Sample viewer

vx.netlux.org/Virus.DOS.Lillehammer.1183

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:23:45.723730434Z 47 PC: 12a6e | Get disk transfer address
2018-12-17T22:23:45.726013024Z 26 PC: 12a76 | Set disk transfer address
2018-12-17T22:23:45.727129412Z 71 PC: 12b44 | Get current directory
2018-12-17T22:23:45.729992067Z 59 PC: 12b4c | Change current directory
2018-12-17T22:23:45.735247483Z 47 PC: 12b61 | Get disk transfer address
2018-12-17T22:23:45.737095235Z 26 PC: 12b6f | Set disk transfer address
2018-12-17T22:23:45.738743903Z 78 PC: 12b7a | Find first file
2018-12-17T22:23:45.746133943Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:45.748190497Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:45.7511155Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:45.753507223Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:45.755860014Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:45.759452327Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:45.766184511Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:45.769383524Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:45.779578087Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:45.781972231Z 47 PC: 12bc6 | Get disk transfer address
2018-12-17T22:23:45.783032576Z 26 PC: 12bd5 | Set disk transfer address
2018-12-17T22:23:45.785295458Z 78 PC: 12bdd | Find first file
2018-12-17T22:23:45.7915287Z 47 PC: 12bf5 | Get disk transfer address
2018-12-17T22:23:45.79265711Z 61 PC: 12c0e | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:23:45.799516855Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:23:45.805709021Z 66 PC: 12c22 | Move file pointer
2018-12-17T22:23:45.806949021Z 62 PC: 12c27 | Close file
2018-12-17T22:23:45.810058908Z 67 PC: 12c47 | Get or set file attributes
2018-12-17T22:23:45.825360087Z 61 PC: 12c4c | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:23:45.829913128Z 64 PC: 12c58 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T22:23:45.832314209Z 66 PC: 12c60 | Move file pointer
2018-12-17T22:23:45.834770928Z 64 PC: 12ef6 | Write file or device (Write 1183 bytes on handle 5)
2018-12-17T22:23:45.844029592Z 87 PC: 12c70 | Get or set file date and time
2018-12-17T22:23:45.84637475Z 62 PC: 12c74 | Close file
2018-12-17T22:23:45.858052973Z 67 PC: 12c81 | Get or set file attributes
2018-12-17T22:23:45.867843657Z 26 PC: 12bef | Set disk transfer address
2018-12-17T22:23:45.868813715Z 26 PC: 12bb2 | Set disk transfer address
2018-12-17T22:23:45.870397367Z 59 PC: 12b56 | Change current directory
2018-12-17T22:23:45.871760997Z 71 PC: 12b44 | Get current directory
2018-12-17T22:23:45.873587533Z 59 PC: 12b4c | Change current directory
2018-12-17T22:23:45.8769682Z 47 PC: 12b61 | Get disk transfer address
2018-12-17T22:23:45.878489818Z 26 PC: 12b6f | Set disk transfer address
2018-12-17T22:23:45.879589589Z 78 PC: 12b7a | Find first file
2018-12-17T22:23:45.885698526Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:45.88757438Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:45.889464094Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:45.891946231Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:45.894354492Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:45.896629597Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:45.899377829Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:45.90128835Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:45.903594032Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:45.906937946Z 47 PC: 12bc6 | Get disk transfer address
2018-12-17T22:23:45.908162344Z 26 PC: 12bd5 | Set disk transfer address
2018-12-17T22:23:45.909173663Z 78 PC: 12bdd | Find first file
2018-12-17T22:23:45.916560358Z 47 PC: 12bf5 | Get disk transfer address
2018-12-17T22:23:45.917688638Z 61 PC: 12c0e | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:23:45.925010417Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:23:45.930741775Z 66 PC: 12c22 | Move file pointer
2018-12-17T22:23:45.932125442Z 62 PC: 12c27 | Close file
2018-12-17T22:23:45.933491106Z 79 PC: 12bdd | Find next file
2018-12-17T22:23:45.93598548Z 47 PC: 12bf5 | Get disk transfer address
2018-12-17T22:23:45.936910886Z 61 PC: 12c0e | Open file (Filename = 'PRINT.COM')
2018-12-17T22:23:45.941090294Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:23:45.945893744Z 66 PC: 12c22 | Move file pointer
2018-12-17T22:23:45.946884843Z 62 PC: 12c27 | Close file
2018-12-17T22:23:45.948110168Z 67 PC: 12c47 | Get or set file attributes
2018-12-17T22:23:45.955444139Z 61 PC: 12c4c | Open file (Filename = 'PRINT.COM')
2018-12-17T22:23:45.959915472Z 64 PC: 12c58 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T22:23:45.961595361Z 66 PC: 12c60 | Move file pointer
2018-12-17T22:23:45.963648026Z 64 PC: 12ef6 | Write file or device (Write 1183 bytes on handle 5)
2018-12-17T22:23:45.970248288Z 87 PC: 12c70 | Get or set file date and time
2018-12-17T22:23:45.97190432Z 62 PC: 12c74 | Close file
2018-12-17T22:23:45.979811485Z 67 PC: 12c81 | Get or set file attributes
2018-12-17T22:23:45.992416484Z 26 PC: 12bef | Set disk transfer address
2018-12-17T22:23:45.993333302Z 26 PC: 12bb2 | Set disk transfer address
2018-12-17T22:23:45.994759802Z 59 PC: 12b56 | Change current directory
2018-12-17T22:23:45.996357769Z 71 PC: 12b44 | Get current directory
2018-12-17T22:23:45.99954196Z 59 PC: 12b4c | Change current directory
2018-12-17T22:23:46.003795444Z 47 PC: 12b61 | Get disk transfer address
2018-12-17T22:23:46.004751921Z 26 PC: 12b6f | Set disk transfer address
2018-12-17T22:23:46.006075591Z 78 PC: 12b7a | Find first file
2018-12-17T22:23:46.012467943Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.014804744Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.017451111Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.020080294Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.022468342Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.024813422Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.027761121Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.030037931Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.032282261Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.035321458Z 47 PC: 12bc6 | Get disk transfer address
2018-12-17T22:23:46.036257296Z 26 PC: 12bd5 | Set disk transfer address
2018-12-17T22:23:46.037258599Z 78 PC: 12bdd | Find first file
2018-12-17T22:23:46.043043966Z 47 PC: 12bf5 | Get disk transfer address
2018-12-17T22:23:46.044624629Z 61 PC: 12c0e | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:23:46.052403423Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:23:46.058645268Z 66 PC: 12c22 | Move file pointer
2018-12-17T22:23:46.060620514Z 62 PC: 12c27 | Close file
2018-12-17T22:23:46.062305546Z 79 PC: 12bdd | Find next file
2018-12-17T22:23:46.06482821Z 47 PC: 12bf5 | Get disk transfer address
2018-12-17T22:23:46.067389211Z 61 PC: 12c0e | Open file (Filename = 'PRINT.COM')
2018-12-17T22:23:46.074328548Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:23:46.080395653Z 66 PC: 12c22 | Move file pointer
2018-12-17T22:23:46.082712336Z 62 PC: 12c27 | Close file
2018-12-17T22:23:46.084741137Z 79 PC: 12bdd | Find next file
2018-12-17T22:23:46.08756582Z 47 PC: 12bf5 | Get disk transfer address
2018-12-17T22:23:46.089634794Z 61 PC: 12c0e | Open file (Filename = 'HELLO.COM')
2018-12-17T22:23:46.096239147Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:23:46.102651972Z 66 PC: 12c22 | Move file pointer
2018-12-17T22:23:46.105020635Z 62 PC: 12c27 | Close file
2018-12-17T22:23:46.107383683Z 67 PC: 12c47 | Get or set file attributes
2018-12-17T22:23:46.117289179Z 61 PC: 12c4c | Open file (Filename = 'HELLO.COM')
2018-12-17T22:23:46.123243619Z 64 PC: 12c58 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T22:23:46.125179743Z 66 PC: 12c60 | Move file pointer
2018-12-17T22:23:46.126714995Z 64 PC: 12ef6 | Write file or device (Write 1183 bytes on handle 5)
2018-12-17T22:23:46.132547063Z 87 PC: 12c70 | Get or set file date and time
2018-12-17T22:23:46.133962964Z 62 PC: 12c74 | Close file
2018-12-17T22:23:46.141380559Z 67 PC: 12c81 | Get or set file attributes
2018-12-17T22:23:46.148433019Z 26 PC: 12bef | Set disk transfer address
2018-12-17T22:23:46.150577824Z 26 PC: 12bb2 | Set disk transfer address
2018-12-17T22:23:46.151662268Z 59 PC: 12b56 | Change current directory
2018-12-17T22:23:46.15417709Z 71 PC: 12b44 | Get current directory
2018-12-17T22:23:46.156636415Z 59 PC: 12b4c | Change current directory
2018-12-17T22:23:46.16005036Z 47 PC: 12b61 | Get disk transfer address
2018-12-17T22:23:46.165332562Z 26 PC: 12b6f | Set disk transfer address
2018-12-17T22:23:46.166466408Z 78 PC: 12b7a | Find first file
2018-12-17T22:23:46.172842901Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.176456123Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.179501578Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.181996339Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.184647678Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.187474301Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.190369655Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.193893256Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.19683504Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.199354819Z 47 PC: 12bc6 | Get disk transfer address
2018-12-17T22:23:46.201029203Z 26 PC: 12bd5 | Set disk transfer address
2018-12-17T22:23:46.202813922Z 78 PC: 12bdd | Find first file
2018-12-17T22:23:46.214196817Z 47 PC: 12bf5 | Get disk transfer address
2018-12-17T22:23:46.215680554Z 61 PC: 12c0e | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:23:46.222228309Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:23:46.228933814Z 66 PC: 12c22 | Move file pointer
2018-12-17T22:23:46.230443299Z 62 PC: 12c27 | Close file
2018-12-17T22:23:46.233885595Z 79 PC: 12bdd | Find next file
2018-12-17T22:23:46.236506592Z 47 PC: 12bf5 | Get disk transfer address
2018-12-17T22:23:46.237842618Z 61 PC: 12c0e | Open file (Filename = 'PRINT.COM')
2018-12-17T22:23:46.244396185Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:23:46.251216982Z 66 PC: 12c22 | Move file pointer
2018-12-17T22:23:46.252846736Z 62 PC: 12c27 | Close file
2018-12-17T22:23:46.255076925Z 79 PC: 12bdd | Find next file
2018-12-17T22:23:46.257704205Z 47 PC: 12bf5 | Get disk transfer address
2018-12-17T22:23:46.258925925Z 61 PC: 12c0e | Open file (Filename = 'HELLO.COM')
2018-12-17T22:23:46.265425333Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:23:46.271442484Z 66 PC: 12c22 | Move file pointer
2018-12-17T22:23:46.272973558Z 62 PC: 12c27 | Close file
2018-12-17T22:23:46.27506874Z 79 PC: 12bdd | Find next file
2018-12-17T22:23:46.277959586Z 47 PC: 12bf5 | Get disk transfer address
2018-12-17T22:23:46.279299299Z 61 PC: 12c0e | Open file (Filename = 'PHANG.COM')
2018-12-17T22:23:46.287087162Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:23:46.293400303Z 66 PC: 12c22 | Move file pointer
2018-12-17T22:23:46.294852021Z 62 PC: 12c27 | Close file
2018-12-17T22:23:46.296701477Z 67 PC: 12c47 | Get or set file attributes
2018-12-17T22:23:46.56053605Z 61 PC: 12c4c | Open file (Filename = 'PHANG.COM')
2018-12-17T22:23:46.568017972Z 64 PC: 12c58 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T22:23:46.571926056Z 66 PC: 12c60 | Move file pointer
2018-12-17T22:23:46.574500368Z 64 PC: 12ef6 | Write file or device (Write 1183 bytes on handle 5)
2018-12-17T22:23:46.583827012Z 87 PC: 12c70 | Get or set file date and time
2018-12-17T22:23:46.585712073Z 62 PC: 12c74 | Close file
2018-12-17T22:23:46.593131834Z 67 PC: 12c81 | Get or set file attributes
2018-12-17T22:23:46.60352848Z 26 PC: 12bef | Set disk transfer address
2018-12-17T22:23:46.604689398Z 26 PC: 12bb2 | Set disk transfer address
2018-12-17T22:23:46.606058987Z 59 PC: 12b56 | Change current directory
2018-12-17T22:23:46.608912211Z 71 PC: 12b44 | Get current directory
2018-12-17T22:23:46.612173695Z 59 PC: 12b4c | Change current directory
2018-12-17T22:23:46.615984669Z 47 PC: 12b61 | Get disk transfer address
2018-12-17T22:23:46.61777189Z 26 PC: 12b6f | Set disk transfer address
2018-12-17T22:23:46.618768172Z 78 PC: 12b7a | Find first file
2018-12-17T22:23:46.624505915Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.62760979Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.630538928Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.632883099Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.635880226Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.638213527Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.640502939Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.643622062Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.64601498Z 79 PC: 12ba2 | Find next file
2018-12-17T22:23:46.648236793Z 47 PC: 12bc6 | Get disk transfer address
2018-12-17T22:23:46.649519116Z 26 PC: 12bd5 | Set disk transfer address
2018-12-17T22:23:46.651833527Z 78 PC: 12bdd | Find first file
2018-12-17T22:23:46.657680946Z 47 PC: 12bf5 | Get disk transfer address
2018-12-17T22:23:46.659252081Z 61 PC: 12c0e | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:23:46.672003578Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:23:46.678532453Z 66 PC: 12c22 | Move file pointer
2018-12-17T22:23:46.680141335Z 62 PC: 12c27 | Close file
2018-12-17T22:23:46.682099303Z 79 PC: 12bdd | Find next file
2018-12-17T22:23:46.683719361Z 47 PC: 12bf5 | Get disk transfer address
2018-12-17T22:23:46.685275216Z 61 PC: 12c0e | Open file (Filename = 'PRINT.COM')
2018-12-17T22:23:46.692252229Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:23:46.698597099Z 66 PC: 12c22 | Move file pointer
2018-12-17T22:23:46.700472055Z 62 PC: 12c27 | Close file
2018-12-17T22:23:46.702151964Z 79 PC: 12bdd | Find next file
2018-12-17T22:23:46.704456149Z 47 PC: 12bf5 | Get disk transfer address
2018-12-17T22:23:46.705737618Z 61 PC: 12c0e | Open file (Filename = 'HELLO.COM')
2018-12-17T22:23:46.711972367Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:23:46.718852678Z 66 PC: 12c22 | Move file pointer
2018-12-17T22:23:46.720735891Z 62 PC: 12c27 | Close file
2018-12-17T22:23:46.722494071Z 79 PC: 12bdd | Find next file
2018-12-17T22:23:46.725432199Z 47 PC: 12bf5 | Get disk transfer address
2018-12-17T22:23:46.727190075Z 61 PC: 12c0e | Open file (Filename = 'PHANG.COM')
2018-12-17T22:23:46.733567746Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:23:46.747312262Z 66 PC: 12c22 | Move file pointer
2018-12-17T22:23:46.749563399Z 62 PC: 12c27 | Close file
2018-12-17T22:23:46.751601648Z 79 PC: 12bdd | Find next file
2018-12-17T22:23:46.754321763Z 47 PC: 12bf5 | Get disk transfer address
2018-12-17T22:23:46.756090216Z 61 PC: 12c0e | Open file (Filename = 'PRINTA~1.COM')
2018-12-17T22:23:46.762661953Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:23:46.769042183Z 66 PC: 12c22 | Move file pointer
2018-12-17T22:23:46.770787098Z 62 PC: 12c27 | Close file
2018-12-17T22:23:46.772007161Z 67 PC: 12c47 | Get or set file attributes
2018-12-17T22:23:46.778078683Z 61 PC: 12c4c | Open file (Filename = 'PRINTA~1.COM')
2018-12-17T22:23:46.784900037Z 64 PC: 12c58 | Write file or device (Write 3 bytes on handle 5)
2018-12-17T22:23:46.78743318Z 66 PC: 12c60 | Move file pointer
2018-12-17T22:23:46.789465981Z 64 PC: 12ef6 | Write file or device (Write 1183 bytes on handle 5)
2018-12-17T22:23:46.806208859Z 87 PC: 12c70 | Get or set file date and time
2018-12-17T22:23:46.80755802Z 62 PC: 12c74 | Close file
2018-12-17T22:23:46.815499894Z 67 PC: 12c81 | Get or set file attributes
2018-12-17T22:23:46.826644154Z 26 PC: 12bef | Set disk transfer address
2018-12-17T22:23:46.827630144Z 26 PC: 12bb2 | Set disk transfer address
2018-12-17T22:23:46.828970161Z 59 PC: 12b56 | Change current directory
2018-12-17T22:23:46.830783714Z 42 PC: 12a89 | Get date 0x12a89: cmp dh, 2
0x12a8c: jb 0x12a9f
0x12a8e: cmp dl, 0xc
0x12a91: jb 0x12a9f
0x12a93: mov ah, 0x2c
0x12a95: int 0x21
0x12a97: cmp dl, 0xa
0x12a9a: ja 0x12a9f
0x12a9c: jmp 0x12ab5
0x12a9e: nop
0x12a9f: pop dx
0x12aa0: mov ah, 0x1a
0x12aa2: int 0x21
0x12aa4: mov sp, bp
0x12aa6: xor ax, ax
0x12aa8: mov bx, ax
0x12aaa: mov cx, ax
0x12aac: mov dx, ax
0x12aae: mov si, ax
0x12ab0: mov di, ax
2018-12-17T22:23:46.833001605Z 44 PC: 12a97 | Get time 0x12a97: cmp dl, 0xa
0x12a9a: ja 0x12a9f
0x12a9c: jmp 0x12ab5
0x12a9e: nop
0x12a9f: pop dx
0x12aa0: mov ah, 0x1a
0x12aa2: int 0x21
0x12aa4: mov sp, bp
0x12aa6: xor ax, ax
0x12aa8: mov bx, ax
0x12aaa: mov cx, ax
0x12aac: mov dx, ax
0x12aae: mov si, ax
0x12ab0: mov di, ax
0x12ab2: mov bp, ax
0x12ab4: ret
0x12ab5: mov ah, 0xf
0x12ab7: int 0x10
0x12ab9: xor ah, ah
0x12abb: int 0x10
2018-12-17T22:23:46.836100989Z 26 PC: 12aa4 | Set disk transfer address

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":4174,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:51:04.278904818Z 47 PC: 12a6e | Get disk transfer address
2018-12-25T11:51:04.281893252Z 26 PC: 12a76 | Set disk transfer address
2018-12-25T11:51:04.282960826Z 71 PC: 12b44 | Get current directory
2018-12-25T11:51:04.285810454Z 59 PC: 12b4c | Change current directory
2018-12-25T11:51:04.289875315Z 47 PC: 12b61 | Get disk transfer address
2018-12-25T11:51:04.290997892Z 26 PC: 12b6f | Set disk transfer address
2018-12-25T11:51:04.291937799Z 78 PC: 12b7a | Find first file
2018-12-25T11:51:04.302316386Z 79 PC: 12ba2 | Find next file
2018-12-25T11:51:04.305077217Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.308344744Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.310823373Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.316132537Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.31841504Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.320692717Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.323536595Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.325821188Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.327858643Z 47 PC: 12bc6 | Get disk transfer address
2018-12-25T11:51:04.329298402Z 26 PC: 12bd5 | Set disk transfer address
2018-12-25T11:51:04.330169913Z 78 PC: 12bdd | Find first file
2018-12-25T11:51:04.335691991Z 47 PC: 12bf5 | Get disk transfer address
2018-12-25T11:51:04.337319476Z 61 PC: 12c0e | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:51:04.343638083Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-25T11:51:04.349705636Z 66 PC: 12c22 | Move file pointer
2018-12-25T11:51:04.351407404Z 62 PC: 12c27 | Close file
2018-12-25T11:51:04.353034746Z 67 PC: 12c47 | Get or set file attributes
2018-12-25T11:51:04.368097478Z 61 PC: 12c4c | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:51:04.375735123Z 64 PC: 12c58 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:51:04.378589122Z 66 PC: 12c60 | Move file pointer
2018-12-25T11:51:04.380982324Z 64 PC: 12ef6 | Write file or device (Write 1183 bytes on handle 5)
2018-12-25T11:51:04.39124391Z 87 PC: 12c70 | Get or set file date and time
2018-12-25T11:51:04.392667752Z 62 PC: 12c74 | Close file
2018-12-25T11:51:04.399466597Z 67 PC: 12c81 | Get or set file attributes
2018-12-25T11:51:04.41182119Z 26 PC: 12bef | Set disk transfer address
2018-12-25T11:51:04.413416769Z 26 PC: 12bb2 | Set disk transfer address
2018-12-25T11:51:04.414540544Z 59 PC: 12b56 | Change current directory
2018-12-25T11:51:04.417239727Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:04.419881534Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:04.423763858Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:04.424734333Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:04.426255566Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:04.436976541Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.43958837Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.442080664Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.444540788Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.446956137Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.450977554Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.453409505Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.45655736Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.459451729Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.461798735Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:04.463076084Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:04.464630929Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:04.470273587Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:04.471282505Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:04.477877409Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:04.484015489Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:04.485285323Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:04.487617689Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:04.490173812Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:04.491189433Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:04.498193186Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:04.50417414Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:04.505356834Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:04.507535379Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:04.517765931Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:04.52431763Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:04.52817332Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:04.530887451Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:04.539883308Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:04.542441307Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:04.550424616Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:04.559992884Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:04.56157967Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:04.562730977Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:04.564515458Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:04.567860919Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:04.570419626Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:04.571228486Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:04.573040154Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:04.579853157Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.581602513Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.584003662Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.586150388Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.588350159Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.590251613Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.592704171Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.594803492Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.597016817Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.599190568Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:04.60009766Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:04.601056176Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:04.606523153Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:04.607374202Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:04.613028179Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:04.619283554Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:04.620463128Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:04.622014474Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:04.624673392Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:04.625519067Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:04.631165635Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:04.63757861Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:04.639134233Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:04.641031022Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:04.643880974Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:04.64483534Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:04.650472749Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:04.65668222Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:04.658021078Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:04.65954607Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:04.668587176Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:04.674207758Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:04.676506757Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:04.678704476Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:04.687213138Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:04.688564669Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:04.696381394Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:04.705823658Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:04.706780858Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:04.708208411Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:04.709759506Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:04.712422084Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:04.721991567Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:04.723495984Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:04.724385565Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:04.733452976Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.735817707Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.738105055Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.740857921Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.743428599Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.745679753Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.748282034Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.750550397Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.752810964Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.755205184Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:04.756099985Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:04.756960758Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:04.762902252Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:04.763818706Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:04.769840251Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:04.776279365Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:04.777682468Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:04.779566482Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:04.78316894Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:04.7840759Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:04.790851043Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:04.797252869Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:04.79848071Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:04.800049162Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:04.802987864Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:04.804011251Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:04.810185463Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:04.81656486Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:04.818426787Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:04.820198472Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:04.823075788Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:04.824115937Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:04.828308269Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:04.832941852Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:04.834168028Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:04.83587273Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:04.846295807Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:04.852546997Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:04.855145348Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:04.857079858Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:04.86464204Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:04.865859758Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:04.872512935Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:04.880898379Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:04.881841904Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:04.882911189Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:04.884401366Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:04.887008374Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:04.890451917Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:04.891307555Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:04.892427234Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:04.902169001Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.904317255Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.907474417Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.909570467Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.91165271Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.914040531Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.916788605Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.919522956Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.931278989Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.933255709Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:04.934302634Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:04.936406072Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:04.942177193Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:04.943414521Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:04.95752278Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:04.963918647Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:04.965221883Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:04.967796298Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:04.970981467Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:04.972484113Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:04.979805792Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:04.986846064Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:04.988673309Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:04.991726799Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:04.994636026Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:04.997489822Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.004619244Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.011458811Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.014039752Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.016074618Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.018510545Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.020099469Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.024919714Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.02938612Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.0311925Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.032761168Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.035279359Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.036842138Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.043457658Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.049680175Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.051548368Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.053212024Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:05.062701955Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:05.069520439Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:05.072212719Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:05.075042972Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:05.084686126Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:05.086432234Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:05.093892588Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:05.103739979Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:05.107035531Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:05.107955677Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:05.110130185Z 42 PC: 12a89 | Get date 0x12a89: cmp dh, 2
0x12a8c: jb 0x12a9f
0x12a8e: cmp dl, 0xc
0x12a91: jb 0x12a9f
0x12a93: mov ah, 0x2c
0x12a95: int 0x21
0x12a97: cmp dl, 0xa
0x12a9a: ja 0x12a9f
0x12a9c: jmp 0x12ab5
0x12a9e: nop
0x12a9f: pop dx
0x12aa0: mov ah, 0x1a
0x12aa2: int 0x21
0x12aa4: mov sp, bp
0x12aa6: xor ax, ax
0x12aa8: mov bx, ax
0x12aaa: mov cx, ax
0x12aac: mov dx, ax
0x12aae: mov si, ax
0x12ab0: mov di, ax
2018-12-25T11:51:05.112138165Z 26 PC: 12aa4 | Set disk transfer address

{"DateBased":true,"Day":1,"Month":2,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":4174,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:51:04.418581397Z 47 PC: 12a6e | Get disk transfer address
2018-12-25T11:51:04.4209578Z 26 PC: 12a76 | Set disk transfer address
2018-12-25T11:51:04.423981089Z 71 PC: 12b44 | Get current directory
2018-12-25T11:51:04.427367898Z 59 PC: 12b4c | Change current directory
2018-12-25T11:51:04.432232612Z 47 PC: 12b61 | Get disk transfer address
2018-12-25T11:51:04.434359124Z 26 PC: 12b6f | Set disk transfer address
2018-12-25T11:51:04.436457482Z 78 PC: 12b7a | Find first file
2018-12-25T11:51:04.449538497Z 79 PC: 12ba2 | Find next file
2018-12-25T11:51:04.453094247Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.456524874Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.459522359Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.467063818Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.474756388Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.477913976Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.481182589Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.485140519Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.488053904Z 47 PC: 12bc6 | Get disk transfer address
2018-12-25T11:51:04.48960413Z 26 PC: 12bd5 | Set disk transfer address
2018-12-25T11:51:04.491794978Z 78 PC: 12bdd | Find first file
2018-12-25T11:51:04.49894921Z 47 PC: 12bf5 | Get disk transfer address
2018-12-25T11:51:04.500384129Z 61 PC: 12c0e | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:51:04.508817238Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-25T11:51:04.516568939Z 66 PC: 12c22 | Move file pointer
2018-12-25T11:51:04.518111719Z 62 PC: 12c27 | Close file
2018-12-25T11:51:04.521209145Z 67 PC: 12c47 | Get or set file attributes
2018-12-25T11:51:04.538494029Z 61 PC: 12c4c | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:51:04.546140644Z 64 PC: 12c58 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:51:04.549327291Z 66 PC: 12c60 | Move file pointer
2018-12-25T11:51:04.551684082Z 64 PC: 12ef6 | Write file or device (Write 1183 bytes on handle 5)
2018-12-25T11:51:04.561778248Z 87 PC: 12c70 | Get or set file date and time
2018-12-25T11:51:04.563642341Z 62 PC: 12c74 | Close file
2018-12-25T11:51:04.572832177Z 67 PC: 12c81 | Get or set file attributes
2018-12-25T11:51:04.58461165Z 26 PC: 12bef | Set disk transfer address
2018-12-25T11:51:04.585735723Z 26 PC: 12bb2 | Set disk transfer address
2018-12-25T11:51:04.587385509Z 59 PC: 12b56 | Change current directory
2018-12-25T11:51:04.588909001Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:04.591277907Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:04.608531269Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:04.609704166Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:04.610786394Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:04.616201883Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.618288656Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.620856012Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.623098911Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.626171983Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.629004757Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.632050936Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.635888383Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.638897301Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.641740529Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:04.643473554Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:04.644689067Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:04.651401966Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:04.653475405Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:04.660665561Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:04.667831937Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:04.670530632Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:04.672531459Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:04.676263584Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:04.677962218Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:04.685643005Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:04.692895033Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:04.695397831Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:04.697405749Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:04.708702363Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:04.71735334Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:04.720955627Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:04.723882959Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:04.734993133Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:04.737487485Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:04.746989655Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:04.758070135Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:04.760810246Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:04.762501469Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:04.764976553Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:04.769079777Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:04.773594798Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:04.774727318Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:04.776395384Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:04.782834003Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.785466207Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.789134611Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.791775226Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.794876554Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.798237183Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.80114374Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.803758544Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.806361048Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.8101464Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:04.811237258Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:04.812279763Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:04.819455249Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:04.820593696Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:04.828366897Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:04.832062424Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:04.833675999Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:04.835885727Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:04.840421935Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:04.841597261Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:04.848606059Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:04.856060604Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:04.857515765Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:04.859359455Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:04.865293715Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:04.866598757Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:04.874300227Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:04.883969186Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:04.886303336Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:04.893482132Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:04.905141258Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:04.913444412Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:04.91642054Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:04.918766344Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:04.929092591Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:04.930559955Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:04.93916683Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:04.95254335Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:04.954115006Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:04.955499391Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:04.958236316Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:04.961699728Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:04.96651459Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:04.968463924Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:04.969840193Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:04.976454954Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.979632779Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.982781376Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.985621796Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.988722163Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.991395397Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.994205683Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.997614746Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.000278647Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.002722276Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:05.004658508Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:05.005708781Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:05.01193096Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.014105699Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.022767011Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.025584191Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.027793159Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.02976999Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.032680821Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.034495876Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.041742779Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.044833935Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.047495135Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.049879291Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.052850931Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.054989866Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.062352254Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.070294852Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.07301665Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.075115922Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.078002873Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.079623499Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.088158006Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.095328229Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.097661074Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.10007948Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:05.111766141Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:05.119661838Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:05.122761336Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:05.125140248Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:05.13662531Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:05.138439253Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:05.147418526Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:05.160684075Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:05.162992135Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:05.164094971Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:05.165923755Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:05.169948185Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:05.174781301Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:05.176429535Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:05.178514072Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:05.185256094Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.188424505Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.193208822Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.196421907Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.199602827Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.203694714Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.20655764Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.209378235Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.214127513Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.216596226Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:05.217594464Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:05.219168922Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:05.226489197Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.227820403Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.23636796Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.239156654Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.240640127Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.242762908Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.245759077Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.247066253Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.254923522Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.257632612Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.259024346Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.263085491Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.266096171Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.268466469Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.275901279Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.280138126Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.281581915Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.283781954Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.287079207Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.289041818Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.2985386Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.306700978Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.308740709Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.311782845Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.314711595Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.31593204Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.325484893Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.333131976Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.335119028Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.339328377Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:05.351012347Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:05.359151923Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:05.364250811Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:05.366737652Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:05.377378032Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:05.380397307Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:05.386522958Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:05.398256473Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:05.401289235Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:05.402771031Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:05.404801077Z 42 PC: 12a89 | Get date 0x12a89: cmp dh, 2
0x12a8c: jb 0x12a9f
0x12a8e: cmp dl, 0xc
0x12a91: jb 0x12a9f
0x12a93: mov ah, 0x2c
0x12a95: int 0x21
0x12a97: cmp dl, 0xa
0x12a9a: ja 0x12a9f
0x12a9c: jmp 0x12ab5
0x12a9e: nop
0x12a9f: pop dx
0x12aa0: mov ah, 0x1a
0x12aa2: int 0x21
0x12aa4: mov sp, bp
0x12aa6: xor ax, ax
0x12aa8: mov bx, ax
0x12aaa: mov cx, ax
0x12aac: mov dx, ax
0x12aae: mov si, ax
0x12ab0: mov di, ax
2018-12-25T11:51:05.40882138Z 26 PC: 12aa4 | Set disk transfer address

{"DateBased":true,"Day":12,"Month":2,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":4174,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:51:04.682648327Z 47 PC: 12a6e | Get disk transfer address
2018-12-25T11:51:04.68428971Z 26 PC: 12a76 | Set disk transfer address
2018-12-25T11:51:04.685179992Z 71 PC: 12b44 | Get current directory
2018-12-25T11:51:04.687806639Z 59 PC: 12b4c | Change current directory
2018-12-25T11:51:04.692849914Z 47 PC: 12b61 | Get disk transfer address
2018-12-25T11:51:04.693780923Z 26 PC: 12b6f | Set disk transfer address
2018-12-25T11:51:04.694658681Z 78 PC: 12b7a | Find first file
2018-12-25T11:51:04.700742339Z 79 PC: 12ba2 | Find next file
2018-12-25T11:51:04.703143289Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.705515021Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.708640641Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.711001163Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.71331584Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.728012166Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.730343222Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.732606507Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.734866567Z 47 PC: 12bc6 | Get disk transfer address
2018-12-25T11:51:04.736001884Z 26 PC: 12bd5 | Set disk transfer address
2018-12-25T11:51:04.736714849Z 78 PC: 12bdd | Find first file
2018-12-25T11:51:04.740594636Z 47 PC: 12bf5 | Get disk transfer address
2018-12-25T11:51:04.741980453Z 61 PC: 12c0e | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:51:04.753051103Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-25T11:51:04.759363318Z 66 PC: 12c22 | Move file pointer
2018-12-25T11:51:04.760982907Z 62 PC: 12c27 | Close file
2018-12-25T11:51:04.762157398Z 67 PC: 12c47 | Get or set file attributes
2018-12-25T11:51:04.774560637Z 61 PC: 12c4c | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:51:04.779408943Z 64 PC: 12c58 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:51:04.781362438Z 66 PC: 12c60 | Move file pointer
2018-12-25T11:51:04.783547025Z 64 PC: 12ef6 | Write file or device (Write 1183 bytes on handle 5)
2018-12-25T11:51:04.797963095Z 87 PC: 12c70 | Get or set file date and time
2018-12-25T11:51:04.799395617Z 62 PC: 12c74 | Close file
2018-12-25T11:51:04.804335393Z 67 PC: 12c81 | Get or set file attributes
2018-12-25T11:51:04.811627179Z 26 PC: 12bef | Set disk transfer address
2018-12-25T11:51:04.812369297Z 26 PC: 12bb2 | Set disk transfer address
2018-12-25T11:51:04.813057714Z 59 PC: 12b56 | Change current directory
2018-12-25T11:51:04.814768812Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:04.819661286Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:04.825514825Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:04.826887518Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:04.828693038Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:04.836614893Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.839437074Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.841610377Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.843717442Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.846437286Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.848927753Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.851299988Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.854893514Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.857274538Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.859435508Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:04.860756881Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:04.861770707Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:04.867594807Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:04.869273784Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:04.875544442Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:04.881646722Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:04.88371122Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:04.885277806Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:04.887835659Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:04.889527853Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:04.896467069Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:04.902994701Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:04.904364905Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:04.906372813Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:04.916144871Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:04.92279624Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:04.925474275Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:04.927487268Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:04.936826853Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:04.938419412Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:04.94624274Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:04.956221619Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:04.957998446Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:04.959039947Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:04.961416143Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:04.964424753Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:04.968214834Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:04.969229139Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:04.970772909Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:04.976448589Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.978751259Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.981755269Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.984739106Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.987189479Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.990769123Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.993460842Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.996124542Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:04.999150829Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.001493079Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:05.002829044Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:05.004442481Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:05.009947855Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.011075387Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.017100293Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.019815804Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.021107345Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.023439822Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.025988699Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.0271084Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.034937991Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.04120437Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.042426407Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.044435736Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.046997241Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.048484068Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.055631549Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.061897502Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.063595038Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.066179733Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:05.07653661Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:05.082959922Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:05.086138262Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:05.088917745Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:05.09836415Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:05.103745982Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:05.112200801Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:05.121824753Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:05.124000037Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:05.125030004Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:05.12673902Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:05.130097366Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:05.134682718Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:05.135868535Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:05.137516739Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:05.143465443Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.145944846Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.149112859Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.15125459Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.153976927Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.157345836Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.159825757Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.162256833Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.16511072Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.167307689Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:05.168584584Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:05.172333721Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:05.178704006Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.179731986Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.186513698Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.188868523Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.190154469Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.192302024Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.194854457Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.195841398Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.212620084Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.214532054Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.215758921Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.218886813Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.221425857Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.222501217Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.230225935Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.236500288Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.238037717Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.240749699Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.245000256Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.246382695Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.253280993Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.259547265Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.260793335Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.263405824Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:05.273591187Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:05.281080091Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:05.284557468Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:05.287057625Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:05.296567583Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:05.299522712Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:05.308407868Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:05.318777111Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:05.320096735Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:05.321553132Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:05.323682956Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:05.326822192Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:05.33057725Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:05.331799419Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:05.333748789Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:05.339809381Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.343130967Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.345643367Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.34798013Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.351143749Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.355108941Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.357428375Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.360640728Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.36294695Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.365146408Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:05.366410902Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:05.372256875Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:05.379020418Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.38036686Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.386268901Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.388233806Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.389644243Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.39111954Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.393075801Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.394190221Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.398491556Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.400249921Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.401598207Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.402842604Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.404558319Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.405701098Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.40997919Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.411748653Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.413249638Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.414546186Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.416346604Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.41784916Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.422464934Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.428175354Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.431600191Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.433618533Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.436570312Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.438513062Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.445131769Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.451589779Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.453893663Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.456320984Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:05.466521314Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:05.473976516Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:05.476801247Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:05.479142802Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:05.488627883Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:05.490143751Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:05.497959837Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:05.507979097Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:05.509155378Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:05.51055303Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:05.512384147Z 42 PC: 12a89 | Get date 0x12a89: cmp dh, 2
0x12a8c: jb 0x12a9f
0x12a8e: cmp dl, 0xc
0x12a91: jb 0x12a9f
0x12a93: mov ah, 0x2c
0x12a95: int 0x21
0x12a97: cmp dl, 0xa
0x12a9a: ja 0x12a9f
0x12a9c: jmp 0x12ab5
0x12a9e: nop
0x12a9f: pop dx
0x12aa0: mov ah, 0x1a
0x12aa2: int 0x21
0x12aa4: mov sp, bp
0x12aa6: xor ax, ax
0x12aa8: mov bx, ax
0x12aaa: mov cx, ax
0x12aac: mov dx, ax
0x12aae: mov si, ax
0x12ab0: mov di, ax
2018-12-25T11:51:05.514383857Z 44 PC: 12a97 | Get time 0x12a97: cmp dl, 0xa
0x12a9a: ja 0x12a9f
0x12a9c: jmp 0x12ab5
0x12a9e: nop
0x12a9f: pop dx
0x12aa0: mov ah, 0x1a
0x12aa2: int 0x21
0x12aa4: mov sp, bp
0x12aa6: xor ax, ax
0x12aa8: mov bx, ax
0x12aaa: mov cx, ax
0x12aac: mov dx, ax
0x12aae: mov si, ax
0x12ab0: mov di, ax
0x12ab2: mov bp, ax
0x12ab4: ret
0x12ab5: mov ah, 0xf
0x12ab7: int 0x10
0x12ab9: xor ah, ah
0x12abb: int 0x10
2018-12-25T11:51:05.51677982Z 26 PC: 12aa4 | Set disk transfer address

{"DateBased":true,"Day":1,"Month":2,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":4174,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:51:04.987294294Z 47 PC: 12a6e | Get disk transfer address
2018-12-25T11:51:04.98905703Z 26 PC: 12a76 | Set disk transfer address
2018-12-25T11:51:04.990087887Z 71 PC: 12b44 | Get current directory
2018-12-25T11:51:04.99297278Z 59 PC: 12b4c | Change current directory
2018-12-25T11:51:04.997499376Z 47 PC: 12b61 | Get disk transfer address
2018-12-25T11:51:04.998505507Z 26 PC: 12b6f | Set disk transfer address
2018-12-25T11:51:04.999653106Z 78 PC: 12b7a | Find first file
2018-12-25T11:51:05.006185328Z 79 PC: 12ba2 | Find next file
2018-12-25T11:51:05.008637414Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.011177114Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.016752451Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.019185275Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.021531574Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.024178309Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.03727562Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.03956346Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.041639307Z 47 PC: 12bc6 | Get disk transfer address
2018-12-25T11:51:05.043200879Z 26 PC: 12bd5 | Set disk transfer address
2018-12-25T11:51:05.044067279Z 78 PC: 12bdd | Find first file
2018-12-25T11:51:05.049518682Z 47 PC: 12bf5 | Get disk transfer address
2018-12-25T11:51:05.05149847Z 61 PC: 12c0e | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:51:05.063370794Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-25T11:51:05.071352657Z 66 PC: 12c22 | Move file pointer
2018-12-25T11:51:05.073356485Z 62 PC: 12c27 | Close file
2018-12-25T11:51:05.075177322Z 67 PC: 12c47 | Get or set file attributes
2018-12-25T11:51:05.089981997Z 61 PC: 12c4c | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:51:05.094383349Z 64 PC: 12c58 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:51:05.096188783Z 66 PC: 12c60 | Move file pointer
2018-12-25T11:51:05.097814025Z 64 PC: 12ef6 | Write file or device (Write 1183 bytes on handle 5)
2018-12-25T11:51:05.10677399Z 87 PC: 12c70 | Get or set file date and time
2018-12-25T11:51:05.108630513Z 62 PC: 12c74 | Close file
2018-12-25T11:51:05.116217417Z 67 PC: 12c81 | Get or set file attributes
2018-12-25T11:51:05.126338144Z 26 PC: 12bef | Set disk transfer address
2018-12-25T11:51:05.127480051Z 26 PC: 12bb2 | Set disk transfer address
2018-12-25T11:51:05.128772487Z 59 PC: 12b56 | Change current directory
2018-12-25T11:51:05.132657196Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:05.135646305Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:05.139480447Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:05.141425937Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:05.142500907Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:05.149303786Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.152104509Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.154548862Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.156834482Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.15953741Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.162319596Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.165121925Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.168330541Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.171075271Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.173559651Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:05.176068735Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:05.177081978Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:05.182760858Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.1842992Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.190759299Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.19696778Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.198846093Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.200710545Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.203901275Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.204947552Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.211405998Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.217407046Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.219045688Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.220838945Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:05.230728719Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:05.237278669Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:05.240067931Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:05.242067033Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:05.251298645Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:05.261380974Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:05.269332215Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:05.280142275Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:05.282612346Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:05.283999124Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:05.286017038Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:05.289399253Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:05.293509494Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:05.295048086Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:05.296627728Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:05.302612022Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.305060732Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.308034073Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.310507093Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.312970923Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.316447404Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.319157527Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.321718632Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.325078383Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.327351204Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:05.333664011Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:05.335872406Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:05.342222202Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.343781361Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.350825733Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.353450396Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.354879334Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.357114806Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.36000952Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.361122619Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.367740181Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.373774072Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.375121789Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.377681627Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.380480268Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.38170292Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.388561641Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.394923464Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.396325481Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.398681987Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:05.409846153Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:05.416645261Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:05.420291061Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:05.422453315Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:05.431436108Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:05.433806964Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:05.441485947Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:05.451503798Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:05.453590298Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:05.454812076Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:05.456901412Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:05.461178084Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:05.470067305Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:05.471136361Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:05.473123439Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:05.482500326Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.485102252Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.488059101Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.490668813Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.49315286Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.496507103Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.498895668Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.501480134Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.505469481Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.50778156Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:05.508826834Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:05.510221093Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:05.515899032Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.51696215Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.524801742Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.531448919Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.532714308Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.540474505Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.543123867Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.544374075Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.552610437Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.559256489Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.560653951Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.563047416Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.565822912Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.56690869Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.573741101Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.580051841Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.581596385Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.584130603Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.586785541Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.587782731Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.59510719Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.599736062Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.600837031Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.602742221Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:05.612738155Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:05.61988692Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:05.623525413Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:05.625027744Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:05.63353425Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:05.635576652Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:05.642833668Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:05.652414742Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:05.655750363Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:05.657092268Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:05.659178388Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:05.663212829Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:05.667328562Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:05.668668946Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:05.671055657Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:05.682044853Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.685345345Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.688657732Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.690740374Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.69318284Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.696174905Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.699111938Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.702409237Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.706157567Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.708836293Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:05.710363144Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:05.712907212Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:05.719608233Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.721012319Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.728691234Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.735434231Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.737051223Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.740394629Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.743311205Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.745432673Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.753111277Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.760139751Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.761810661Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.763812737Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.766033001Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.767086957Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.772829767Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.778205726Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.780153361Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.782247461Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.785170238Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.789267387Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.796665866Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.803518151Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.805851063Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.808294059Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.811707354Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.814548909Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.822241084Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.829774889Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.84048454Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.842687421Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:05.850979625Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:05.856099437Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:05.858039234Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:05.859746065Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:05.867166769Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:05.868277852Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:05.873498422Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:05.882220415Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:05.88321617Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:05.884102519Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:05.886078064Z 42 PC: 12a89 | Get date 0x12a89: cmp dh, 2
0x12a8c: jb 0x12a9f
0x12a8e: cmp dl, 0xc
0x12a91: jb 0x12a9f
0x12a93: mov ah, 0x2c
0x12a95: int 0x21
0x12a97: cmp dl, 0xa
0x12a9a: ja 0x12a9f
0x12a9c: jmp 0x12ab5
0x12a9e: nop
0x12a9f: pop dx
0x12aa0: mov ah, 0x1a
0x12aa2: int 0x21
0x12aa4: mov sp, bp
0x12aa6: xor ax, ax
0x12aa8: mov bx, ax
0x12aaa: mov cx, ax
0x12aac: mov dx, ax
0x12aae: mov si, ax
0x12ab0: mov di, ax
2018-12-25T11:51:05.887651729Z 26 PC: 12aa4 | Set disk transfer address

{"DateBased":true,"Day":12,"Month":2,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":4174,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:51:05.312527519Z 47 PC: 12a6e | Get disk transfer address
2018-12-25T11:51:05.314741676Z 26 PC: 12a76 | Set disk transfer address
2018-12-25T11:51:05.316306932Z 71 PC: 12b44 | Get current directory
2018-12-25T11:51:05.319387843Z 59 PC: 12b4c | Change current directory
2018-12-25T11:51:05.324190414Z 47 PC: 12b61 | Get disk transfer address
2018-12-25T11:51:05.325297363Z 26 PC: 12b6f | Set disk transfer address
2018-12-25T11:51:05.32636472Z 78 PC: 12b7a | Find first file
2018-12-25T11:51:05.332383666Z 79 PC: 12ba2 | Find next file
2018-12-25T11:51:05.335578242Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.3380209Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.340357452Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.34356027Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.346063411Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.34849582Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.353460565Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.356048617Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.358565119Z 47 PC: 12bc6 | Get disk transfer address
2018-12-25T11:51:05.365617056Z 26 PC: 12bd5 | Set disk transfer address
2018-12-25T11:51:05.366597129Z 78 PC: 12bdd | Find first file
2018-12-25T11:51:05.372870196Z 47 PC: 12bf5 | Get disk transfer address
2018-12-25T11:51:05.374155907Z 61 PC: 12c0e | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:51:05.380342514Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-25T11:51:05.386323573Z 66 PC: 12c22 | Move file pointer
2018-12-25T11:51:05.39250774Z 62 PC: 12c27 | Close file
2018-12-25T11:51:05.394215055Z 67 PC: 12c47 | Get or set file attributes
2018-12-25T11:51:05.409424393Z 61 PC: 12c4c | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:51:05.416426581Z 64 PC: 12c58 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:51:05.419351328Z 66 PC: 12c60 | Move file pointer
2018-12-25T11:51:05.421359769Z 64 PC: 12ef6 | Write file or device (Write 1183 bytes on handle 5)
2018-12-25T11:51:05.431573668Z 87 PC: 12c70 | Get or set file date and time
2018-12-25T11:51:05.432978683Z 62 PC: 12c74 | Close file
2018-12-25T11:51:05.441079742Z 67 PC: 12c81 | Get or set file attributes
2018-12-25T11:51:05.452583881Z 26 PC: 12bef | Set disk transfer address
2018-12-25T11:51:05.453718148Z 26 PC: 12bb2 | Set disk transfer address
2018-12-25T11:51:05.455226568Z 59 PC: 12b56 | Change current directory
2018-12-25T11:51:05.464093124Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:05.466853235Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:05.470703233Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:05.472462523Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:05.47337548Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:05.478863249Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.481776043Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.484536996Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.487118566Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.489539919Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.492214024Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.494587739Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.496894954Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.500092024Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.502306166Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:05.503389293Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:05.505014397Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:05.510631181Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.511679834Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.524290323Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.530968433Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.532719712Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.535798529Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.538730827Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.540101696Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.548323609Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.555214026Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.556876623Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.559830921Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:05.570186431Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:05.577060685Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:05.580499919Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:05.582505347Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:05.592590478Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:05.59483213Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:05.603756413Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:05.613221663Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:05.615396222Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:05.617060803Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:05.618802717Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:05.622008059Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:05.625916798Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:05.626976781Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:05.62866337Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:05.64146822Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.643650213Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.646487222Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.649672867Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.652396038Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.655251737Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.65926726Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.661742941Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.664358785Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.667822435Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:05.669142537Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:05.670417489Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:05.677011714Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.678413853Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.684919831Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.692812457Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.694039867Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.695642116Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.698594438Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.699768399Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.706447746Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.713680169Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.715225756Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.716910158Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.719759582Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.720706496Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.728267792Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.736072467Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.737635713Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.739751537Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:05.751321778Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:05.761802134Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:05.766590993Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:05.769504688Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:05.780497992Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:05.782087709Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:05.790366469Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:05.812768195Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:05.814252355Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:05.816280065Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:05.828225715Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:05.831999377Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:05.837940441Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:05.840199808Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:05.84150269Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:05.84946447Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.85255862Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.854879099Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.85847023Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.860896706Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.863504024Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.866626717Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.870670199Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.875130406Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.88183684Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:05.883121242Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:05.88429408Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:05.891256802Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.893060917Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.89968244Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.903384413Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.904804411Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.906709691Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.910303431Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.911752294Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.918583755Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.921744895Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.923068421Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.92544285Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.929471597Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.931042082Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.937830795Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.944663349Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.94623189Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.948236028Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.951128195Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.95272109Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.959199157Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.967587458Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.969976949Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.971755507Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:05.981947144Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:05.989880194Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:05.992604169Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:05.994735895Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:06.004745534Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:06.006221765Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:06.013866993Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:06.02499437Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:06.026159297Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:06.027644678Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:06.030824336Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:06.033631212Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:06.037960932Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:06.039427707Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:06.04046395Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:06.051059061Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.053973295Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.056400669Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.058984869Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.061755984Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.06435842Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.067721797Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.071487207Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.074027887Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.076638341Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:06.078411469Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:06.080118612Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:06.085822581Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:06.087319971Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:06.094000612Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:06.101102723Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:06.102981176Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:06.104561375Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:06.10718619Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:06.110634437Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:06.11632064Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:06.123491702Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:06.125274101Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:06.127350584Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:06.131067666Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:06.132219427Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:06.137868065Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:06.145921555Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:06.147185256Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:06.148655438Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:06.152342946Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:06.153615893Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:06.160111509Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:06.166543117Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:06.167806022Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:06.16934677Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:06.172341474Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:06.173401191Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:06.179183312Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:06.185753371Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:06.187045815Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:06.18879296Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:06.198121116Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:06.204009624Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:06.206377908Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:06.209053227Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:06.217877775Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:06.219132381Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:06.225791999Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:06.234909527Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:06.235796127Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:06.237300758Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:06.238758982Z 42 PC: 12a89 | Get date 0x12a89: cmp dh, 2
0x12a8c: jb 0x12a9f
0x12a8e: cmp dl, 0xc
0x12a91: jb 0x12a9f
0x12a93: mov ah, 0x2c
0x12a95: int 0x21
0x12a97: cmp dl, 0xa
0x12a9a: ja 0x12a9f
0x12a9c: jmp 0x12ab5
0x12a9e: nop
0x12a9f: pop dx
0x12aa0: mov ah, 0x1a
0x12aa2: int 0x21
0x12aa4: mov sp, bp
0x12aa6: xor ax, ax
0x12aa8: mov bx, ax
0x12aaa: mov cx, ax
0x12aac: mov dx, ax
0x12aae: mov si, ax
0x12ab0: mov di, ax
2018-12-25T11:51:06.24056383Z 44 PC: 12a97 | Get time 0x12a97: cmp dl, 0xa
0x12a9a: ja 0x12a9f
0x12a9c: jmp 0x12ab5
0x12a9e: nop
0x12a9f: pop dx
0x12aa0: mov ah, 0x1a
0x12aa2: int 0x21
0x12aa4: mov sp, bp
0x12aa6: xor ax, ax
0x12aa8: mov bx, ax
0x12aaa: mov cx, ax
0x12aac: mov dx, ax
0x12aae: mov si, ax
0x12ab0: mov di, ax
0x12ab2: mov bp, ax
0x12ab4: ret
0x12ab5: mov ah, 0xf
0x12ab7: int 0x10
0x12ab9: xor ah, ah
0x12abb: int 0x10
2018-12-25T11:51:06.242980825Z 26 PC: 12aa4 | Set disk transfer address

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":4174,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:51:05.400278082Z 47 PC: 12a6e | Get disk transfer address
2018-12-25T11:51:05.40166175Z 26 PC: 12a76 | Set disk transfer address
2018-12-25T11:51:05.403473569Z 71 PC: 12b44 | Get current directory
2018-12-25T11:51:05.406995541Z 59 PC: 12b4c | Change current directory
2018-12-25T11:51:05.412591018Z 47 PC: 12b61 | Get disk transfer address
2018-12-25T11:51:05.415300515Z 26 PC: 12b6f | Set disk transfer address
2018-12-25T11:51:05.416715191Z 78 PC: 12b7a | Find first file
2018-12-25T11:51:05.423714432Z 79 PC: 12ba2 | Find next file
2018-12-25T11:51:05.428153118Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.431954106Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.435237932Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.440152233Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.442726346Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.445625443Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.448552951Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.465115595Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.470204523Z 47 PC: 12bc6 | Get disk transfer address
2018-12-25T11:51:05.472051113Z 26 PC: 12bd5 | Set disk transfer address
2018-12-25T11:51:05.473916146Z 78 PC: 12bdd | Find first file
2018-12-25T11:51:05.477943509Z 47 PC: 12bf5 | Get disk transfer address
2018-12-25T11:51:05.478962947Z 61 PC: 12c0e | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:51:05.484236491Z 63 PC: 12c1a | Read file or device (Read 3 bytes on handle 5)
2018-12-25T11:51:05.488608414Z 66 PC: 12c22 | Move file pointer
2018-12-25T11:51:05.489886844Z 62 PC: 12c27 | Close file
2018-12-25T11:51:05.49218599Z 67 PC: 12c47 | Get or set file attributes
2018-12-25T11:51:05.505827637Z 61 PC: 12c4c | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:51:05.51116655Z 64 PC: 12c58 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:51:05.515770198Z 66 PC: 12c60 | Move file pointer
2018-12-25T11:51:05.51935144Z 64 PC: 12ef6 | Write file or device (Write 1183 bytes on handle 5)
2018-12-25T11:51:05.52622617Z 87 PC: 12c70 | Get or set file date and time
2018-12-25T11:51:05.527698729Z 62 PC: 12c74 | Close file
2018-12-25T11:51:05.533619932Z 67 PC: 12c81 | Get or set file attributes
2018-12-25T11:51:05.540671953Z 26 PC: 12bef | Set disk transfer address
2018-12-25T11:51:05.541769928Z 26 PC: 12bb2 | Set disk transfer address
2018-12-25T11:51:05.544014605Z 59 PC: 12b56 | Change current directory
2018-12-25T11:51:05.546601452Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:05.550374202Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:05.569325179Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:05.571632081Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:05.573872884Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:05.585915002Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.590771919Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.593899879Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.59714192Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.601221959Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.605035692Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.608309016Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.612432451Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.616018682Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.619091473Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:05.62102877Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:05.623528575Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:05.630497659Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.632247955Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.641591949Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.649880914Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.651962683Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.655431543Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.659243189Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.66158459Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.670206753Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.677393298Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.679119926Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.681748845Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:05.693271656Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:05.700797783Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:05.704444772Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:05.707667528Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:05.718341885Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:05.720582464Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:05.729935106Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:05.745475564Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:05.747275261Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:05.75039361Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:05.752967208Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:05.756740037Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:05.76272829Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:05.764657931Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:05.766015935Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:05.779187694Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.782297222Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.786027439Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.789827584Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.793083088Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.795907769Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.7989457Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.802283182Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.80724089Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:05.809983199Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:05.811767839Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:05.813389058Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:05.820370408Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.823309355Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.831025014Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.838713575Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.841707298Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.844603433Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.848096628Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.850685726Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.859631781Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.867195675Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.86951395Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.873121807Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:05.876569353Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:05.878325177Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:05.887368717Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:05.894924506Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:05.896988078Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:05.900465991Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:05.912440524Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:05.920317373Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:05.924782065Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:05.928808609Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:05.939158998Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:05.941560502Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:05.951575049Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:05.962999781Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:05.964752339Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:05.967715033Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:05.970169935Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:05.973805349Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:05.979572719Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:05.98161053Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:05.983240758Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:05.997036482Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.000155533Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.003125833Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.006256018Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.009760617Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.013121224Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.016577122Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.02001358Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.02313209Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.026233505Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:06.0280029Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:06.029525897Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:06.036634663Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:06.039752102Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:06.047438452Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:06.055066303Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:06.057604094Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:06.059657848Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:06.062665854Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:06.065012642Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:06.073126021Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:06.080322283Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:06.082910932Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:06.085279715Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:06.088735738Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:06.091211374Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:06.106050533Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:06.113922885Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:06.116999439Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:06.120174329Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:06.123717611Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:06.126331731Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:06.134366746Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:06.142410538Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:06.145203193Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:06.148036419Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:06.159528686Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:06.167575254Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:06.172045505Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:06.174898906Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:06.185004785Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:06.187738912Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:06.19665184Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:06.208503558Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:06.211543865Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:06.212952244Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:06.215111071Z 71 PC: 12b44 | Get current directory (See above)
2018-12-25T11:51:06.219750417Z 59 PC: 12b4c | Change current directory (See above)
2018-12-25T11:51:06.224658742Z 47 PC: 12b61 | Get disk transfer address (See above)
2018-12-25T11:51:06.226261463Z 26 PC: 12b6f | Set disk transfer address (See above)
2018-12-25T11:51:06.22831298Z 78 PC: 12b7a | Find first file (See above)
2018-12-25T11:51:06.23553118Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.238736073Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.242405814Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.245356023Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.248223659Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.25199575Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.255297736Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.258542557Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.262494286Z 79 PC: 12ba2 | Find next file (See above)
2018-12-25T11:51:06.266039892Z 47 PC: 12bc6 | Get disk transfer address (See above)
2018-12-25T11:51:06.267702418Z 26 PC: 12bd5 | Set disk transfer address (See above)
2018-12-25T11:51:06.270377135Z 78 PC: 12bdd | Find first file (See above)
2018-12-25T11:51:06.278033551Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:06.28053775Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:06.288861821Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:06.292090329Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:06.294231693Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:06.297393439Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:06.300520644Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:06.302020401Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:06.310522935Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:06.313643753Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:06.315563405Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:06.318366734Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:06.322123407Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:06.323519654Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:06.330957161Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:06.33315247Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:06.335103959Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:06.338437743Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:06.356621961Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:06.358948286Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:06.377500408Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:06.385192551Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:06.387142717Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:06.390034183Z 79 PC: 12bdd | Find next file (See above)
2018-12-25T11:51:06.393535762Z 47 PC: 12bf5 | Get disk transfer address (See above)
2018-12-25T11:51:06.395144718Z 61 PC: 12c0e | Open file (See above)
2018-12-25T11:51:06.403238678Z 63 PC: 12c1a | Read file or device (See above)
2018-12-25T11:51:06.411061886Z 66 PC: 12c22 | Move file pointer (See above)
2018-12-25T11:51:06.413256306Z 62 PC: 12c27 | Close file (See above)
2018-12-25T11:51:06.416909789Z 67 PC: 12c47 | Get or set file attributes (See above)
2018-12-25T11:51:06.429822817Z 61 PC: 12c4c | Open file (See above)
2018-12-25T11:51:06.438028106Z 64 PC: 12c58 | Write file or device (See above)
2018-12-25T11:51:06.441812297Z 66 PC: 12c60 | Move file pointer (See above)
2018-12-25T11:51:06.444989811Z 64 PC: 12ef6 | Write file or device (See above)
2018-12-25T11:51:06.456436403Z 87 PC: 12c70 | Get or set file date and time (See above)
2018-12-25T11:51:06.45879642Z 62 PC: 12c74 | Close file (See above)
2018-12-25T11:51:06.468508677Z 67 PC: 12c81 | Get or set file attributes (See above)
2018-12-25T11:51:06.480443989Z 26 PC: 12bef | Set disk transfer address (See above)
2018-12-25T11:51:06.482540908Z 26 PC: 12bb2 | Set disk transfer address (See above)
2018-12-25T11:51:06.484919647Z 59 PC: 12b56 | Change current directory (See above)
2018-12-25T11:51:06.487329437Z 42 PC: 12a89 | Get date 0x12a89: cmp dh, 2
0x12a8c: jb 0x12a9f
0x12a8e: cmp dl, 0xc
0x12a91: jb 0x12a9f
0x12a93: mov ah, 0x2c
0x12a95: int 0x21
0x12a97: cmp dl, 0xa
0x12a9a: ja 0x12a9f
0x12a9c: jmp 0x12ab5
0x12a9e: nop
0x12a9f: pop dx
0x12aa0: mov ah, 0x1a
0x12aa2: int 0x21
0x12aa4: mov sp, bp
0x12aa6: xor ax, ax
0x12aa8: mov bx, ax
0x12aaa: mov cx, ax
0x12aac: mov dx, ax
0x12aae: mov si, ax
0x12ab0: mov di, ax
2018-12-25T11:51:06.490300038Z 26 PC: 12aa4 | Set disk transfer address