{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":3068,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:48:10.351800413Z | 98 | PC: 12d31 | Get current PSP |
| 2018-12-25T11:48:10.353043959Z | 25 | PC: 12dfb | Get default drive |
| 2018-12-25T11:48:10.35662173Z | 25 | PC: 9f5c6 | Get default drive |
| 2018-12-25T11:48:10.358784193Z | 42 | PC: 9f628 | Get date 0x9f628: cmp dl, 0x15 0x9f62b: jne 0x9f63e 0x9f62d: mov ax, 0x309 0x9f630: mov dx, 0 0x9f633: mov cx, 1 0x9f636: lea bx, word ptr [0x100] 0x9f63a: int 0x13 0x9f63c: jmp 0x9f64f 0x9f63e: mov ax, 0 0x9f641: mov ds, ax 0x9f643: inc word ptr [0x310] 0x9f647: cmp word ptr [0x310], 0x2ff 0x9f64d: jne 0x9f66e 0x9f64f: push cs 0x9f650: pop ds 0x9f651: mov bx, 0x390 0x9f654: mov ah, byte ptr [bx] 0x9f656: xor ah, 0x15 0x9f659: mov byte ptr [bx], ah 0x9f65b: inc bx |
| 2018-12-25T11:48:10.361124467Z | 47 | PC: 9f674 | Get disk transfer address |
| 2018-12-25T11:48:10.362970052Z | 26 | PC: 9f683 | Set disk transfer address |
| 2018-12-25T11:48:10.364218559Z | 78 | PC: 9f68f | Find first file |
| 2018-12-25T11:48:10.370759015Z | 61 | PC: 9f69e | Open file (Filename = '�>?!�u�?!') |
| 2018-12-25T11:48:10.378347217Z | 63 | PC: 9f6c0 | Read file or device (Read 5 bytes on handle 5) |
| 2018-12-25T11:48:10.386124872Z | 62 | PC: 9f6e8 | Close file |
| 2018-12-25T11:48:10.388112536Z | 79 | PC: 9f6ee | Find next file |
| 2018-12-25T11:48:10.391546889Z | 61 | PC: 9f69e | Open file (See above) |
| 2018-12-25T11:48:10.398821646Z | 63 | PC: 9f6c0 | Read file or device (See above) |
| 2018-12-25T11:48:10.405925406Z | 62 | PC: 9f6e8 | Close file (See above) |
| 2018-12-25T11:48:10.408221366Z | 79 | PC: 9f6ee | Find next file (See above) |
| 2018-12-25T11:48:10.411143399Z | 61 | PC: 9f69e | Open file (See above) |
| 2018-12-25T11:48:10.418302544Z | 63 | PC: 9f6c0 | Read file or device (See above) |
| 2018-12-25T11:48:10.425684277Z | 62 | PC: 9f6e8 | Close file (See above) |
| 2018-12-25T11:48:10.427563049Z | 79 | PC: 9f6ee | Find next file (See above) |
| 2018-12-25T11:48:10.430283867Z | 61 | PC: 9f69e | Open file (See above) |
| 2018-12-25T11:48:10.43762402Z | 63 | PC: 9f6c0 | Read file or device (See above) |
| 2018-12-25T11:48:10.445572822Z | 62 | PC: 9f6e8 | Close file (See above) |
| 2018-12-25T11:48:10.447388332Z | 79 | PC: 9f6ee | Find next file (See above) |
| 2018-12-25T11:48:10.450077327Z | 61 | PC: 9f69e | Open file (See above) |
| 2018-12-25T11:48:10.45795105Z | 63 | PC: 9f6c0 | Read file or device (See above) |
| 2018-12-25T11:48:10.46538478Z | 62 | PC: 9f6e8 | Close file (See above) |
| 2018-12-25T11:48:10.467221612Z | 79 | PC: 9f6ee | Find next file (See above) |
| 2018-12-25T11:48:10.471173801Z | 61 | PC: 9f69e | Open file (See above) |
| 2018-12-25T11:48:10.47842648Z | 63 | PC: 9f6c0 | Read file or device (See above) |
| 2018-12-25T11:48:10.485746834Z | 66 | PC: 9f72e | Move file pointer |
| 2018-12-25T11:48:10.488309876Z | 64 | PC: 9f73c | Write file or device (Write 5 bytes on handle 5) |
| 2018-12-25T11:48:10.491139515Z | 66 | PC: 9f745 | Move file pointer |
| 2018-12-25T11:48:10.492435228Z | 64 | PC: 9f755 | Write file or device (Write 1004 bytes on handle 5) |
| 2018-12-25T11:48:10.507997215Z | 62 | PC: 9f75d | Close file |
| 2018-12-25T11:48:10.518044759Z | 26 | PC: 9f774 | Set disk transfer address |
| 2018-12-25T11:48:10.5197242Z | 255 | PC: 12e0f | UNKNOWN! |
| 2018-12-25T11:48:10.529337131Z | 0 | PC: 12a47 | Program terminate |
{"DateBased":true,"Day":21,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":3068,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:48:10.626242662Z | 98 | PC: 12d31 | Get current PSP |
| 2018-12-25T11:48:10.627503725Z | 25 | PC: 12dfb | Get default drive |
| 2018-12-25T11:48:10.628942629Z | 25 | PC: 9f5c6 | Get default drive |
| 2018-12-25T11:48:10.63050135Z | 42 | PC: 9f628 | Get date 0x9f628: cmp dl, 0x15 0x9f62b: jne 0x9f63e 0x9f62d: mov ax, 0x309 0x9f630: mov dx, 0 0x9f633: mov cx, 1 0x9f636: lea bx, word ptr [0x100] 0x9f63a: int 0x13 0x9f63c: jmp 0x9f64f 0x9f63e: mov ax, 0 0x9f641: mov ds, ax 0x9f643: inc word ptr [0x310] 0x9f647: cmp word ptr [0x310], 0x2ff 0x9f64d: jne 0x9f66e 0x9f64f: push cs 0x9f650: pop ds 0x9f651: mov bx, 0x390 0x9f654: mov ah, byte ptr [bx] 0x9f656: xor ah, 0x15 0x9f659: mov byte ptr [bx], ah 0x9f65b: inc bx |
| 2018-12-25T11:48:10.641570124Z | 9 | PC: 9f669 | Display string (String= 'Virus in memory !!! Created by 21.I.1990 - PMG\OTME - Tolbuhin ...') |