{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":942,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:42:18.456146796Z | 78 | PC: 13ea2 | Find first file |
| 2018-12-25T11:42:18.466571226Z | 61 | PC: 13ec4 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T11:42:18.474478437Z | 63 | PC: 13edb | Read file or device (Read 6 bytes on handle 5) |
| 2018-12-25T11:42:18.481355533Z | 66 | PC: 13ef3 | Move file pointer |
| 2018-12-25T11:42:18.48317573Z | 66 | PC: 13f13 | Move file pointer |
| 2018-12-25T11:42:18.485025739Z | 64 | PC: 13f1e | Write file or device (Write 6 bytes on handle 5) |
| 2018-12-25T11:42:18.487862761Z | 66 | PC: 13f27 | Move file pointer |
| 2018-12-25T11:42:18.489366947Z | 64 | PC: 13f32 | Write file or device (Write 30 bytes on handle 5) |
| 2018-12-25T11:42:18.492721262Z | 64 | PC: 13f57 | Write file or device (Write 382 bytes on handle 5) |
| 2018-12-25T11:42:18.508268041Z | 62 | PC: 13f5b | Close file |
| 2018-12-25T11:42:18.517161772Z | 79 | PC: 13ea2 | Find next file (See above) |
| 2018-12-25T11:42:18.520762184Z | 61 | PC: 13ec4 | Open file (See above) |
| 2018-12-25T11:42:18.528224901Z | 63 | PC: 13edb | Read file or device (See above) |
| 2018-12-25T11:42:18.535448714Z | 66 | PC: 13ef3 | Move file pointer (See above) |
| 2018-12-25T11:42:18.537919405Z | 62 | PC: 13f5b | Close file (See above) |
| 2018-12-25T11:42:18.540081593Z | 79 | PC: 13ea2 | Find next file (See above) |
| 2018-12-25T11:42:18.54358036Z | 61 | PC: 13ec4 | Open file (See above) |
| 2018-12-25T11:42:18.552596855Z | 63 | PC: 13edb | Read file or device (See above) |
| 2018-12-25T11:42:18.559634967Z | 66 | PC: 13ef3 | Move file pointer (See above) |
| 2018-12-25T11:42:18.56115351Z | 62 | PC: 13f5b | Close file (See above) |
| 2018-12-25T11:42:18.563573976Z | 79 | PC: 13ea2 | Find next file (See above) |
| 2018-12-25T11:42:18.566583059Z | 61 | PC: 13ec4 | Open file (See above) |
| 2018-12-25T11:42:18.574176746Z | 63 | PC: 13edb | Read file or device (See above) |
| 2018-12-25T11:42:18.582254576Z | 66 | PC: 13ef3 | Move file pointer (See above) |
| 2018-12-25T11:42:18.583851074Z | 62 | PC: 13f5b | Close file (See above) |
| 2018-12-25T11:42:18.585836608Z | 79 | PC: 13ea2 | Find next file (See above) |
| 2018-12-25T11:42:18.589052191Z | 61 | PC: 13ec4 | Open file (See above) |
| 2018-12-25T11:42:18.597511041Z | 63 | PC: 13edb | Read file or device (See above) |
| 2018-12-25T11:42:18.604656752Z | 66 | PC: 13ef3 | Move file pointer (See above) |
| 2018-12-25T11:42:18.6059763Z | 62 | PC: 13f5b | Close file (See above) |
| 2018-12-25T11:42:18.60856804Z | 79 | PC: 13ea2 | Find next file (See above) |
| 2018-12-25T11:42:18.612372658Z | 61 | PC: 13ec4 | Open file (See above) |
| 2018-12-25T11:42:18.616692364Z | 63 | PC: 13edb | Read file or device (See above) |
| 2018-12-25T11:42:18.621631871Z | 66 | PC: 13ef3 | Move file pointer (See above) |
| 2018-12-25T11:42:18.622942406Z | 66 | PC: 13f13 | Move file pointer (See above) |
| 2018-12-25T11:42:18.624251148Z | 64 | PC: 13f1e | Write file or device (See above) |
| 2018-12-25T11:42:18.627380321Z | 66 | PC: 13f27 | Move file pointer (See above) |
| 2018-12-25T11:42:18.628654608Z | 64 | PC: 13f32 | Write file or device (See above) |
| 2018-12-25T11:42:18.634001144Z | 64 | PC: 13f57 | Write file or device (See above) |
| 2018-12-25T11:42:18.636922532Z | 62 | PC: 13f5b | Close file (See above) |
| 2018-12-25T11:42:18.64256534Z | 79 | PC: 13ea2 | Find next file (See above) |
| 2018-12-25T11:42:18.644649419Z | 61 | PC: 13ec4 | Open file (See above) |
| 2018-12-25T11:42:18.64929134Z | 63 | PC: 13edb | Read file or device (See above) |
| 2018-12-25T11:42:18.653701306Z | 66 | PC: 13ef3 | Move file pointer (See above) |
| 2018-12-25T11:42:18.655230048Z | 62 | PC: 13f5b | Close file (See above) |
| 2018-12-25T11:42:18.657341715Z | 79 | PC: 13ea2 | Find next file (See above) |
| 2018-12-25T11:42:18.661034874Z | 61 | PC: 13ec4 | Open file (See above) |
| 2018-12-25T11:42:18.669005032Z | 63 | PC: 13edb | Read file or device (See above) |
| 2018-12-25T11:42:18.672282078Z | 62 | PC: 13f5b | Close file (See above) |
| 2018-12-25T11:42:18.674699373Z | 79 | PC: 13ea2 | Find next file (See above) |
| 2018-12-25T11:42:18.677843898Z | 44 | PC: 13f6f | Get time 0x13f6f: cmp ch, 9 0x13f72: je 0x13f79 0x13f74: mov ax, 0x100 0x13f77: jmp ax 0x13f79: mov ah, 0x3c 0x13f7b: mov cx, 0x20 0x13f7e: lea dx, word ptr [bp + 0x280] 0x13f82: int 0x21 0x13f84: jb 0x13f88 0x13f86: jmp 0x13f92 0x13f88: mov al, byte ptr [0x280] 0x13f8b: inc al 0x13f8d: mov byte ptr [0x280], al 0x13f90: jmp 0x13f79 0x13f92: xchg ax, bx 0x13f93: mov ah, 0x40 0x13f95: lea dx, word ptr [bp + 0x13d] 0x13f99: mov cx, 0x2d 0x13f9c: int 0x21 0x13f9e: mov ah, 0x3d |
| 2018-12-25T11:42:18.680682633Z | 9 | PC: 12a85 | Display string (String= 'Sophos Ltd, Oxford sacrificial COM goat 1400H bytes long ') |
| 2018-12-25T11:42:18.687827039Z | 0 | PC: 12a89 | Program terminate |
{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":9,"Min":0,"Second":0,"TimeBased":true,"OriginalID":942,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:42:19.652619402Z | 78 | PC: 13ea2 | Find first file |
| 2018-12-25T11:42:19.65956102Z | 61 | PC: 13ec4 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T11:42:19.667201246Z | 63 | PC: 13edb | Read file or device (Read 6 bytes on handle 5) |
| 2018-12-25T11:42:19.674193382Z | 66 | PC: 13ef3 | Move file pointer |
| 2018-12-25T11:42:19.675821663Z | 66 | PC: 13f13 | Move file pointer |
| 2018-12-25T11:42:19.681296738Z | 64 | PC: 13f1e | Write file or device (Write 6 bytes on handle 5) |
| 2018-12-25T11:42:19.684724497Z | 66 | PC: 13f27 | Move file pointer |
| 2018-12-25T11:42:19.686738316Z | 64 | PC: 13f32 | Write file or device (Write 30 bytes on handle 5) |
| 2018-12-25T11:42:19.700515252Z | 64 | PC: 13f57 | Write file or device (Write 382 bytes on handle 5) |
| 2018-12-25T11:42:19.728763245Z | 62 | PC: 13f5b | Close file |
| 2018-12-25T11:42:19.737915136Z | 79 | PC: 13ea2 | Find next file (See above) |
| 2018-12-25T11:42:19.74149769Z | 61 | PC: 13ec4 | Open file (See above) |
| 2018-12-25T11:42:19.748809529Z | 63 | PC: 13edb | Read file or device (See above) |
| 2018-12-25T11:42:19.755912853Z | 66 | PC: 13ef3 | Move file pointer (See above) |
| 2018-12-25T11:42:19.758654234Z | 62 | PC: 13f5b | Close file (See above) |
| 2018-12-25T11:42:19.76103725Z | 79 | PC: 13ea2 | Find next file (See above) |
| 2018-12-25T11:42:19.764403718Z | 61 | PC: 13ec4 | Open file (See above) |
| 2018-12-25T11:42:19.773079046Z | 63 | PC: 13edb | Read file or device (See above) |
| 2018-12-25T11:42:19.78040399Z | 66 | PC: 13ef3 | Move file pointer (See above) |
| 2018-12-25T11:42:19.781975893Z | 62 | PC: 13f5b | Close file (See above) |
| 2018-12-25T11:42:19.784197123Z | 79 | PC: 13ea2 | Find next file (See above) |
| 2018-12-25T11:42:19.787680174Z | 61 | PC: 13ec4 | Open file (See above) |
| 2018-12-25T11:42:19.794842878Z | 63 | PC: 13edb | Read file or device (See above) |
| 2018-12-25T11:42:19.801790759Z | 66 | PC: 13ef3 | Move file pointer (See above) |
| 2018-12-25T11:42:19.804243877Z | 62 | PC: 13f5b | Close file (See above) |
| 2018-12-25T11:42:19.807418653Z | 79 | PC: 13ea2 | Find next file (See above) |
| 2018-12-25T11:42:19.810791588Z | 61 | PC: 13ec4 | Open file (See above) |
| 2018-12-25T11:42:19.818764379Z | 63 | PC: 13edb | Read file or device (See above) |
| 2018-12-25T11:42:19.8261968Z | 66 | PC: 13ef3 | Move file pointer (See above) |
| 2018-12-25T11:42:19.828151407Z | 62 | PC: 13f5b | Close file (See above) |
| 2018-12-25T11:42:19.831406309Z | 79 | PC: 13ea2 | Find next file (See above) |
| 2018-12-25T11:42:19.839138651Z | 61 | PC: 13ec4 | Open file (See above) |
| 2018-12-25T11:42:19.846451968Z | 63 | PC: 13edb | Read file or device (See above) |
| 2018-12-25T11:42:19.854276942Z | 66 | PC: 13ef3 | Move file pointer (See above) |
| 2018-12-25T11:42:19.855818587Z | 66 | PC: 13f13 | Move file pointer (See above) |
| 2018-12-25T11:42:19.857277704Z | 64 | PC: 13f1e | Write file or device (See above) |
| 2018-12-25T11:42:19.860566128Z | 66 | PC: 13f27 | Move file pointer (See above) |
| 2018-12-25T11:42:19.862085565Z | 64 | PC: 13f32 | Write file or device (See above) |
| 2018-12-25T11:42:19.870724204Z | 64 | PC: 13f57 | Write file or device (See above) |
| 2018-12-25T11:42:19.873656978Z | 62 | PC: 13f5b | Close file (See above) |
| 2018-12-25T11:42:19.882755292Z | 79 | PC: 13ea2 | Find next file (See above) |
| 2018-12-25T11:42:19.885594934Z | 61 | PC: 13ec4 | Open file (See above) |
| 2018-12-25T11:42:19.892597232Z | 63 | PC: 13edb | Read file or device (See above) |
| 2018-12-25T11:42:19.905149881Z | 66 | PC: 13ef3 | Move file pointer (See above) |
| 2018-12-25T11:42:19.908688217Z | 62 | PC: 13f5b | Close file (See above) |
| 2018-12-25T11:42:19.911027621Z | 79 | PC: 13ea2 | Find next file (See above) |
| 2018-12-25T11:42:19.914777305Z | 61 | PC: 13ec4 | Open file (See above) |
| 2018-12-25T11:42:19.922422799Z | 63 | PC: 13edb | Read file or device (See above) |
| 2018-12-25T11:42:19.925577824Z | 62 | PC: 13f5b | Close file (See above) |
| 2018-12-25T11:42:19.928383496Z | 79 | PC: 13ea2 | Find next file (See above) |
| 2018-12-25T11:42:19.931358018Z | 44 | PC: 13f6f | Get time 0x13f6f: cmp ch, 9 0x13f72: je 0x13f79 0x13f74: mov ax, 0x100 0x13f77: jmp ax 0x13f79: mov ah, 0x3c 0x13f7b: mov cx, 0x20 0x13f7e: lea dx, word ptr [bp + 0x280] 0x13f82: int 0x21 0x13f84: jb 0x13f88 0x13f86: jmp 0x13f92 0x13f88: mov al, byte ptr [0x280] 0x13f8b: inc al 0x13f8d: mov byte ptr [0x280], al 0x13f90: jmp 0x13f79 0x13f92: xchg ax, bx 0x13f93: mov ah, 0x40 0x13f95: lea dx, word ptr [bp + 0x13d] 0x13f99: mov cx, 0x2d 0x13f9c: int 0x21 0x13f9e: mov ah, 0x3d |
| 2018-12-25T11:42:19.933683713Z | 60 | PC: 13f84 | Create or truncate file |
| 2018-12-25T11:42:20.290550211Z | 64 | PC: 13f9e | Write file or device (Write 45 bytes on handle 5) |
| 2018-12-25T11:42:20.29949016Z | 61 | PC: 13fa2 | Open file (Filename = 'Dedicated to Goofy��') |
| 2018-12-25T11:42:20.305739472Z | 9 | PC: 12a85 | Display string (String= 'Sophos Ltd, Oxford sacrificial COM goat 1400H bytes long ') |
| 2018-12-25T11:42:20.312216296Z | 0 | PC: 12a89 | Program terminate |