{"DateBased":true,"Day":2,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":913,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:42:04.825150429Z | 78 | PC: 12a4a | Find first file |
| 2018-12-25T11:42:04.83169551Z | 67 | PC: 12aa2 | Get or set file attributes |
| 2018-12-25T11:42:04.838579957Z | 67 | PC: 12aae | Get or set file attributes |
| 2018-12-25T11:42:04.857499594Z | 61 | PC: 12ab4 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T11:42:04.87051533Z | 87 | PC: 12abe | Get or set file date and time |
| 2018-12-25T11:42:04.872307439Z | 64 | PC: 12ad1 | Write file or device (Write 271 bytes on handle 5) |
| 2018-12-25T11:42:04.879126916Z | 87 | PC: 12adf | Get or set file date and time |
| 2018-12-25T11:42:04.880908496Z | 62 | PC: 12ae3 | Close file |
| 2018-12-25T11:42:04.889467926Z | 67 | PC: 12af0 | Get or set file attributes |
| 2018-12-25T11:42:04.899734014Z | 79 | PC: 12a59 | Find next file |
| 2018-12-25T11:42:04.903217991Z | 67 | PC: 12aa2 | Get or set file attributes (See above) |
| 2018-12-25T11:42:04.910142286Z | 67 | PC: 12aae | Get or set file attributes (See above) |
| 2018-12-25T11:42:04.92044425Z | 61 | PC: 12ab4 | Open file (See above) |
| 2018-12-25T11:42:04.931644955Z | 87 | PC: 12abe | Get or set file date and time (See above) |
| 2018-12-25T11:42:04.933954994Z | 64 | PC: 12ad1 | Write file or device (See above) |
| 2018-12-25T11:42:04.940490591Z | 87 | PC: 12adf | Get or set file date and time (See above) |
| 2018-12-25T11:42:04.942185566Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:42:04.950140688Z | 67 | PC: 12af0 | Get or set file attributes (See above) |
| 2018-12-25T11:42:04.960306284Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T11:42:04.962900911Z | 67 | PC: 12aa2 | Get or set file attributes (See above) |
| 2018-12-25T11:42:04.969200722Z | 67 | PC: 12aae | Get or set file attributes (See above) |
| 2018-12-25T11:42:04.979135571Z | 61 | PC: 12ab4 | Open file (See above) |
| 2018-12-25T11:42:04.990489277Z | 87 | PC: 12abe | Get or set file date and time (See above) |
| 2018-12-25T11:42:04.992131283Z | 64 | PC: 12ad1 | Write file or device (See above) |
| 2018-12-25T11:42:05.000681463Z | 87 | PC: 12adf | Get or set file date and time (See above) |
| 2018-12-25T11:42:05.002493072Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:42:05.009952292Z | 67 | PC: 12af0 | Get or set file attributes (See above) |
| 2018-12-25T11:42:05.020328011Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T11:42:05.023252285Z | 67 | PC: 12aa2 | Get or set file attributes (See above) |
| 2018-12-25T11:42:05.029204298Z | 67 | PC: 12aae | Get or set file attributes (See above) |
| 2018-12-25T11:42:05.039778757Z | 61 | PC: 12ab4 | Open file (See above) |
| 2018-12-25T11:42:05.052156184Z | 87 | PC: 12abe | Get or set file date and time (See above) |
| 2018-12-25T11:42:05.053934082Z | 64 | PC: 12ad1 | Write file or device (See above) |
| 2018-12-25T11:42:05.062385821Z | 87 | PC: 12adf | Get or set file date and time (See above) |
| 2018-12-25T11:42:05.064183322Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:42:05.072129237Z | 67 | PC: 12af0 | Get or set file attributes (See above) |
| 2018-12-25T11:42:05.082689132Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T11:42:05.085666537Z | 67 | PC: 12aa2 | Get or set file attributes (See above) |
| 2018-12-25T11:42:05.091241103Z | 67 | PC: 12aae | Get or set file attributes (See above) |
| 2018-12-25T11:42:05.10162256Z | 61 | PC: 12ab4 | Open file (See above) |
| 2018-12-25T11:42:05.113022296Z | 87 | PC: 12abe | Get or set file date and time (See above) |
| 2018-12-25T11:42:05.114718816Z | 64 | PC: 12ad1 | Write file or device (See above) |
| 2018-12-25T11:42:05.122026596Z | 87 | PC: 12adf | Get or set file date and time (See above) |
| 2018-12-25T11:42:05.123885501Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:42:05.13160386Z | 67 | PC: 12af0 | Get or set file attributes (See above) |
| 2018-12-25T11:42:05.14386518Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T11:42:05.146571641Z | 67 | PC: 12aa2 | Get or set file attributes (See above) |
| 2018-12-25T11:42:05.15344383Z | 67 | PC: 12aae | Get or set file attributes (See above) |
| 2018-12-25T11:42:05.164140831Z | 61 | PC: 12ab4 | Open file (See above) |
| 2018-12-25T11:42:05.171365966Z | 87 | PC: 12abe | Get or set file date and time (See above) |
| 2018-12-25T11:42:05.173005446Z | 64 | PC: 12ad1 | Write file or device (See above) |
| 2018-12-25T11:42:05.183489125Z | 87 | PC: 12adf | Get or set file date and time (See above) |
| 2018-12-25T11:42:05.185528889Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:42:05.193151338Z | 67 | PC: 12af0 | Get or set file attributes (See above) |
| 2018-12-25T11:42:05.204418435Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T11:42:05.207470549Z | 67 | PC: 12aa2 | Get or set file attributes (See above) |
| 2018-12-25T11:42:05.213076644Z | 67 | PC: 12aae | Get or set file attributes (See above) |
| 2018-12-25T11:42:05.226686581Z | 61 | PC: 12ab4 | Open file (See above) |
| 2018-12-25T11:42:05.234191799Z | 87 | PC: 12abe | Get or set file date and time (See above) |
| 2018-12-25T11:42:05.235958237Z | 64 | PC: 12ad1 | Write file or device (See above) |
| 2018-12-25T11:42:05.242925567Z | 87 | PC: 12adf | Get or set file date and time (See above) |
| 2018-12-25T11:42:05.245145201Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:42:05.253040145Z | 67 | PC: 12af0 | Get or set file attributes (See above) |
| 2018-12-25T11:42:05.26373057Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T11:42:05.267079424Z | 67 | PC: 12aa2 | Get or set file attributes (See above) |
| 2018-12-25T11:42:05.272485178Z | 67 | PC: 12aae | Get or set file attributes (See above) |
| 2018-12-25T11:42:05.281810555Z | 61 | PC: 12ab4 | Open file (See above) |
| 2018-12-25T11:42:05.288733702Z | 87 | PC: 12abe | Get or set file date and time (See above) |
| 2018-12-25T11:42:05.290112445Z | 64 | PC: 12ad1 | Write file or device (See above) |
| 2018-12-25T11:42:05.297080453Z | 87 | PC: 12adf | Get or set file date and time (See above) |
| 2018-12-25T11:42:05.2994829Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T11:42:05.306529626Z | 67 | PC: 12af0 | Get or set file attributes (See above) |
| 2018-12-25T11:42:05.319193206Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T11:42:05.321996714Z | 42 | PC: 12a64 | Get date 0x12a64: cmp al, 2 0x12a66: je 0x12a6c 0x12a68: mov ah, 0x4c 0x12a6a: int 0x21 0x12a6c: mov byte ptr [0x1bd], 0 0x12a71: jmp 0x12a74 0x12a73: nop 0x12a74: mov al, byte ptr [0x1be] 0x12a77: mov cx, 0xa0 0x12a7a: mov dx, 0 0x12a7d: mov bx, 0 0x12a80: int 0x26 0x12a82: inc byte ptr [0x1bd] 0x12a86: cmp byte ptr [0x1bd], 0xa 0x12a8b: je 0x12a8f 0x12a8d: jne 0x12a74 0x12a8f: mov ah, 9 0x12a91: mov dx, 0x1f5 0x12a94: int 0x21 0x12a96: mov ah, 0x4c |
| 2018-12-25T11:42:05.324003146Z | 76 | PC: 12a6c | Terminate with return code (Return code = '3') |
{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":913,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T13:06:45.111283271Z | 78 | PC: 12a4a | Find first file |
| 2018-12-25T13:06:45.118108452Z | 67 | PC: 12aa2 | Get or set file attributes |
| 2018-12-25T13:06:45.124230644Z | 67 | PC: 12aae | Get or set file attributes |
| 2018-12-25T13:06:45.336815979Z | 61 | PC: 12ab4 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T13:06:45.34491202Z | 87 | PC: 12abe | Get or set file date and time |
| 2018-12-25T13:06:45.346664765Z | 64 | PC: 12ad1 | Write file or device (Write 271 bytes on handle 5) |
| 2018-12-25T13:06:45.353917949Z | 87 | PC: 12adf | Get or set file date and time |
| 2018-12-25T13:06:45.355420152Z | 62 | PC: 12ae3 | Close file |
| 2018-12-25T13:06:45.364665077Z | 67 | PC: 12af0 | Get or set file attributes |
| 2018-12-25T13:06:45.37910291Z | 79 | PC: 12a59 | Find next file |
| 2018-12-25T13:06:45.382692395Z | 67 | PC: 12aa2 | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.389382789Z | 67 | PC: 12aae | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.400455045Z | 61 | PC: 12ab4 | Open file (See above) |
| 2018-12-25T13:06:45.408167383Z | 87 | PC: 12abe | Get or set file date and time (See above) |
| 2018-12-25T13:06:45.410788772Z | 64 | PC: 12ad1 | Write file or device (See above) |
| 2018-12-25T13:06:45.420556195Z | 87 | PC: 12adf | Get or set file date and time (See above) |
| 2018-12-25T13:06:45.422176471Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T13:06:45.431131364Z | 67 | PC: 12af0 | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.442554921Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T13:06:45.445558167Z | 67 | PC: 12aa2 | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.452344753Z | 67 | PC: 12aae | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.46330073Z | 61 | PC: 12ab4 | Open file (See above) |
| 2018-12-25T13:06:45.471204388Z | 87 | PC: 12abe | Get or set file date and time (See above) |
| 2018-12-25T13:06:45.472998479Z | 64 | PC: 12ad1 | Write file or device (See above) |
| 2018-12-25T13:06:45.481031Z | 87 | PC: 12adf | Get or set file date and time (See above) |
| 2018-12-25T13:06:45.482607394Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T13:06:45.490690992Z | 67 | PC: 12af0 | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.504933248Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T13:06:45.50814346Z | 67 | PC: 12aa2 | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.514938845Z | 67 | PC: 12aae | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.536557642Z | 61 | PC: 12ab4 | Open file (See above) |
| 2018-12-25T13:06:45.543925235Z | 87 | PC: 12abe | Get or set file date and time (See above) |
| 2018-12-25T13:06:45.545429554Z | 64 | PC: 12ad1 | Write file or device (See above) |
| 2018-12-25T13:06:45.553292107Z | 87 | PC: 12adf | Get or set file date and time (See above) |
| 2018-12-25T13:06:45.554865832Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T13:06:45.562746087Z | 67 | PC: 12af0 | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.577304728Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T13:06:45.580181068Z | 67 | PC: 12aa2 | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.586384329Z | 67 | PC: 12aae | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.597630772Z | 61 | PC: 12ab4 | Open file (See above) |
| 2018-12-25T13:06:45.60532928Z | 87 | PC: 12abe | Get or set file date and time (See above) |
| 2018-12-25T13:06:45.607214569Z | 64 | PC: 12ad1 | Write file or device (See above) |
| 2018-12-25T13:06:45.615368504Z | 87 | PC: 12adf | Get or set file date and time (See above) |
| 2018-12-25T13:06:45.617009614Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T13:06:45.625204594Z | 67 | PC: 12af0 | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.639777717Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T13:06:45.642990202Z | 67 | PC: 12aa2 | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.649156082Z | 67 | PC: 12aae | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.659829331Z | 61 | PC: 12ab4 | Open file (See above) |
| 2018-12-25T13:06:45.668174266Z | 87 | PC: 12abe | Get or set file date and time (See above) |
| 2018-12-25T13:06:45.669827283Z | 64 | PC: 12ad1 | Write file or device (See above) |
| 2018-12-25T13:06:45.677254367Z | 87 | PC: 12adf | Get or set file date and time (See above) |
| 2018-12-25T13:06:45.679614514Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T13:06:45.687417076Z | 67 | PC: 12af0 | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.701705641Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T13:06:45.705429665Z | 67 | PC: 12aa2 | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.712642919Z | 67 | PC: 12aae | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.724477423Z | 61 | PC: 12ab4 | Open file (See above) |
| 2018-12-25T13:06:45.732299402Z | 87 | PC: 12abe | Get or set file date and time (See above) |
| 2018-12-25T13:06:45.733791598Z | 64 | PC: 12ad1 | Write file or device (See above) |
| 2018-12-25T13:06:45.741131914Z | 87 | PC: 12adf | Get or set file date and time (See above) |
| 2018-12-25T13:06:45.74312308Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T13:06:45.751781335Z | 67 | PC: 12af0 | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.766165353Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T13:06:45.769349843Z | 67 | PC: 12aa2 | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.775820988Z | 67 | PC: 12aae | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.786475529Z | 61 | PC: 12ab4 | Open file (See above) |
| 2018-12-25T13:06:45.793911195Z | 87 | PC: 12abe | Get or set file date and time (See above) |
| 2018-12-25T13:06:45.79549506Z | 64 | PC: 12ad1 | Write file or device (See above) |
| 2018-12-25T13:06:45.802693443Z | 87 | PC: 12adf | Get or set file date and time (See above) |
| 2018-12-25T13:06:45.804317226Z | 62 | PC: 12ae3 | Close file (See above) |
| 2018-12-25T13:06:45.813034317Z | 67 | PC: 12af0 | Get or set file attributes (See above) |
| 2018-12-25T13:06:45.827517464Z | 79 | PC: 12a59 | Find next file (See above) |
| 2018-12-25T13:06:45.830170784Z | 42 | PC: 12a64 | Get date 0x12a64: cmp al, 2 0x12a66: je 0x12a6c 0x12a68: mov ah, 0x4c 0x12a6a: int 0x21 0x12a6c: mov byte ptr [0x1bd], 0 0x12a71: jmp 0x12a74 0x12a73: nop 0x12a74: mov al, byte ptr [0x1be] 0x12a77: mov cx, 0xa0 0x12a7a: mov dx, 0 0x12a7d: mov bx, 0 0x12a80: int 0x26 0x12a82: inc byte ptr [0x1bd] 0x12a86: cmp byte ptr [0x1bd], 0xa 0x12a8b: je 0x12a8f 0x12a8d: jne 0x12a74 0x12a8f: mov ah, 9 0x12a91: mov dx, 0x1f5 0x12a94: int 0x21 0x12a96: mov ah, 0x4c |
| 2018-12-25T13:06:45.833758696Z | 9 | PC: 12a96 | Display string (String= ' Error eating drive C: ') |
| 2018-12-25T13:06:45.837348055Z | 76 | PC: 12a9a | Terminate with return code (Return code = '36') |