{"DateBased":true,"Day":1,"Month":2,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":2236,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:45:12.727859591Z | 78 | PC: 12a74 | Find first file |
| 2018-12-25T11:45:12.734039513Z | 61 | PC: 12a81 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T11:45:12.738141893Z | 63 | PC: 12a90 | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-25T11:45:12.74429704Z | 66 | PC: 12ab3 | Move file pointer |
| 2018-12-25T11:45:12.746068815Z | 64 | PC: 12ac4 | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-25T11:45:12.747887167Z | 66 | PC: 12acc | Move file pointer |
| 2018-12-25T11:45:12.748927865Z | 64 | PC: 12adc | Write file or device (Write 282 bytes on handle 5) |
| 2018-12-25T11:45:12.76816065Z | 62 | PC: 12ae3 | Close file |
| 2018-12-25T11:45:12.776314098Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:12.780798022Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:12.788953066Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:12.795388665Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:12.79678475Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:12.799314505Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:12.80098272Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:12.803493745Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:12.811352514Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:12.814676739Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:12.8231642Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:12.829432563Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:12.831388264Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:12.835407335Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:12.837201523Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:12.841007512Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:12.851008649Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:12.853514451Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:12.861025437Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:12.867839881Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:12.873602916Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:12.87691845Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:12.883213118Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:12.885967904Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:12.894973575Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:12.89783307Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:12.904270101Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:12.910671083Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:12.912085393Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:12.914488204Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:12.915897254Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:12.918387084Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:12.92606571Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:12.928585538Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:12.935334748Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:12.941825579Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:12.943582895Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:12.946322324Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:12.947553478Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:12.955538619Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:12.964174909Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:12.966944441Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:12.973526896Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:12.981002018Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:12.982211744Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:12.985444256Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:12.987564829Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:12.990049706Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:12.997624577Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:13.000782669Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:13.007026833Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:13.009387721Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:13.011743495Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:13.013971939Z | 42 | PC: 12aee | Get date 0x12aee: cmp dh, 2 0x12af1: je 0x12af6 0x12af3: jmp 0x12b0c 0x12af6: cmp dl, 5 0x12af9: je 0x12afe 0x12afb: jmp 0x12b0c 0x12afe: mov ah, 9 0x12b00: lea dx, word ptr [bp + 0xf7] 0x12b04: int 0x21 0x12b06: int 0 0x12b08: int 0x16 0x12b0a: int 0x20 0x12b0c: mov di, 0x100 0x12b0f: jmp di 0x12b11: jmp 0x12b2e 0x12b14: sub ch, byte ptr [0x6f63] 0x12b18: sub al, byte ptr [bx + si] 0x12b1a: jmp 0x12b1d 0x12b1d: push sp 0x12b1e: push 0x2065 |
{"DateBased":true,"Day":5,"Month":2,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":2236,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:45:13.935215663Z | 78 | PC: 12a74 | Find first file |
| 2018-12-25T11:45:13.939337236Z | 61 | PC: 12a81 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T11:45:13.943907096Z | 63 | PC: 12a90 | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-25T11:45:13.950955162Z | 66 | PC: 12ab3 | Move file pointer |
| 2018-12-25T11:45:13.952353644Z | 64 | PC: 12ac4 | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-25T11:45:13.95500321Z | 66 | PC: 12acc | Move file pointer |
| 2018-12-25T11:45:13.956243547Z | 64 | PC: 12adc | Write file or device (Write 282 bytes on handle 5) |
| 2018-12-25T11:45:13.969430659Z | 62 | PC: 12ae3 | Close file |
| 2018-12-25T11:45:13.982810808Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:13.986760429Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:13.995095153Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:14.005400078Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:14.006965469Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:14.009930428Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:14.012201633Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:14.015151192Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:14.024483037Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:14.027728658Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:14.035285912Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:14.042949427Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:14.044450535Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:14.047439554Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:14.048775573Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:14.051949273Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:14.061208738Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:14.064636921Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:14.072818473Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:14.081036911Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:14.083200405Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:14.0870465Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:14.090182183Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:14.093351012Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:14.102287381Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:14.116443955Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:14.124275419Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:14.132649023Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:14.134884758Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:14.138996473Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:14.14106685Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:14.144558734Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:14.154214355Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:14.15749591Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:14.16473941Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:14.17285849Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:14.174893653Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:14.178460622Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:14.18194849Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:14.192057274Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:14.201452483Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:14.205201296Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:14.213202051Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:14.221245302Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:14.223259079Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:14.226318958Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:14.227879964Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:14.231533923Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:14.2422253Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:14.245493876Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:14.253146988Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:14.257123487Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:14.259624159Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:14.262759949Z | 42 | PC: 12aee | Get date 0x12aee: cmp dh, 2 0x12af1: je 0x12af6 0x12af3: jmp 0x12b0c 0x12af6: cmp dl, 5 0x12af9: je 0x12afe 0x12afb: jmp 0x12b0c 0x12afe: mov ah, 9 0x12b00: lea dx, word ptr [bp + 0xf7] 0x12b04: int 0x21 0x12b06: int 0 0x12b08: int 0x16 0x12b0a: int 0x20 0x12b0c: mov di, 0x100 0x12b0f: jmp di 0x12b11: jmp 0x12b2e 0x12b14: sub ch, byte ptr [0x6f63] 0x12b18: sub al, byte ptr [bx + si] 0x12b1a: jmp 0x12b1d 0x12b1d: push sp 0x12b1e: push 0x2065 |
| 2018-12-25T11:45:14.266104811Z | 9 | PC: 12b06 | Display string (String= 'Happy Birthday Lisa! ') |
| 2018-12-25T11:45:14.27467311Z | 76 | PC: 0 | Terminate with return code (Return code = '0') |
{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":2236,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:45:15.022943944Z | 78 | PC: 12a74 | Find first file |
| 2018-12-25T11:45:15.027791233Z | 61 | PC: 12a81 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T11:45:15.034176269Z | 63 | PC: 12a90 | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-25T11:45:15.040285106Z | 66 | PC: 12ab3 | Move file pointer |
| 2018-12-25T11:45:15.054313756Z | 64 | PC: 12ac4 | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-25T11:45:15.057237041Z | 66 | PC: 12acc | Move file pointer |
| 2018-12-25T11:45:15.058940677Z | 64 | PC: 12adc | Write file or device (Write 282 bytes on handle 5) |
| 2018-12-25T11:45:15.073357638Z | 62 | PC: 12ae3 | Close file |
| 2018-12-25T11:45:15.08126989Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:15.083935199Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:15.09452252Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:15.101918056Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:15.103295818Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:15.105803729Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:15.10784314Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:15.110929313Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:15.11935717Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:15.123391233Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:15.1305792Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:15.142630041Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:15.145335254Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:15.148051049Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:15.149458724Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:15.152870995Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:15.171461936Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:15.178110014Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:15.186145332Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:15.19342225Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:15.195176639Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:15.198964933Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:15.200798124Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:15.202726728Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:15.208909034Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:15.215149121Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:15.221915511Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:15.227349083Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:15.236752473Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:15.241392068Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:15.242926461Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:15.246615359Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:15.255195674Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:15.25802422Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:15.26969015Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:15.276540035Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:15.277972348Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:15.280837169Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:15.282815497Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:15.290890168Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:15.299485272Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:15.302632775Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:15.309140417Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:15.31629709Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:15.319199799Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:15.322059129Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:15.323689663Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:15.327516679Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:15.335278235Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:15.338001164Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:15.345370172Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:15.348392366Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:15.350331899Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:15.353595871Z | 42 | PC: 12aee | Get date 0x12aee: cmp dh, 2 0x12af1: je 0x12af6 0x12af3: jmp 0x12b0c 0x12af6: cmp dl, 5 0x12af9: je 0x12afe 0x12afb: jmp 0x12b0c 0x12afe: mov ah, 9 0x12b00: lea dx, word ptr [bp + 0xf7] 0x12b04: int 0x21 0x12b06: int 0 0x12b08: int 0x16 0x12b0a: int 0x20 0x12b0c: mov di, 0x100 0x12b0f: jmp di 0x12b11: jmp 0x12b2e 0x12b14: sub ch, byte ptr [0x6f63] 0x12b18: sub al, byte ptr [bx + si] 0x12b1a: jmp 0x12b1d 0x12b1d: push sp 0x12b1e: push 0x2065 |
{"DateBased":true,"Day":5,"Month":2,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":2236,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:45:15.229367177Z | 78 | PC: 12a74 | Find first file |
| 2018-12-25T11:45:15.235863324Z | 61 | PC: 12a81 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T11:45:15.242898549Z | 63 | PC: 12a90 | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-25T11:45:15.262802413Z | 66 | PC: 12ab3 | Move file pointer |
| 2018-12-25T11:45:15.264832071Z | 64 | PC: 12ac4 | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-25T11:45:15.268376112Z | 66 | PC: 12acc | Move file pointer |
| 2018-12-25T11:45:15.269893177Z | 64 | PC: 12adc | Write file or device (Write 282 bytes on handle 5) |
| 2018-12-25T11:45:15.284023568Z | 62 | PC: 12ae3 | Close file |
| 2018-12-25T11:45:15.296215798Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:15.299007524Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:15.305698399Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:15.313787176Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:15.315209181Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:15.317812623Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:15.32014878Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:15.32278874Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:15.330540252Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:15.333328004Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:15.356851672Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:15.363510066Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:15.365199132Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:15.368643875Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:15.370342838Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:15.373253698Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:15.390415936Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:15.393189851Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:15.400201598Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:15.407113805Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:15.408547121Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:15.411234639Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:15.413400189Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:15.42508487Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:15.433065312Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:15.436429571Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:15.443085161Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:15.450382901Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:15.452879487Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:15.45576728Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:15.457385774Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:15.466628636Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:15.474480144Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:15.477017927Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:15.484364242Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:15.491269221Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:15.492885204Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:15.496516172Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:15.498379863Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:15.506779283Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:15.516350429Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:15.519101264Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:15.525507398Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:15.532883023Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:15.534561978Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:15.537510305Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:15.540051125Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:15.543737284Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:15.551584514Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:15.55527071Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:15.561999855Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:15.564777092Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:15.56751243Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:15.570579673Z | 42 | PC: 12aee | Get date 0x12aee: cmp dh, 2 0x12af1: je 0x12af6 0x12af3: jmp 0x12b0c 0x12af6: cmp dl, 5 0x12af9: je 0x12afe 0x12afb: jmp 0x12b0c 0x12afe: mov ah, 9 0x12b00: lea dx, word ptr [bp + 0xf7] 0x12b04: int 0x21 0x12b06: int 0 0x12b08: int 0x16 0x12b0a: int 0x20 0x12b0c: mov di, 0x100 0x12b0f: jmp di 0x12b11: jmp 0x12b2e 0x12b14: sub ch, byte ptr [0x6f63] 0x12b18: sub al, byte ptr [bx + si] 0x12b1a: jmp 0x12b1d 0x12b1d: push sp 0x12b1e: push 0x2065 |
| 2018-12-25T11:45:15.573035001Z | 9 | PC: 12b06 | Display string (String= 'Happy Birthday Lisa! ') |
| 2018-12-25T11:45:15.580020121Z | 76 | PC: 0 | Terminate with return code (Return code = '0') |
{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":2236,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:45:16.859532262Z | 78 | PC: 12a74 | Find first file |
| 2018-12-25T11:45:16.866953646Z | 61 | PC: 12a81 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T11:45:16.873648Z | 63 | PC: 12a90 | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-25T11:45:16.880147834Z | 66 | PC: 12ab3 | Move file pointer |
| 2018-12-25T11:45:16.884469486Z | 64 | PC: 12ac4 | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-25T11:45:16.887372139Z | 66 | PC: 12acc | Move file pointer |
| 2018-12-25T11:45:16.88903407Z | 64 | PC: 12adc | Write file or device (Write 282 bytes on handle 5) |
| 2018-12-25T11:45:16.903822239Z | 62 | PC: 12ae3 | Close file |
| 2018-12-25T11:45:16.913065483Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:16.915874387Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:16.922504437Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:16.933229199Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:16.934601957Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:16.936969915Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:16.939130582Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:16.942444635Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:16.949650688Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:16.952636878Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:16.958780964Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:16.964674084Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:16.966803294Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:16.96967524Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:16.971059977Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:16.97406612Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:16.982082702Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:16.985045742Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:16.992396644Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:16.998993811Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:17.000669637Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:17.003780321Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:17.005662273Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:17.008567979Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:17.016543332Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:17.019724329Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:17.030161126Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:17.040501928Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:17.04265734Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:17.045342166Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:17.047448769Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:17.051459388Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:17.059502324Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:17.062061846Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:17.067808798Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:17.074946506Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:17.076299084Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:17.081581045Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:17.083432379Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:17.090998452Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:17.099607948Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:17.102647812Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:17.10803602Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:17.114479759Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:17.115708433Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:17.117638487Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:17.119359607Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:17.121958022Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:17.1271515Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:17.130537251Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:17.134671613Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:17.137362166Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:17.140230521Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:17.142572319Z | 42 | PC: 12aee | Get date 0x12aee: cmp dh, 2 0x12af1: je 0x12af6 0x12af3: jmp 0x12b0c 0x12af6: cmp dl, 5 0x12af9: je 0x12afe 0x12afb: jmp 0x12b0c 0x12afe: mov ah, 9 0x12b00: lea dx, word ptr [bp + 0xf7] 0x12b04: int 0x21 0x12b06: int 0 0x12b08: int 0x16 0x12b0a: int 0x20 0x12b0c: mov di, 0x100 0x12b0f: jmp di 0x12b11: jmp 0x12b2e 0x12b14: sub ch, byte ptr [0x6f63] 0x12b18: sub al, byte ptr [bx + si] 0x12b1a: jmp 0x12b1d 0x12b1d: push sp 0x12b1e: push 0x2065 |
{"DateBased":true,"Day":1,"Month":2,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":2236,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:45:17.193713474Z | 78 | PC: 12a74 | Find first file |
| 2018-12-25T11:45:17.199710021Z | 61 | PC: 12a81 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T11:45:17.206994528Z | 63 | PC: 12a90 | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-25T11:45:17.213154153Z | 66 | PC: 12ab3 | Move file pointer |
| 2018-12-25T11:45:17.214865121Z | 64 | PC: 12ac4 | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-25T11:45:17.218739417Z | 66 | PC: 12acc | Move file pointer |
| 2018-12-25T11:45:17.220205993Z | 64 | PC: 12adc | Write file or device (Write 282 bytes on handle 5) |
| 2018-12-25T11:45:17.235269841Z | 62 | PC: 12ae3 | Close file |
| 2018-12-25T11:45:17.242817615Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:17.244721483Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:17.249635542Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:17.256722823Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:17.25776022Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:17.259519485Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:17.260687094Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:17.26296909Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:17.267891612Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:17.269649535Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:17.274206734Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:17.279043846Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:17.280122374Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:17.282567428Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:17.283733958Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:17.285536706Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:17.291179933Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:17.29395597Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:17.300749282Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:17.305937177Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:17.306960323Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:17.308668762Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:17.310282404Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:17.312198168Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:17.317253849Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:17.324672886Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:17.334632013Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:17.338690343Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:17.340432535Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:17.342390859Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:17.34341161Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:17.34559248Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:17.350538775Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:17.352340528Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:17.35673552Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:17.361932318Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:17.363206117Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:17.366416882Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:17.367919115Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:17.375923759Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:17.384788859Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:17.388044368Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:17.395099655Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:17.401288836Z | 66 | PC: 12ab3 | Move file pointer (See above) |
| 2018-12-25T11:45:17.404355212Z | 64 | PC: 12ac4 | Write file or device (See above) |
| 2018-12-25T11:45:17.407354856Z | 66 | PC: 12acc | Move file pointer (See above) |
| 2018-12-25T11:45:17.408877695Z | 64 | PC: 12adc | Write file or device (See above) |
| 2018-12-25T11:45:17.412780033Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:17.421103595Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:17.42409548Z | 61 | PC: 12a81 | Open file (See above) |
| 2018-12-25T11:45:17.43176617Z | 63 | PC: 12a90 | Read file or device (See above) |
| 2018-12-25T11:45:17.434883083Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:45:17.436893077Z | 79 | PC: 12a74 | Find next file (See above) |
| 2018-12-25T11:45:17.440042023Z | 42 | PC: 12aee | Get date 0x12aee: cmp dh, 2 0x12af1: je 0x12af6 0x12af3: jmp 0x12b0c 0x12af6: cmp dl, 5 0x12af9: je 0x12afe 0x12afb: jmp 0x12b0c 0x12afe: mov ah, 9 0x12b00: lea dx, word ptr [bp + 0xf7] 0x12b04: int 0x21 0x12b06: int 0 0x12b08: int 0x16 0x12b0a: int 0x20 0x12b0c: mov di, 0x100 0x12b0f: jmp di 0x12b11: jmp 0x12b2e 0x12b14: sub ch, byte ptr [0x6f63] 0x12b18: sub al, byte ptr [bx + si] 0x12b1a: jmp 0x12b1d 0x12b1d: push sp 0x12b1e: push 0x2065 |