Sample viewer

vx.netlux.org/Virus.DOS.Ysse.1495

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:14:47.304269301Z 47 PC: 1517d | Get disk transfer address
2018-12-17T22:14:47.305646112Z 26 PC: 15187 | Set disk transfer address
2018-12-17T22:14:47.306504605Z 44 PC: 1518f | Get time 0x1518f: cmp cl, 0x1e
0x15192: je 0x1539c
0x15196: jmp 0x15199
0x15198: nop
0x15199: mov cx, 3
0x1519c: push cx
0x1519d: call 0x151bd
0x151a0: pop cx
0x151a1: loop 0x1519c
0x151a3: pop dx
0x151a4: push cx
0x151a5: mov cl, 0x1a
0x151a7: mov ah, cl
0x151a9: pop cx
0x151aa: int 0x21
0x151ac: mov sp, bp
0x151ae: xor ax, ax
0x151b0: mov bx, ax
0x151b2: mov cx, ax
0x151b4: mov dx, ax
2018-12-17T22:14:47.308086853Z 71 PC: 151d0 | Get current directory
2018-12-17T22:14:47.310429947Z 59 PC: 151dc | Change current directory
2018-12-17T22:14:47.313001441Z 47 PC: 151f9 | Get disk transfer address
2018-12-17T22:14:47.313778554Z 26 PC: 1520b | Set disk transfer address
2018-12-17T22:14:47.314902386Z 78 PC: 1521a | Find first file
2018-12-17T22:14:47.318582623Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.320956301Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.323672Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.32614163Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.328422485Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.331218947Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.333684282Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.335936893Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.33887648Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.341185965Z 47 PC: 15282 | Get disk transfer address
2018-12-17T22:14:47.342132308Z 26 PC: 15295 | Set disk transfer address
2018-12-17T22:14:47.342992787Z 78 PC: 152a1 | Find first file
2018-12-17T22:14:47.348648449Z 47 PC: 152c9 | Get disk transfer address
2018-12-17T22:14:47.349593115Z 61 PC: 152e8 | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:14:47.36104167Z 63 PC: 152f8 | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:14:47.370095587Z 66 PC: 15304 | Move file pointer
2018-12-17T22:14:47.371373505Z 62 PC: 1530d | Close file
2018-12-17T22:14:47.373062588Z 67 PC: 15333 | Get or set file attributes
2018-12-17T22:14:47.389593964Z 61 PC: 1533c | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:14:47.395946622Z 64 PC: 1534c | Write file or device (Write 3 bytes on handle 5)
2018-12-17T22:14:47.398536999Z 66 PC: 15358 | Move file pointer
2018-12-17T22:14:47.400235586Z 64 PC: 15367 | Write file or device (Write 1495 bytes on handle 5)
2018-12-17T22:14:47.408555471Z 87 PC: 15376 | Get or set file date and time
2018-12-17T22:14:47.409879162Z 62 PC: 1537e | Close file
2018-12-17T22:14:47.417514239Z 67 PC: 1538f | Get or set file attributes
2018-12-17T22:14:47.427618538Z 26 PC: 152bf | Set disk transfer address
2018-12-17T22:14:47.42893563Z 26 PC: 1526a | Set disk transfer address
2018-12-17T22:14:47.431823798Z 59 PC: 151ea | Change current directory
2018-12-17T22:14:47.434152039Z 71 PC: 151d0 | Get current directory
2018-12-17T22:14:47.436918891Z 59 PC: 151dc | Change current directory
2018-12-17T22:14:47.44124134Z 47 PC: 151f9 | Get disk transfer address
2018-12-17T22:14:47.442479554Z 26 PC: 1520b | Set disk transfer address
2018-12-17T22:14:47.44358335Z 78 PC: 1521a | Find first file
2018-12-17T22:14:47.458320976Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.460726917Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.463114121Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.465923606Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.468305704Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.470632902Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.473452753Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.475895608Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.478247947Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.480808751Z 47 PC: 15282 | Get disk transfer address
2018-12-17T22:14:47.482286998Z 26 PC: 15295 | Set disk transfer address
2018-12-17T22:14:47.483609246Z 78 PC: 152a1 | Find first file
2018-12-17T22:14:47.490035446Z 47 PC: 152c9 | Get disk transfer address
2018-12-17T22:14:47.491058275Z 61 PC: 152e8 | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:14:47.497248427Z 63 PC: 152f8 | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:14:47.503755263Z 66 PC: 15304 | Move file pointer
2018-12-17T22:14:47.505083779Z 62 PC: 1530d | Close file
2018-12-17T22:14:47.507110355Z 79 PC: 152a1 | Find next file
2018-12-17T22:14:47.529816975Z 47 PC: 152c9 | Get disk transfer address
2018-12-17T22:14:47.531035287Z 61 PC: 152e8 | Open file (Filename = 'PRINT.COM')
2018-12-17T22:14:47.537480614Z 63 PC: 152f8 | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:14:47.544734968Z 66 PC: 15304 | Move file pointer
2018-12-17T22:14:47.546101913Z 62 PC: 1530d | Close file
2018-12-17T22:14:47.54798937Z 67 PC: 15333 | Get or set file attributes
2018-12-17T22:14:47.558842327Z 61 PC: 1533c | Open file (Filename = 'PRINT.COM')
2018-12-17T22:14:47.565659789Z 64 PC: 1534c | Write file or device (Write 3 bytes on handle 5)
2018-12-17T22:14:47.568374948Z 66 PC: 15358 | Move file pointer
2018-12-17T22:14:47.57042355Z 64 PC: 15367 | Write file or device (Write 1495 bytes on handle 5)
2018-12-17T22:14:47.578921094Z 87 PC: 15376 | Get or set file date and time
2018-12-17T22:14:47.580396655Z 62 PC: 1537e | Close file
2018-12-17T22:14:47.588687248Z 67 PC: 1538f | Get or set file attributes
2018-12-17T22:14:47.599586196Z 26 PC: 152bf | Set disk transfer address
2018-12-17T22:14:47.600724778Z 26 PC: 1526a | Set disk transfer address
2018-12-17T22:14:47.602233091Z 59 PC: 151ea | Change current directory
2018-12-17T22:14:47.6046096Z 71 PC: 151d0 | Get current directory
2018-12-17T22:14:47.607454205Z 59 PC: 151dc | Change current directory
2018-12-17T22:14:47.610575496Z 47 PC: 151f9 | Get disk transfer address
2018-12-17T22:14:47.611536496Z 26 PC: 1520b | Set disk transfer address
2018-12-17T22:14:47.612401232Z 78 PC: 1521a | Find first file
2018-12-17T22:14:47.616509915Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.619095623Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.621469049Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.62417121Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.626632542Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.628976788Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.631683693Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.63409499Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.636397Z 79 PC: 15256 | Find next file
2018-12-17T22:14:47.638989432Z 47 PC: 15282 | Get disk transfer address
2018-12-17T22:14:47.639956381Z 26 PC: 15295 | Set disk transfer address
2018-12-17T22:14:47.640864696Z 78 PC: 152a1 | Find first file
2018-12-17T22:14:47.646905434Z 47 PC: 152c9 | Get disk transfer address
2018-12-17T22:14:47.647900477Z 61 PC: 152e8 | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:14:47.659066306Z 63 PC: 152f8 | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:14:47.666178724Z 66 PC: 15304 | Move file pointer
2018-12-17T22:14:47.667623089Z 62 PC: 1530d | Close file
2018-12-17T22:14:47.669344932Z 79 PC: 152a1 | Find next file
2018-12-17T22:14:47.672646129Z 47 PC: 152c9 | Get disk transfer address
2018-12-17T22:14:47.673776921Z 61 PC: 152e8 | Open file (Filename = 'PRINT.COM')
2018-12-17T22:14:47.680103246Z 63 PC: 152f8 | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:14:47.686852809Z 66 PC: 15304 | Move file pointer
2018-12-17T22:14:47.689131991Z 62 PC: 1530d | Close file
2018-12-17T22:14:47.691401484Z 79 PC: 152a1 | Find next file
2018-12-17T22:14:47.694490988Z 47 PC: 152c9 | Get disk transfer address
2018-12-17T22:14:47.696993762Z 61 PC: 152e8 | Open file (Filename = 'HELLO.COM')
2018-12-17T22:14:47.703829176Z 63 PC: 152f8 | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:14:47.710069797Z 66 PC: 15304 | Move file pointer
2018-12-17T22:14:47.712207762Z 62 PC: 1530d | Close file
2018-12-17T22:14:47.713973969Z 67 PC: 15333 | Get or set file attributes
2018-12-17T22:14:47.723683959Z 61 PC: 1533c | Open file (Filename = 'HELLO.COM')
2018-12-17T22:14:47.731082791Z 64 PC: 1534c | Write file or device (Write 3 bytes on handle 5)
2018-12-17T22:14:47.733855402Z 66 PC: 15358 | Move file pointer
2018-12-17T22:14:47.736094906Z 64 PC: 15367 | Write file or device (Write 1495 bytes on handle 5)
2018-12-17T22:14:47.745378343Z 87 PC: 15376 | Get or set file date and time
2018-12-17T22:14:47.746904105Z 62 PC: 1537e | Close file
2018-12-17T22:14:47.75480211Z 67 PC: 1538f | Get or set file attributes
2018-12-17T22:14:47.76521282Z 26 PC: 152bf | Set disk transfer address
2018-12-17T22:14:47.766321224Z 26 PC: 1526a | Set disk transfer address
2018-12-17T22:14:47.767440139Z 59 PC: 151ea | Change current directory
2018-12-17T22:14:47.770042879Z 26 PC: 151ac | Set disk transfer address
2018-12-17T22:14:47.771028978Z 9 PC: 1514b | Display string (String= 'Generic triage goat. ')
2018-12-17T22:14:47.774769786Z 76 PC: 15150 | Terminate with return code (Return code = '0')

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":2758,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:46:23.955281229Z 47 PC: 1517d | Get disk transfer address
2018-12-25T11:46:23.961629997Z 26 PC: 15187 | Set disk transfer address
2018-12-25T11:46:23.963206884Z 44 PC: 1518f | Get time 0x1518f: cmp cl, 0x1e
0x15192: je 0x1539c
0x15196: jmp 0x15199
0x15198: nop
0x15199: mov cx, 3
0x1519c: push cx
0x1519d: call 0x151bd
0x151a0: pop cx
0x151a1: loop 0x1519c
0x151a3: pop dx
0x151a4: push cx
0x151a5: mov cl, 0x1a
0x151a7: mov ah, cl
0x151a9: pop cx
0x151aa: int 0x21
0x151ac: mov sp, bp
0x151ae: xor ax, ax
0x151b0: mov bx, ax
0x151b2: mov cx, ax
0x151b4: mov dx, ax
2018-12-25T11:46:23.965772242Z 71 PC: 151d0 | Get current directory
2018-12-25T11:46:23.969168245Z 59 PC: 151dc | Change current directory
2018-12-25T11:46:23.973489637Z 47 PC: 151f9 | Get disk transfer address
2018-12-25T11:46:23.974519081Z 26 PC: 1520b | Set disk transfer address
2018-12-25T11:46:23.975941662Z 78 PC: 1521a | Find first file
2018-12-25T11:46:23.981647315Z 79 PC: 15256 | Find next file
2018-12-25T11:46:23.98398714Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:23.986760002Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:23.989078601Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:23.991426209Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:23.99474146Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:23.997065161Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:23.999325134Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.002313728Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.004374147Z 47 PC: 15282 | Get disk transfer address
2018-12-25T11:46:24.005276741Z 26 PC: 15295 | Set disk transfer address
2018-12-25T11:46:24.006991843Z 78 PC: 152a1 | Find first file
2018-12-25T11:46:24.012722646Z 47 PC: 152c9 | Get disk transfer address
2018-12-25T11:46:24.013711289Z 61 PC: 152e8 | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:46:24.025463045Z 63 PC: 152f8 | Read file or device (Read 3 bytes on handle 5)
2018-12-25T11:46:24.031756213Z 66 PC: 15304 | Move file pointer
2018-12-25T11:46:24.033845058Z 62 PC: 1530d | Close file
2018-12-25T11:46:24.036276471Z 67 PC: 15333 | Get or set file attributes
2018-12-25T11:46:24.052332389Z 61 PC: 1533c | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:46:24.058517822Z 64 PC: 1534c | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:46:24.061196986Z 66 PC: 15358 | Move file pointer
2018-12-25T11:46:24.062658082Z 64 PC: 15367 | Write file or device (Write 1495 bytes on handle 5)
2018-12-25T11:46:24.070829126Z 87 PC: 15376 | Get or set file date and time
2018-12-25T11:46:24.072313831Z 62 PC: 1537e | Close file
2018-12-25T11:46:24.079798657Z 67 PC: 1538f | Get or set file attributes
2018-12-25T11:46:24.089640824Z 26 PC: 152bf | Set disk transfer address
2018-12-25T11:46:24.090751467Z 26 PC: 1526a | Set disk transfer address
2018-12-25T11:46:24.092115581Z 59 PC: 151ea | Change current directory
2018-12-25T11:46:24.093997063Z 71 PC: 151d0 | Get current directory (See above)
2018-12-25T11:46:24.096896587Z 59 PC: 151dc | Change current directory (See above)
2018-12-25T11:46:24.100911596Z 47 PC: 151f9 | Get disk transfer address (See above)
2018-12-25T11:46:24.101842953Z 26 PC: 1520b | Set disk transfer address (See above)
2018-12-25T11:46:24.10290992Z 78 PC: 1521a | Find first file (See above)
2018-12-25T11:46:24.108883164Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.11110394Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.113233868Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.115608965Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.117888256Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.120143693Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.122884479Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.125189893Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.127392422Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.129771705Z 47 PC: 15282 | Get disk transfer address (See above)
2018-12-25T11:46:24.130844949Z 26 PC: 15295 | Set disk transfer address (See above)
2018-12-25T11:46:24.131756383Z 78 PC: 152a1 | Find first file (See above)
2018-12-25T11:46:24.137820247Z 47 PC: 152c9 | Get disk transfer address (See above)
2018-12-25T11:46:24.138937054Z 61 PC: 152e8 | Open file (See above)
2018-12-25T11:46:24.149933218Z 63 PC: 152f8 | Read file or device (See above)
2018-12-25T11:46:24.156791635Z 66 PC: 15304 | Move file pointer (See above)
2018-12-25T11:46:24.157928271Z 62 PC: 1530d | Close file (See above)
2018-12-25T11:46:24.159452601Z 79 PC: 152a1 | Find next file (See above)
2018-12-25T11:46:24.162130304Z 47 PC: 152c9 | Get disk transfer address (See above)
2018-12-25T11:46:24.163044482Z 61 PC: 152e8 | Open file (See above)
2018-12-25T11:46:24.169056846Z 63 PC: 152f8 | Read file or device (See above)
2018-12-25T11:46:24.175319468Z 66 PC: 15304 | Move file pointer (See above)
2018-12-25T11:46:24.176429866Z 62 PC: 1530d | Close file (See above)
2018-12-25T11:46:24.177807804Z 67 PC: 15333 | Get or set file attributes (See above)
2018-12-25T11:46:24.187351661Z 61 PC: 1533c | Open file (See above)
2018-12-25T11:46:24.191345616Z 64 PC: 1534c | Write file or device (See above)
2018-12-25T11:46:24.193149734Z 66 PC: 15358 | Move file pointer (See above)
2018-12-25T11:46:24.195250376Z 64 PC: 15367 | Write file or device (See above)
2018-12-25T11:46:24.204590456Z 87 PC: 15376 | Get or set file date and time (See above)
2018-12-25T11:46:24.20592642Z 62 PC: 1537e | Close file (See above)
2018-12-25T11:46:24.214801632Z 67 PC: 1538f | Get or set file attributes (See above)
2018-12-25T11:46:24.231027473Z 26 PC: 152bf | Set disk transfer address (See above)
2018-12-25T11:46:24.232201869Z 26 PC: 1526a | Set disk transfer address (See above)
2018-12-25T11:46:24.233936545Z 59 PC: 151ea | Change current directory (See above)
2018-12-25T11:46:24.236189275Z 71 PC: 151d0 | Get current directory (See above)
2018-12-25T11:46:24.238332843Z 59 PC: 151dc | Change current directory (See above)
2018-12-25T11:46:24.241587945Z 47 PC: 151f9 | Get disk transfer address (See above)
2018-12-25T11:46:24.242412718Z 26 PC: 1520b | Set disk transfer address (See above)
2018-12-25T11:46:24.243186342Z 78 PC: 1521a | Find first file (See above)
2018-12-25T11:46:24.247307681Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.249654395Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.262736965Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.27092811Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.273320296Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.275783029Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.279453433Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.282199621Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.28478457Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.288071078Z 47 PC: 15282 | Get disk transfer address (See above)
2018-12-25T11:46:24.289274275Z 26 PC: 15295 | Set disk transfer address (See above)
2018-12-25T11:46:24.290533177Z 78 PC: 152a1 | Find first file (See above)
2018-12-25T11:46:24.297385701Z 47 PC: 152c9 | Get disk transfer address (See above)
2018-12-25T11:46:24.298785507Z 61 PC: 152e8 | Open file (See above)
2018-12-25T11:46:24.305170286Z 63 PC: 152f8 | Read file or device (See above)
2018-12-25T11:46:24.311901632Z 66 PC: 15304 | Move file pointer (See above)
2018-12-25T11:46:24.313393533Z 62 PC: 1530d | Close file (See above)
2018-12-25T11:46:24.315397422Z 79 PC: 152a1 | Find next file (See above)
2018-12-25T11:46:24.319021344Z 47 PC: 152c9 | Get disk transfer address (See above)
2018-12-25T11:46:24.319947662Z 61 PC: 152e8 | Open file (See above)
2018-12-25T11:46:24.324144157Z 63 PC: 152f8 | Read file or device (See above)
2018-12-25T11:46:24.328278383Z 66 PC: 15304 | Move file pointer (See above)
2018-12-25T11:46:24.329458427Z 62 PC: 1530d | Close file (See above)
2018-12-25T11:46:24.330617849Z 79 PC: 152a1 | Find next file (See above)
2018-12-25T11:46:24.332554356Z 47 PC: 152c9 | Get disk transfer address (See above)
2018-12-25T11:46:24.333579505Z 61 PC: 152e8 | Open file (See above)
2018-12-25T11:46:24.337593059Z 63 PC: 152f8 | Read file or device (See above)
2018-12-25T11:46:24.341592248Z 66 PC: 15304 | Move file pointer (See above)
2018-12-25T11:46:24.343041179Z 62 PC: 1530d | Close file (See above)
2018-12-25T11:46:24.344355895Z 67 PC: 15333 | Get or set file attributes (See above)
2018-12-25T11:46:24.355751986Z 61 PC: 1533c | Open file (See above)
2018-12-25T11:46:24.362545509Z 64 PC: 1534c | Write file or device (See above)
2018-12-25T11:46:24.364987071Z 66 PC: 15358 | Move file pointer (See above)
2018-12-25T11:46:24.366783549Z 64 PC: 15367 | Write file or device (See above)
2018-12-25T11:46:24.375542866Z 87 PC: 15376 | Get or set file date and time (See above)
2018-12-25T11:46:24.376548116Z 62 PC: 1537e | Close file (See above)
2018-12-25T11:46:24.385117361Z 67 PC: 1538f | Get or set file attributes (See above)
2018-12-25T11:46:24.395195043Z 26 PC: 152bf | Set disk transfer address (See above)
2018-12-25T11:46:24.396647499Z 26 PC: 1526a | Set disk transfer address (See above)
2018-12-25T11:46:24.398105762Z 59 PC: 151ea | Change current directory (See above)
2018-12-25T11:46:24.401081289Z 26 PC: 151ac | Set disk transfer address
2018-12-25T11:46:24.402162783Z 9 PC: 1514b | Display string (String= 'Generic triage goat. ')
2018-12-25T11:46:24.406486927Z 76 PC: 15150 | Terminate with return code (Return code = '0')

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":30,"Second":0,"TimeBased":true,"OriginalID":2758,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:46:24.005419526Z 47 PC: 1517d | Get disk transfer address
2018-12-25T11:46:24.006995437Z 26 PC: 15187 | Set disk transfer address
2018-12-25T11:46:24.008192398Z 44 PC: 1518f | Get time 0x1518f: cmp cl, 0x1e
0x15192: je 0x1539c
0x15196: jmp 0x15199
0x15198: nop
0x15199: mov cx, 3
0x1519c: push cx
0x1519d: call 0x151bd
0x151a0: pop cx
0x151a1: loop 0x1519c
0x151a3: pop dx
0x151a4: push cx
0x151a5: mov cl, 0x1a
0x151a7: mov ah, cl
0x151a9: pop cx
0x151aa: int 0x21
0x151ac: mov sp, bp
0x151ae: xor ax, ax
0x151b0: mov bx, ax
0x151b2: mov cx, ax
0x151b4: mov dx, ax

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":30,"Second":0,"TimeBased":true,"OriginalID":2758,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:46:24.360872107Z 47 PC: 1517d | Get disk transfer address
2018-12-25T11:46:24.362963241Z 26 PC: 15187 | Set disk transfer address
2018-12-25T11:46:24.364038539Z 44 PC: 1518f | Get time 0x1518f: cmp cl, 0x1e
0x15192: je 0x1539c
0x15196: jmp 0x15199
0x15198: nop
0x15199: mov cx, 3
0x1519c: push cx
0x1519d: call 0x151bd
0x151a0: pop cx
0x151a1: loop 0x1519c
0x151a3: pop dx
0x151a4: push cx
0x151a5: mov cl, 0x1a
0x151a7: mov ah, cl
0x151a9: pop cx
0x151aa: int 0x21
0x151ac: mov sp, bp
0x151ae: xor ax, ax
0x151b0: mov bx, ax
0x151b2: mov cx, ax
0x151b4: mov dx, ax

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":2758,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:46:24.588197935Z 47 PC: 1517d | Get disk transfer address
2018-12-25T11:46:24.589635167Z 26 PC: 15187 | Set disk transfer address
2018-12-25T11:46:24.590701075Z 44 PC: 1518f | Get time 0x1518f: cmp cl, 0x1e
0x15192: je 0x1539c
0x15196: jmp 0x15199
0x15198: nop
0x15199: mov cx, 3
0x1519c: push cx
0x1519d: call 0x151bd
0x151a0: pop cx
0x151a1: loop 0x1519c
0x151a3: pop dx
0x151a4: push cx
0x151a5: mov cl, 0x1a
0x151a7: mov ah, cl
0x151a9: pop cx
0x151aa: int 0x21
0x151ac: mov sp, bp
0x151ae: xor ax, ax
0x151b0: mov bx, ax
0x151b2: mov cx, ax
0x151b4: mov dx, ax
2018-12-25T11:46:24.592797712Z 71 PC: 151d0 | Get current directory
2018-12-25T11:46:24.596755627Z 59 PC: 151dc | Change current directory
2018-12-25T11:46:24.600886345Z 47 PC: 151f9 | Get disk transfer address
2018-12-25T11:46:24.602211961Z 26 PC: 1520b | Set disk transfer address
2018-12-25T11:46:24.604209212Z 78 PC: 1521a | Find first file
2018-12-25T11:46:24.610511696Z 79 PC: 15256 | Find next file
2018-12-25T11:46:24.613329262Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.616396792Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.619420314Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.62215566Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.624888812Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.628077559Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.630547132Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.633025083Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.635998159Z 47 PC: 15282 | Get disk transfer address
2018-12-25T11:46:24.637336521Z 26 PC: 15295 | Set disk transfer address
2018-12-25T11:46:24.63865074Z 78 PC: 152a1 | Find first file
2018-12-25T11:46:24.645706246Z 47 PC: 152c9 | Get disk transfer address
2018-12-25T11:46:24.649553598Z 61 PC: 152e8 | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:46:24.657093103Z 63 PC: 152f8 | Read file or device (Read 3 bytes on handle 5)
2018-12-25T11:46:24.664369497Z 66 PC: 15304 | Move file pointer
2018-12-25T11:46:24.665901047Z 62 PC: 1530d | Close file
2018-12-25T11:46:24.6677886Z 67 PC: 15333 | Get or set file attributes
2018-12-25T11:46:24.684341152Z 61 PC: 1533c | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:46:24.690961968Z 64 PC: 1534c | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:46:24.694084298Z 66 PC: 15358 | Move file pointer
2018-12-25T11:46:24.696265783Z 64 PC: 15367 | Write file or device (Write 1495 bytes on handle 5)
2018-12-25T11:46:24.705006774Z 87 PC: 15376 | Get or set file date and time
2018-12-25T11:46:24.706775602Z 62 PC: 1537e | Close file
2018-12-25T11:46:24.715239758Z 67 PC: 1538f | Get or set file attributes
2018-12-25T11:46:24.725480709Z 26 PC: 152bf | Set disk transfer address
2018-12-25T11:46:24.72668379Z 26 PC: 1526a | Set disk transfer address
2018-12-25T11:46:24.728365821Z 59 PC: 151ea | Change current directory
2018-12-25T11:46:24.730821998Z 71 PC: 151d0 | Get current directory (See above)
2018-12-25T11:46:24.734202176Z 59 PC: 151dc | Change current directory (See above)
2018-12-25T11:46:24.739250906Z 47 PC: 151f9 | Get disk transfer address (See above)
2018-12-25T11:46:24.740444599Z 26 PC: 1520b | Set disk transfer address (See above)
2018-12-25T11:46:24.741651688Z 78 PC: 1521a | Find first file (See above)
2018-12-25T11:46:24.748275885Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.751139338Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.753897769Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.75726084Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.760078819Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.762572236Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.765962428Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.76836159Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.770823677Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.774629656Z 47 PC: 15282 | Get disk transfer address (See above)
2018-12-25T11:46:24.77594757Z 26 PC: 15295 | Set disk transfer address (See above)
2018-12-25T11:46:24.777060913Z 78 PC: 152a1 | Find first file (See above)
2018-12-25T11:46:24.783546664Z 47 PC: 152c9 | Get disk transfer address (See above)
2018-12-25T11:46:24.785410007Z 61 PC: 152e8 | Open file (See above)
2018-12-25T11:46:24.792070705Z 63 PC: 152f8 | Read file or device (See above)
2018-12-25T11:46:24.798913833Z 66 PC: 15304 | Move file pointer (See above)
2018-12-25T11:46:24.801375889Z 62 PC: 1530d | Close file (See above)
2018-12-25T11:46:24.803499553Z 79 PC: 152a1 | Find next file (See above)
2018-12-25T11:46:24.807156054Z 47 PC: 152c9 | Get disk transfer address (See above)
2018-12-25T11:46:24.809084751Z 61 PC: 152e8 | Open file (See above)
2018-12-25T11:46:24.816300718Z 63 PC: 152f8 | Read file or device (See above)
2018-12-25T11:46:24.822686534Z 66 PC: 15304 | Move file pointer (See above)
2018-12-25T11:46:24.82459935Z 62 PC: 1530d | Close file (See above)
2018-12-25T11:46:24.826692226Z 67 PC: 15333 | Get or set file attributes (See above)
2018-12-25T11:46:24.836828916Z 61 PC: 1533c | Open file (See above)
2018-12-25T11:46:24.844699647Z 64 PC: 1534c | Write file or device (See above)
2018-12-25T11:46:24.847765811Z 66 PC: 15358 | Move file pointer (See above)
2018-12-25T11:46:24.849447933Z 64 PC: 15367 | Write file or device (See above)
2018-12-25T11:46:24.858656499Z 87 PC: 15376 | Get or set file date and time (See above)
2018-12-25T11:46:24.860041485Z 62 PC: 1537e | Close file (See above)
2018-12-25T11:46:24.86747633Z 67 PC: 1538f | Get or set file attributes (See above)
2018-12-25T11:46:24.874504775Z 26 PC: 152bf | Set disk transfer address (See above)
2018-12-25T11:46:24.875561103Z 26 PC: 1526a | Set disk transfer address (See above)
2018-12-25T11:46:24.876556732Z 59 PC: 151ea | Change current directory (See above)
2018-12-25T11:46:24.878307441Z 71 PC: 151d0 | Get current directory (See above)
2018-12-25T11:46:24.880263894Z 59 PC: 151dc | Change current directory (See above)
2018-12-25T11:46:24.882842044Z 47 PC: 151f9 | Get disk transfer address (See above)
2018-12-25T11:46:24.884303713Z 26 PC: 1520b | Set disk transfer address (See above)
2018-12-25T11:46:24.895574167Z 78 PC: 1521a | Find first file (See above)
2018-12-25T11:46:24.901246543Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.905666245Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.908500146Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.91099063Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.913922483Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.916334642Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.918695862Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.922104976Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.924831896Z 79 PC: 15256 | Find next file (See above)
2018-12-25T11:46:24.927303569Z 47 PC: 15282 | Get disk transfer address (See above)
2018-12-25T11:46:24.929412385Z 26 PC: 15295 | Set disk transfer address (See above)
2018-12-25T11:46:24.931095077Z 78 PC: 152a1 | Find first file (See above)
2018-12-25T11:46:24.937096899Z 47 PC: 152c9 | Get disk transfer address (See above)
2018-12-25T11:46:24.93922247Z 61 PC: 152e8 | Open file (See above)
2018-12-25T11:46:24.951382349Z 63 PC: 152f8 | Read file or device (See above)
2018-12-25T11:46:24.957634106Z 66 PC: 15304 | Move file pointer (See above)
2018-12-25T11:46:24.959644437Z 62 PC: 1530d | Close file (See above)
2018-12-25T11:46:24.961617332Z 79 PC: 152a1 | Find next file (See above)
2018-12-25T11:46:24.96450722Z 47 PC: 152c9 | Get disk transfer address (See above)
2018-12-25T11:46:24.966758757Z 61 PC: 152e8 | Open file (See above)
2018-12-25T11:46:24.973411117Z 63 PC: 152f8 | Read file or device (See above)
2018-12-25T11:46:24.97992251Z 66 PC: 15304 | Move file pointer (See above)
2018-12-25T11:46:24.981960592Z 62 PC: 1530d | Close file (See above)
2018-12-25T11:46:24.984009632Z 79 PC: 152a1 | Find next file (See above)
2018-12-25T11:46:24.986766268Z 47 PC: 152c9 | Get disk transfer address (See above)
2018-12-25T11:46:24.988085507Z 61 PC: 152e8 | Open file (See above)
2018-12-25T11:46:24.995080416Z 63 PC: 152f8 | Read file or device (See above)
2018-12-25T11:46:25.001342581Z 66 PC: 15304 | Move file pointer (See above)
2018-12-25T11:46:25.003234965Z 62 PC: 1530d | Close file (See above)
2018-12-25T11:46:25.005848444Z 67 PC: 15333 | Get or set file attributes (See above)
2018-12-25T11:46:25.01598965Z 61 PC: 1533c | Open file (See above)
2018-12-25T11:46:25.022788224Z 64 PC: 1534c | Write file or device (See above)
2018-12-25T11:46:25.025992107Z 66 PC: 15358 | Move file pointer (See above)
2018-12-25T11:46:25.027919555Z 64 PC: 15367 | Write file or device (See above)
2018-12-25T11:46:25.036349317Z 87 PC: 15376 | Get or set file date and time (See above)
2018-12-25T11:46:25.037919407Z 62 PC: 1537e | Close file (See above)
2018-12-25T11:46:25.045354315Z 67 PC: 1538f | Get or set file attributes (See above)
2018-12-25T11:46:25.054998384Z 26 PC: 152bf | Set disk transfer address (See above)
2018-12-25T11:46:25.056971562Z 26 PC: 1526a | Set disk transfer address (See above)
2018-12-25T11:46:25.058023976Z 59 PC: 151ea | Change current directory (See above)
2018-12-25T11:46:25.059720485Z 26 PC: 151ac | Set disk transfer address
2018-12-25T11:46:25.061486856Z 9 PC: 1514b | Display string (String= 'Generic triage goat. ')
2018-12-25T11:46:25.065531399Z 76 PC: 15150 | Terminate with return code (Return code = '0')