:53:33.923309517Z | 26 | PC: 12c77 | Set disk transfer address |
{"DateBased":true,"Day":1,"Month":1,"Year":1995,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":16619,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:53:33.887761321Z | 48 | PC: 12a98 | Get DOS version |
| 2018-12-25T12:53:33.889022555Z | 54 | PC: 12aa6 | Get free disk space |
| 2018-12-25T12:53:33.899294214Z | 42 | PC: 12ab2 | Get date 0x12ab2: cmp cx, 0x7ca 0x12ab6: jae 0x12abb 0x12ab8: jmp 0x12b4c 0x12abb: push cs 0x12abc: pop ds 0x12abd: mov ah, 9 0x12abf: lea dx, word ptr [bp + 0x274] 0x12ac3: int 0x21 0x12ac5: mov ah, 0x1a 0x12ac7: mov dx, 0xfd00 0x12aca: int 0x21 0x12acc: mov ax, word ptr cs:[0x2c] 0x12ad0: mov ds, ax 0x12ad2: mov si, 0 0x12ad5: mov cx, 0x4000 0x12ad8: lodsb al, byte ptr [si] 0x12ad9: cmp al, 1 0x12adb: je 0x12adf 0x12add: loop 0x12ad8 0x12adf: inc si |
| 2018-12-25T12:53:33.901806221Z | 9 | PC: 12ac5 | Display string (Could not find end pointer) |
| 2018-12-25T12:53:33.924789524Z | 26 | PC: 12acc | Set disk transfer address |
| 2018-12-25T12:53:33.926976148Z | 67 | PC: 12afc | Get or set file attributes |
| 2018-12-25T12:53:33.933858868Z | 67 | PC: 12b09 | Get or set file attributes |
| 2018-12-25T12:53:33.951181949Z | 61 | PC: 12b0e | Open file (Filename = 'A:\TEST.COM') |
| 2018-12-25T12:53:33.959297788Z | 87 | PC: 12b15 | Get or set file date and time |
| 2018-12-25T12:53:33.960948241Z | 62 | PC: 12b1b | Close file |
| 2018-12-25T12:53:33.963317239Z | 60 | PC: 12b24 | Create or truncate file |
| 2018-12-25T12:53:33.979370843Z | 64 | PC: 12b33 | Write file or device (Write 4 bytes on handle 5) |
| 2018-12-25T12:53:33.985167626Z | 87 | PC: 12b3a | Get or set file date and time |
| 2018-12-25T12:53:33.986631032Z | 62 | PC: 12b3e | Close file |
| 2018-12-25T12:53:33.995460498Z | 67 | PC: 12b47 | Get or set file attributes |
| 2018-12-25T12:53:34.006406237Z | 26 | PC: 12c77 | Set disk transfer address |