.
Time | Syscall Op | Syscall Name |
---|---|---|
2018-12-17T22:25:06.353544153Z | 240 | PC: 12ad9 | UNKNOWN! |
2018-12-17T22:25:06.355212029Z | 240 | PC: 12b04 | UNKNOWN! |
2018-12-17T22:25:06.356913123Z | 74 | PC: 12b88 | Reallocate memory |
2018-12-17T22:25:06.358873472Z | 53 | PC: 12b8d | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
2018-12-17T22:25:06.36089077Z | 37 | PC: 12ba1 | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
2018-12-17T22:25:06.363899335Z | 44 | PC: 12bd8 | Get time 0x12bd8: cmp ch, 0x16 0x12bdb: jne 0x12c0d 0x12bdd: mov ah, 0x19 0x12bdf: int 0x21 0x12be1: mov dl, al 0x12be3: cmp dl, 2 0x12be6: jb 0x12beb 0x12be8: add dl, 0x7e 0x12beb: mov ax, 0x50f 0x12bee: xor cx, cx 0x12bf0: inc cl 0x12bf2: xor dh, dh 0x12bf4: lea bx, word ptr [0x1bc] 0x12bf8: int 0x13 0x12bfa: int 0x19 0x12bfc: add byte ptr [bx + si], al 0x12bfe: add word ptr [bp + si], ax 0x12c00: nop 0x12c01: nop 0x12c02: nop |
2018-12-17T22:25:06.36672801Z | 75 | PC: 12c19 | Execute program |
2018-12-17T22:25:06.382845962Z | 9 | PC: 132a7 | Display string (String= 'This file is infected with the Curse.B VIRUS!') |
2018-12-17T22:25:06.388072788Z | 73 | PC: 12c1f | Release memory |
2018-12-17T22:25:06.389699949Z | 77 | PC: 12c23 | Get program return code |
2018-12-17T22:25:06.391196066Z | 49 | PC: 12c31 | Terminate and stay resident (Return code = '0' | Memory size = '119') |
.
Time | Syscall Op | Syscall Name |
---|---|---|
2018-12-25T11:51:51.526183835Z | 240 | PC: 12ad9 | UNKNOWN! |
2018-12-25T11:51:51.539716683Z | 240 | PC: 12b04 | UNKNOWN! |
2018-12-25T11:51:51.541131374Z | 74 | PC: 12b88 | Reallocate memory |
2018-12-25T11:51:51.54282177Z | 53 | PC: 12b8d | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
2018-12-25T11:51:51.545332766Z | 37 | PC: 12ba1 | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
2018-12-25T11:51:51.547046272Z | 44 | PC: 12bd8 | Get time 0x12bd8: cmp ch, 0x16 0x12bdb: jne 0x12c0d 0x12bdd: mov ah, 0x19 0x12bdf: int 0x21 0x12be1: mov dl, al 0x12be3: cmp dl, 2 0x12be6: jb 0x12beb 0x12be8: add dl, 0x7e 0x12beb: mov ax, 0x50f 0x12bee: xor cx, cx 0x12bf0: inc cl 0x12bf2: xor dh, dh 0x12bf4: lea bx, word ptr [0x1bc] 0x12bf8: int 0x13 0x12bfa: int 0x19 0x12bfc: add byte ptr [bx + si], al 0x12bfe: add word ptr [bp + si], ax 0x12c00: nop 0x12c01: nop 0x12c02: nop |
2018-12-25T11:51:51.549447789Z | 75 | PC: 12c19 | Execute program |
2018-12-25T11:51:51.565035315Z | 9 | PC: 132a7 | Display string (String= 'This file is infected with the Curse.B VIRUS!') |
2018-12-25T11:51:51.569187558Z | 73 | PC: 12c1f | Release memory |
2018-12-25T11:51:51.570484692Z | 77 | PC: 12c23 | Get program return code |
2018-12-25T11:51:51.571646508Z | 49 | PC: 12c31 | Terminate and stay resident (Return code = '0' | Memory size = '119') |
.
Time | Syscall Op | Syscall Name |
---|---|---|
2018-12-25T11:51:51.686958183Z | 240 | PC: 12ad9 | UNKNOWN! |
2018-12-25T11:51:51.688853365Z | 240 | PC: 12b04 | UNKNOWN! |
2018-12-25T11:51:51.690101083Z | 74 | PC: 12b88 | Reallocate memory |
2018-12-25T11:51:51.691547003Z | 53 | PC: 12b8d | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
2018-12-25T11:51:51.693107693Z | 37 | PC: 12ba1 | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
2018-12-25T11:51:51.695157645Z | 44 | PC: 12bd8 | Get time 0x12bd8: cmp ch, 0x16 0x12bdb: jne 0x12c0d 0x12bdd: mov ah, 0x19 0x12bdf: int 0x21 0x12be1: mov dl, al 0x12be3: cmp dl, 2 0x12be6: jb 0x12beb 0x12be8: add dl, 0x7e 0x12beb: mov ax, 0x50f 0x12bee: xor cx, cx 0x12bf0: inc cl 0x12bf2: xor dh, dh 0x12bf4: lea bx, word ptr [0x1bc] 0x12bf8: int 0x13 0x12bfa: int 0x19 0x12bfc: add byte ptr [bx + si], al 0x12bfe: add word ptr [bp + si], ax 0x12c00: nop 0x12c01: nop 0x12c02: nop |
2018-12-25T11:51:51.698275326Z | 25 | PC: 12be1 | Get default drive |
2018-12-25T11:51:53.769486328Z | 72 | PC: 8f1b9 | Allocate memory |
2018-12-25T11:51:53.771383319Z | 72 | PC: 8f1bd | Allocate memory |
2018-12-25T11:51:53.773396958Z | 99 | PC: 90858 | Get DBCS lead byte table pointer |
2018-12-25T11:51:53.776076452Z | 61 | PC: 91f88 | Open file (Filename = 'C:\WINDOWS\HIMEM.SYS') |
2018-12-25T11:51:53.786838045Z | 66 | PC: 91f95 | Move file pointer |
2018-12-25T11:51:53.788579112Z | 62 | PC: 91fc1 | Close file |
2018-12-25T11:51:53.790940028Z | 75 | PC: 91fe0 | Execute program |
2018-12-25T11:51:53.807006628Z | 98 | PC: 916f1 | Get current PSP |
2018-12-25T11:51:53.808166887Z | 9 | PC: c605 | Display string (String= '6�� r�&;]u') |
2018-12-25T11:51:53.817203502Z | 48 | PC: c609 | Get DOS version |
2018-12-25T11:51:53.820909637Z | 9 | PC: c382 | Display string (String= ' Installed A20 handler number ') |
2018-12-25T11:51:53.824803053Z | 2 | PC: c38c | Character output (Char = '32') |
2018-12-25T11:51:53.826954166Z | 2 | PC: c3a7 | Character output (Char = '2e') |
2018-12-25T11:51:53.831369647Z | 9 | PC: c6d9 | Display string (String= '���� �VH�VD���V@������� ������ �_���Ku��t1������� �D�����t �� ��������a 1��Z � �� � �W��������� �5 � ��|�����(���������Nj�(������� �p�^') |
2018-12-25T11:51:53.837098956Z | 9 | PC: c6e0 | Display string (String= ' �5 � ��|�����(���������Nj�(������� �p�^') |
2018-12-25T11:51:53.846652843Z | 61 | PC: 91f88 | Open file (See above) |
2018-12-25T11:51:53.857690021Z | 66 | PC: 91f95 | Move file pointer (See above) |
2018-12-25T11:51:53.859416972Z | 62 | PC: 91fc1 | Close file (See above) |
2018-12-25T11:51:53.861826421Z | 75 | PC: 91fe0 | Execute program (See above) |
2018-12-25T11:51:53.883741094Z | 98 | PC: 916f1 | Get current PSP (See above) |
2018-12-25T11:51:53.887668895Z | 82 | PC: 13d46 | Get DOS internal pointers (SYSVARS) |
2018-12-25T11:51:53.889308774Z | 53 | PC: 13ac3 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
2018-12-25T11:51:53.891641904Z | 37 | PC: 13ad6 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
2018-12-25T11:51:53.893152162Z | 53 | PC: 13ae0 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address') |
2018-12-25T11:51:53.894735807Z | 37 | PC: 13af3 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address') |
2018-12-25T11:51:53.896809667Z | 9 | PC: 13a0d | Display string (Could not find end pointer) |
2018-12-25T11:51:53.908282215Z | 62 | PC: 8f8eb | Close file |
2018-12-25T11:51:53.909963704Z | 62 | PC: 8f8f2 | Close file |
2018-12-25T11:51:53.911629364Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.921331178Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.922730695Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.924062851Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.925818702Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.927144296Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.928398545Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.930193851Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.931549571Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.932957025Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.93540273Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.937375549Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.938959661Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.942140863Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.943562344Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.944866077Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.946497166Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.947939708Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.949229039Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.951437143Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.952873841Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.954228927Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.955821627Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.957320162Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.958904418Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.961121064Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.962418452Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.963656621Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.97354418Z | 62 | PC: 8f8f2 | Close file (See above) |
2018-12-25T11:51:53.974846595Z | 61 | PC: 8f8ff | Open file (Filename = '') |
2018-12-25T11:51:53.979506359Z | 62 | PC: 8f90e | Close file |
2018-12-25T11:51:53.981538343Z | 69 | PC: 8f915 | Duplicate handle |
2018-12-25T11:51:53.982781172Z | 69 | PC: 8f919 | Duplicate handle |
2018-12-25T11:51:53.983936778Z | 61 | PC: 9387b | Open file (Filename = '') |
2018-12-25T11:51:53.995033942Z | 68 | PC: 9386b | I/O control for devices (Set for = '') |
2018-12-25T11:51:54.00375834Z | 61 | PC: 9387b | Open file (See above) |
2018-12-25T11:51:54.00700089Z | 68 | PC: 9386b | I/O control for devices (See above) |
2018-12-25T11:51:54.008830326Z | 74 | PC: 8f9c4 | Reallocate memory |
2018-12-25T11:51:54.010130381Z | 72 | PC: 8f9e0 | Allocate memory |
2018-12-25T11:51:54.011343636Z | 72 | PC: 8f9e4 | Allocate memory |
2018-12-25T11:51:54.012546247Z | 74 | PC: 8f9fb | Reallocate memory |
2018-12-25T11:51:54.014301853Z | 72 | PC: 8fa02 | Allocate memory |
2018-12-25T11:51:54.0158697Z | 72 | PC: 8fa06 | Allocate memory |
2018-12-25T11:51:54.017467917Z | 73 | PC: 8fa11 | Release memory |
2018-12-25T11:51:54.019040967Z | 73 | PC: 8efea | Release memory |
2018-12-25T11:51:54.020342249Z | 74 | PC: 8f003 | Reallocate memory |
2018-12-25T11:51:54.022008628Z | 72 | PC: 8f054 | Allocate memory |
2018-12-25T11:51:54.023257734Z | 72 | PC: 8f058 | Allocate memory |
2018-12-25T11:51:54.024361242Z | 73 | PC: 8f060 | Release memory |
2018-12-25T11:51:54.02539064Z | 61 | PC: 8f080 | Open file (Filename = 'r,�S�������[�
|
2018-12-25T11:51:54.034308405Z | 63 | PC: 8f095 | Read file or device (Read 4 bytes on handle 5) |
2018-12-25T11:51:54.039446788Z | 66 | PC: 8f0ad | Move file pointer |
2018-12-25T11:51:54.040690951Z | 62 | PC: 8f0d1 | Close file |
2018-12-25T11:51:54.042633671Z | 75 | PC: 8f0f2 | Execute program |
2018-12-25T11:51:54.060938272Z | 80 | PC: 12be9 | Set current PSP |
2018-12-25T11:51:54.061891837Z | 48 | PC: 12bee | Get DOS version |
2018-12-25T11:51:54.063199193Z | 99 | PC: 193d0 | Get DBCS lead byte table pointer |
2018-12-25T11:51:54.064715237Z | 101 | PC: 12c74 | Get extended country info |
2018-12-25T11:51:54.065707035Z | 99 | PC: 12c7a | Get DBCS lead byte table pointer |
2018-12-25T11:51:54.066827363Z | 74 | PC: 12cdc | Reallocate memory |
2018-12-25T11:51:54.067932649Z | 72 | PC: 1355d | Allocate memory |
2018-12-25T11:51:54.069545148Z | 25 | PC: 13596 | Get default drive |
2018-12-25T11:51:54.070621028Z | 71 | PC: 135ad | Get current directory |
2018-12-25T11:51:54.072731412Z | 59 | PC: 135ba | Change current directory |
2018-12-25T11:51:54.07770351Z | 59 | PC: 135c8 | Change current directory |
2018-12-25T11:51:54.082270925Z | 59 | PC: 135d3 | Change current directory |
2018-12-25T11:51:54.085789165Z | 25 | PC: 12d13 | Get default drive |
2018-12-25T11:51:54.087397947Z | 37 | PC: 127d3 | Set interrupt vector (Interrupt = '34' AKA 'Random write') |
2018-12-25T11:51:54.088861221Z | 37 | PC: 127da | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records') |
2018-12-25T11:51:54.090153926Z | 37 | PC: 127e1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
2018-12-25T11:51:54.092465994Z | 80 | PC: 1301d | Set current PSP |
2018-12-25T11:51:54.093551289Z | 37 | PC: 13041 | Set interrupt vector (Interrupt = '46' AKA 'Set verify flag') |
2018-12-25T11:51:54.094915642Z | 53 | PC: 13362 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address') |
2018-12-25T11:51:54.096387007Z | 37 | PC: 13383 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address') |
2018-12-25T11:51:54.097886337Z | 51 | PC: 13417 | Get or set Ctrl-Break |
2018-12-25T11:51:54.100104069Z | 72 | PC: 130ec | Allocate memory |
2018-12-25T11:51:54.102142153Z | 61 | PC: 131b2 | Open file (Filename = '') |
2018-12-25T11:51:54.108216717Z | 62 | PC: 131ba | Close file |
2018-12-25T11:51:54.110280054Z | 51 | PC: 1344c | Get or set Ctrl-Break |
2018-12-25T11:51:54.111519548Z | 74 | PC: 1197c | Reallocate memory |
2018-12-25T11:51:54.113817313Z | 72 | PC: 11991 | Allocate memory |
2018-12-25T11:51:54.116618918Z | 73 | PC: 119b2 | Release memory |
2018-12-25T11:51:54.11870901Z | 72 | PC: 119bd | Allocate memory |
2018-12-25T11:51:54.120542956Z | 73 | PC: 119df | Release memory |
2018-12-25T11:51:54.121996951Z | 72 | PC: 119f5 | Allocate memory |
2018-12-25T11:51:54.124265035Z | 72 | PC: 119fd | Allocate memory |