{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":2482,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:46:00.821553274Z | 26 | PC: 12ace | Set disk transfer address |
| 2018-12-25T11:46:00.82322091Z | 78 | PC: 12b27 | Find first file |
| 2018-12-25T11:46:00.829754084Z | 61 | PC: 12b33 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T11:46:00.836841493Z | 63 | PC: 12b42 | Read file or device (Read 4 bytes on handle 5) |
| 2018-12-25T11:46:00.851275727Z | 66 | PC: 12b5b | Move file pointer |
| 2018-12-25T11:46:00.85310117Z | 64 | PC: 12b70 | Write file or device (Write 4 bytes on handle 5) |
| 2018-12-25T11:46:00.856761424Z | 64 | PC: 12a72 | Write file or device (Write 1600 bytes on handle 5) |
| 2018-12-25T11:46:00.874871178Z | 66 | PC: 12b94 | Move file pointer |
| 2018-12-25T11:46:00.877469947Z | 64 | PC: 12bb6 | Write file or device (Write 4 bytes on handle 5) |
| 2018-12-25T11:46:00.884989391Z | 62 | PC: 12b1b | Close file |
| 2018-12-25T11:46:00.894406662Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:00.898770845Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:00.901488954Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:00.904563571Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:00.907854094Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:00.910719693Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:00.913025738Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:00.920203907Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:00.922476317Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:00.925769754Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:00.928537646Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:00.931105717Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:00.933289667Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:00.936999527Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:00.944931662Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:00.947586222Z | 59 | PC: 12be9 | Change current directory |
| 2018-12-25T11:46:00.952426108Z | 42 | PC: 12bf8 | Get date 0x12bf8: cmp dl, 4 0x12bfb: jne 0x12c07 0x12bfd: cmp dh, 7 0x12c00: jne 0x12c07 0x12c02: xor ax, ax 0x12c04: jmp 0x12c25 0x12c06: nop 0x12c07: mov ah, 0x2c 0x12c09: int 0x21 0x12c0b: or cl, cl 0x12c0d: jne 0x12c32 0x12c0f: cmp ch, 6 0x12c12: jge 0x12c32 0x12c14: add cl, ch 0x12c16: mov ax, cx 0x12c18: cwde 0x12c19: add al, dh 0x12c1b: adc al, dl 0x12c1d: adc ah, 0 0x12c20: or ax, ax |
| 2018-12-25T11:46:00.955038612Z | 44 | PC: 12c0b | Get time 0x12c0b: or cl, cl 0x12c0d: jne 0x12c32 0x12c0f: cmp ch, 6 0x12c12: jge 0x12c32 0x12c14: add cl, ch 0x12c16: mov ax, cx 0x12c18: cwde 0x12c19: add al, dh 0x12c1b: adc al, dl 0x12c1d: adc ah, 0 0x12c20: or ax, ax 0x12c22: jne 0x12c25 0x12c24: inc ax 0x12c25: mov dx, ax 0x12c27: mov cx, 1 0x12c2a: xor bx, bx 0x12c2c: mov ah, 0x19 0x12c2e: int 0x21 0x12c30: int 0x26 0x12c32: mov bx, 0x3df |
| 2018-12-25T11:46:00.957299998Z | 25 | PC: 12c30 | Get default drive |
{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":2482,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:46:01.380545558Z | 26 | PC: 12ace | Set disk transfer address |
| 2018-12-25T11:46:01.396171Z | 78 | PC: 12b27 | Find first file |
| 2018-12-25T11:46:01.402786088Z | 61 | PC: 12b33 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T11:46:01.409937395Z | 63 | PC: 12b42 | Read file or device (Read 4 bytes on handle 5) |
| 2018-12-25T11:46:01.417278145Z | 66 | PC: 12b5b | Move file pointer |
| 2018-12-25T11:46:01.41868918Z | 64 | PC: 12b70 | Write file or device (Write 4 bytes on handle 5) |
| 2018-12-25T11:46:01.422932507Z | 64 | PC: 12a72 | Write file or device (Write 1600 bytes on handle 5) |
| 2018-12-25T11:46:01.439779381Z | 66 | PC: 12b94 | Move file pointer |
| 2018-12-25T11:46:01.445320867Z | 64 | PC: 12bb6 | Write file or device (Write 4 bytes on handle 5) |
| 2018-12-25T11:46:01.45224676Z | 62 | PC: 12b1b | Close file |
| 2018-12-25T11:46:01.460907271Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:01.463730642Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:01.465961559Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:01.468624048Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:01.471345616Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:01.473086452Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:01.474580223Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:01.477378481Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:01.47958457Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:01.482079279Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:01.484735963Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:01.487148574Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:01.489289398Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:01.493370663Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:01.495757606Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:01.498129658Z | 59 | PC: 12be9 | Change current directory |
| 2018-12-25T11:46:01.503436239Z | 42 | PC: 12bf8 | Get date 0x12bf8: cmp dl, 4 0x12bfb: jne 0x12c07 0x12bfd: cmp dh, 7 0x12c00: jne 0x12c07 0x12c02: xor ax, ax 0x12c04: jmp 0x12c25 0x12c06: nop 0x12c07: mov ah, 0x2c 0x12c09: int 0x21 0x12c0b: or cl, cl 0x12c0d: jne 0x12c32 0x12c0f: cmp ch, 6 0x12c12: jge 0x12c32 0x12c14: add cl, ch 0x12c16: mov ax, cx 0x12c18: cwde 0x12c19: add al, dh 0x12c1b: adc al, dl 0x12c1d: adc ah, 0 0x12c20: or ax, ax |
| 2018-12-25T11:46:01.505918956Z | 44 | PC: 12c0b | Get time 0x12c0b: or cl, cl 0x12c0d: jne 0x12c32 0x12c0f: cmp ch, 6 0x12c12: jge 0x12c32 0x12c14: add cl, ch 0x12c16: mov ax, cx 0x12c18: cwde 0x12c19: add al, dh 0x12c1b: adc al, dl 0x12c1d: adc ah, 0 0x12c20: or ax, ax 0x12c22: jne 0x12c25 0x12c24: inc ax 0x12c25: mov dx, ax 0x12c27: mov cx, 1 0x12c2a: xor bx, bx 0x12c2c: mov ah, 0x19 0x12c2e: int 0x21 0x12c30: int 0x26 0x12c32: mov bx, 0x3df |
| 2018-12-25T11:46:01.508188657Z | 25 | PC: 12c30 | Get default drive |
{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":6,"Min":0,"Second":0,"TimeBased":true,"OriginalID":2482,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:46:01.642094627Z | 26 | PC: 12ace | Set disk transfer address |
| 2018-12-25T11:46:01.643749636Z | 78 | PC: 12b27 | Find first file |
| 2018-12-25T11:46:01.650535541Z | 61 | PC: 12b33 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T11:46:01.656757854Z | 63 | PC: 12b42 | Read file or device (Read 4 bytes on handle 5) |
| 2018-12-25T11:46:01.672967459Z | 66 | PC: 12b5b | Move file pointer |
| 2018-12-25T11:46:01.674293028Z | 64 | PC: 12b70 | Write file or device (Write 4 bytes on handle 5) |
| 2018-12-25T11:46:01.677489426Z | 64 | PC: 12a72 | Write file or device (Write 1600 bytes on handle 5) |
| 2018-12-25T11:46:01.694462062Z | 66 | PC: 12b94 | Move file pointer |
| 2018-12-25T11:46:01.695794056Z | 64 | PC: 12bb6 | Write file or device (Write 4 bytes on handle 5) |
| 2018-12-25T11:46:01.702060292Z | 62 | PC: 12b1b | Close file |
| 2018-12-25T11:46:01.710082465Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:01.713663805Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:01.715619952Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:01.718525604Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:01.721387861Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:01.723822014Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:01.725885804Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:01.733569361Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:01.736168681Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:01.738550703Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:01.753775697Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:01.756530752Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:01.758842019Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:01.762052136Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:01.764400148Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:01.766819311Z | 59 | PC: 12be9 | Change current directory |
| 2018-12-25T11:46:01.771706672Z | 42 | PC: 12bf8 | Get date 0x12bf8: cmp dl, 4 0x12bfb: jne 0x12c07 0x12bfd: cmp dh, 7 0x12c00: jne 0x12c07 0x12c02: xor ax, ax 0x12c04: jmp 0x12c25 0x12c06: nop 0x12c07: mov ah, 0x2c 0x12c09: int 0x21 0x12c0b: or cl, cl 0x12c0d: jne 0x12c32 0x12c0f: cmp ch, 6 0x12c12: jge 0x12c32 0x12c14: add cl, ch 0x12c16: mov ax, cx 0x12c18: cwde 0x12c19: add al, dh 0x12c1b: adc al, dl 0x12c1d: adc ah, 0 0x12c20: or ax, ax |
| 2018-12-25T11:46:01.77383406Z | 44 | PC: 12c0b | Get time 0x12c0b: or cl, cl 0x12c0d: jne 0x12c32 0x12c0f: cmp ch, 6 0x12c12: jge 0x12c32 0x12c14: add cl, ch 0x12c16: mov ax, cx 0x12c18: cwde 0x12c19: add al, dh 0x12c1b: adc al, dl 0x12c1d: adc ah, 0 0x12c20: or ax, ax 0x12c22: jne 0x12c25 0x12c24: inc ax 0x12c25: mov dx, ax 0x12c27: mov cx, 1 0x12c2a: xor bx, bx 0x12c2c: mov ah, 0x19 0x12c2e: int 0x21 0x12c30: int 0x26 0x12c32: mov bx, 0x3df |
| 2018-12-25T11:46:01.775853299Z | 44 | PC: 12c39 | Get time 0x12c39: inc dh 0x12c3b: cmp dh, byte ptr [0x407] 0x12c3f: jl 0x12c47 0x12c41: sub dh, byte ptr [0x407] 0x12c45: jmp 0x12c3b 0x12c47: mov al, dh 0x12c49: mov cl, al 0x12c4b: cwde 0x12c4c: shl ax, 1 0x12c4e: add bx, ax 0x12c50: mov si, word ptr [bx] 0x12c52: mov ch, byte ptr [si - 1] 0x12c55: mov dx, si 0x12c57: mov ah, 9 0x12c59: int 0x21 0x12c5b: cmp ch, 0 0x12c5e: je 0x12c89 0x12c60: cmp ch, 1 0x12c63: je 0x12c63 0x12c65: cmp ch, 2 |
| 2018-12-25T11:46:01.778258483Z | 9 | PC: 12c5b | Display string (Could not find end pointer) |
{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":6,"Min":0,"Second":0,"TimeBased":true,"OriginalID":2482,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:46:02.075232107Z | 26 | PC: 12ace | Set disk transfer address |
| 2018-12-25T11:46:02.07707694Z | 78 | PC: 12b27 | Find first file |
| 2018-12-25T11:46:02.0836446Z | 61 | PC: 12b33 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T11:46:02.090093109Z | 63 | PC: 12b42 | Read file or device (Read 4 bytes on handle 5) |
| 2018-12-25T11:46:02.099300885Z | 66 | PC: 12b5b | Move file pointer |
| 2018-12-25T11:46:02.101225Z | 64 | PC: 12b70 | Write file or device (Write 4 bytes on handle 5) |
| 2018-12-25T11:46:02.105099403Z | 64 | PC: 12a72 | Write file or device (Write 1600 bytes on handle 5) |
| 2018-12-25T11:46:02.12039646Z | 66 | PC: 12b94 | Move file pointer |
| 2018-12-25T11:46:02.122089447Z | 64 | PC: 12bb6 | Write file or device (Write 4 bytes on handle 5) |
| 2018-12-25T11:46:02.128746213Z | 62 | PC: 12b1b | Close file |
| 2018-12-25T11:46:02.137539456Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:02.140450615Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:02.142637385Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:02.144929445Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:02.147059942Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:02.149350714Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:02.151188198Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:02.155080861Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:02.157105822Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:02.15937478Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:02.162160777Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:02.164639382Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:02.167116647Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:02.170328155Z | 61 | PC: 12b33 | Open file (See above) |
| 2018-12-25T11:46:02.172750722Z | 79 | PC: 12b27 | Find next file (See above) |
| 2018-12-25T11:46:02.175880189Z | 59 | PC: 12be9 | Change current directory |
| 2018-12-25T11:46:02.181524067Z | 42 | PC: 12bf8 | Get date 0x12bf8: cmp dl, 4 0x12bfb: jne 0x12c07 0x12bfd: cmp dh, 7 0x12c00: jne 0x12c07 0x12c02: xor ax, ax 0x12c04: jmp 0x12c25 0x12c06: nop 0x12c07: mov ah, 0x2c 0x12c09: int 0x21 0x12c0b: or cl, cl 0x12c0d: jne 0x12c32 0x12c0f: cmp ch, 6 0x12c12: jge 0x12c32 0x12c14: add cl, ch 0x12c16: mov ax, cx 0x12c18: cwde 0x12c19: add al, dh 0x12c1b: adc al, dl 0x12c1d: adc ah, 0 0x12c20: or ax, ax |
| 2018-12-25T11:46:02.184747061Z | 44 | PC: 12c0b | Get time 0x12c0b: or cl, cl 0x12c0d: jne 0x12c32 0x12c0f: cmp ch, 6 0x12c12: jge 0x12c32 0x12c14: add cl, ch 0x12c16: mov ax, cx 0x12c18: cwde 0x12c19: add al, dh 0x12c1b: adc al, dl 0x12c1d: adc ah, 0 0x12c20: or ax, ax 0x12c22: jne 0x12c25 0x12c24: inc ax 0x12c25: mov dx, ax 0x12c27: mov cx, 1 0x12c2a: xor bx, bx 0x12c2c: mov ah, 0x19 0x12c2e: int 0x21 0x12c30: int 0x26 0x12c32: mov bx, 0x3df |
| 2018-12-25T11:46:02.187444965Z | 44 | PC: 12c39 | Get time 0x12c39: inc dh 0x12c3b: cmp dh, byte ptr [0x407] 0x12c3f: jl 0x12c47 0x12c41: sub dh, byte ptr [0x407] 0x12c45: jmp 0x12c3b 0x12c47: mov al, dh 0x12c49: mov cl, al 0x12c4b: cwde 0x12c4c: shl ax, 1 0x12c4e: add bx, ax 0x12c50: mov si, word ptr [bx] 0x12c52: mov ch, byte ptr [si - 1] 0x12c55: mov dx, si 0x12c57: mov ah, 9 0x12c59: int 0x21 0x12c5b: cmp ch, 0 0x12c5e: je 0x12c89 0x12c60: cmp ch, 1 0x12c63: je 0x12c63 0x12c65: cmp ch, 2 |
| 2018-12-25T11:46:02.190776261Z | 9 | PC: 12c5b | Display string (Could not find end pointer) |