{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":9214,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:22:41.946212709Z | 48 | PC: 12a57 | Get DOS version |
| 2018-12-25T12:22:41.947620159Z | 75 | PC: 12b2e | Execute program |
| 2018-12-25T12:22:41.949929708Z | 82 | PC: 12b39 | Get DOS internal pointers (SYSVARS) |
| 2018-12-25T12:22:41.951438292Z | 74 | PC: 12bd5 | Reallocate memory |
| 2018-12-25T12:22:41.952964768Z | 72 | PC: 12bdb | Allocate memory |
| 2018-12-25T12:22:41.957156455Z | 98 | PC: 12c15 | Get current PSP |
| 2018-12-25T12:22:41.9589811Z | 42 | PC: 9d63d | Get date 0x9d63d: mov word ptr cs:[0xe04], dx 0x9d642: mov word ptr cs:[0xe06], cx 0x9d647: pop ds 0x9d648: pop dx 0x9d649: mov ax, 0x3d00 0x9d64c: call 0x9de35 0x9d64f: jb 0x9d69d 0x9d651: push cs 0x9d652: pop ds 0x9d653: xchg ax, bx 0x9d654: call 0x9d871 0x9d657: jb 0x9d69a 0x9d659: mov dx, 0xde2 0x9d65c: mov si, dx 0x9d65e: mov ah, 0x3f 0x9d660: mov cx, 0x20 0x9d663: int 0 0x9d665: cmp word ptr [si], 0x5a4d 0x9d669: je 0x9d6a0 0x9d66b: push cs |
| 2018-12-25T12:22:41.961526055Z | 61 | PC: 9de3b | Open file (Filename = '������������~���') |
| 2018-12-25T12:22:41.970909622Z | 63 | PC: 9d665 | Read file or device (Read 32 bytes on handle 5) |
| 2018-12-25T12:22:41.973968859Z | 66 | PC: 9d870 | Move file pointer |
| 2018-12-25T12:22:41.988464211Z | 44 | PC: 9d7f0 | Get time 0x9d7f0: mov bx, dx 0x9d7f2: xor ah, dl 0x9d7f4: int3 0x9d7f5: mov byte ptr cs:[0x15e], ah 0x9d7fa: mov byte ptr cs:[0x160], al 0x9d7fe: mov word ptr cs:[0x162], bx 0x9d803: mov byte ptr cs:[0x114], 0x4c 0x9d809: push cs 0x9d80a: push cs 0x9d80b: pop ds 0x9d80c: pop es 0x9d80d: mov cx, word ptr cs:[0x102] 0x9d812: add cx, bp 0x9d814: mov word ptr cs:[0x102], cx 0x9d819: mov si, 0x100 0x9d81c: lea di, word ptr [bp + 0xe22] 0x9d820: mov cx, 0xd04 0x9d823: rep movsb byte ptr es:[di], byte ptr [si] 0x9d825: mov cx, 0xc27 0x9d828: lea di, word ptr [bp + 0x1b26] |
| 2018-12-25T12:22:41.998403437Z | 66 | PC: 9d870 | Move file pointer (See above) |
| 2018-12-25T12:22:42.0001254Z | 64 | PC: 9d71c | Write file or device (Write 3555 bytes on handle 5) |
| 2018-12-25T12:22:42.353000358Z | 66 | PC: 9d870 | Move file pointer (See above) |
| 2018-12-25T12:22:42.355335323Z | 64 | PC: 9d750 | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-25T12:22:42.360990394Z | 62 | PC: 9d776 | Close file |
| 2018-12-25T12:22:42.369188198Z | 65 | PC: 9d788 | Delete file (Filename = 'ANTI-VIR.DAT') |
| 2018-12-25T12:22:42.375822005Z | 65 | PC: 9d788 | Delete file (See above) |
| 2018-12-25T12:22:42.382941447Z | 65 | PC: 9d788 | Delete file (See above) |
| 2018-12-25T12:22:42.389486802Z | 65 | PC: 9d788 | Delete file (See above) |
| 2018-12-25T12:22:42.395933779Z | 65 | PC: 9d788 | Delete file (See above) |
| 2018-12-25T12:22:42.409953294Z | 42 | PC: 12c4d | Get date 0x12c4d: cmp dh, 0xc 0x12c50: jne 0x12cc9 0x12c52: push cs 0x12c53: pop ds 0x12c54: in al, 0x21 0x12c56: or al, 2 0x12c58: out 0x21, al 0x12c5a: mov ax, 0xa000 0x12c5d: mov es, ax 0x12c5f: mov ax, 0x13 0x12c62: int 0x10 0x12c64: call 0x12d29 0x12c67: mov di, 0x58c 0x12c6a: mov al, 6 0x12c6c: mov cx, 0xc4 0x12c6f: push cx 0x12c70: mov cl, 0x14 0x12c72: rep stosb byte ptr es:[di], al 0x12c74: add di, 0x12c 0x12c78: pop cx |
{"DateBased":true,"Day":1,"Month":12,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":9214,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:22:41.888407935Z | 64 | PC: 0 | Write file or device (Write 2 bytes on handle 1) |
| 2018-12-25T12:22:41.893848997Z | 41 | PC: 94fae | Parse filename |
| 2018-12-25T12:22:41.897974125Z | 41 | PC: 9502f | Parse filename |
| 2018-12-25T12:22:41.900256639Z | 41 | PC: 9504c | Parse filename |
| 2018-12-25T12:22:41.904700262Z | 26 | PC: 984f7 | Set disk transfer address |
| 2018-12-25T12:22:41.907409834Z | 71 | PC: 986f3 | Get current directory |
| 2018-12-25T12:22:41.91739552Z | 78 | PC: 986fe | Find first file |
| 2018-12-25T12:22:41.928323602Z | 71 | PC: 986f3 | Get current directory (See above) |
| 2018-12-25T12:22:41.932174267Z | 78 | PC: 986fe | Find first file (See above) |
| 2018-12-25T12:22:41.944304115Z | 64 | PC: 9a848 | Write file or device (Write 26 bytes on handle 2) |
| 2018-12-25T12:22:41.947953567Z | 37 | PC: 123c4 | Set interrupt vector (Interrupt = '34' AKA 'Random write') |
| 2018-12-25T12:22:41.957402726Z | 37 | PC: 123cb | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records') |
| 2018-12-25T12:22:41.958822358Z | 37 | PC: 123d2 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T12:22:41.960130216Z | 62 | PC: 122ab | Close file |
| 2018-12-25T12:22:41.961969471Z | 62 | PC: 122ab | Close file (See above) |
| 2018-12-25T12:22:41.963841034Z | 62 | PC: 122ab | Close file (See above) |
| 2018-12-25T12:22:41.965664641Z | 62 | PC: 122ab | Close file (See above) |
| 2018-12-25T12:22:41.967637335Z | 62 | PC: 122ab | Close file (See above) |
| 2018-12-25T12:22:41.970428685Z | 62 | PC: 122ab | Close file (See above) |
| 2018-12-25T12:22:41.972389142Z | 62 | PC: 122ab | Close file (See above) |
| 2018-12-25T12:22:41.974319186Z | 62 | PC: 122ab | Close file (See above) |
| 2018-12-25T12:22:41.976664598Z | 62 | PC: 122ab | Close file (See above) |
| 2018-12-25T12:22:41.978766802Z | 62 | PC: 122ab | Close file (See above) |
| 2018-12-25T12:22:41.980851054Z | 62 | PC: 122ab | Close file (See above) |
| 2018-12-25T12:22:41.98351779Z | 62 | PC: 122ab | Close file (See above) |
| 2018-12-25T12:22:41.985274224Z | 62 | PC: 122ab | Close file (See above) |
| 2018-12-25T12:22:41.987712391Z | 62 | PC: 122ab | Close file (See above) |
| 2018-12-25T12:22:41.990189089Z | 62 | PC: 122ab | Close file (See above) |
| 2018-12-25T12:22:41.992446108Z | 99 | PC: 9a5d7 | Get DBCS lead byte table pointer |
| 2018-12-25T12:22:41.994063102Z | 56 | PC: 94df9 | Get or set country info |
| 2018-12-25T12:22:41.996741693Z | 64 | PC: 9a848 | Write file or device (See above) |
| 2018-12-25T12:22:42.00175757Z | 25 | PC: 94e62 | Get default drive |
| 2018-12-25T12:22:42.003346869Z | 71 | PC: 970dd | Get current directory |
| 2018-12-25T12:22:42.008007674Z | 64 | PC: 9a848 | Write file or device (See above) |
| 2018-12-25T12:22:42.011626697Z | 2 | PC: 970b2 | Character output (Char = '3e') |
| 2018-12-25T12:22:42.014153316Z | 93 | PC: 94f20 | File sharing functions |
| 2018-12-25T12:22:42.016277723Z | 93 | PC: 94f27 | File sharing functions |
| 2018-12-25T12:22:42.018579225Z | 10 | PC: 94f39 | Buffered keyboard input |
| 2018-12-25T12:22:56.935928321Z | 0 | PC: 0 | Program terminate (See above) |
| 2018-12-25T12:22:58.294465449Z | 0 | PC: 0 | Program terminate (See above) |
| 2018-12-25T12:22:58.399352708Z | 64 | PC: 9a848 | Write file or device (See above) |
| 2018-12-25T12:22:58.406266178Z | 41 | PC: 94fae | Parse filename (See above) |
| 2018-12-25T12:22:58.409456954Z | 41 | PC: 9502f | Parse filename (See above) |
| 2018-12-25T12:22:58.412741285Z | 41 | PC: 9504c | Parse filename (See above) |
| 2018-12-25T12:22:58.416828048Z | 26 | PC: 984f7 | Set disk transfer address (See above) |
| 2018-12-25T12:22:58.419209446Z | 71 | PC: 986f3 | Get current directory (See above) |
| 2018-12-25T12:22:58.427975864Z | 78 | PC: 986fe | Find first file (See above) |
| 2018-12-25T12:22:58.437843198Z | 71 | PC: 9856c | Get current directory |
| 2018-12-25T12:22:58.442159645Z | 73 | PC: 97c09 | Release memory |
| 2018-12-25T12:22:58.44374366Z | 75 | PC: 11821 | Execute program |
| 2018-12-25T12:22:58.460644088Z | 9 | PC: 12a47 | Display string (String= 'Hello, World! ') |
| 2018-12-25T12:22:58.466354708Z | 76 | PC: 12a4b | Terminate with return code (Return code = '36') |