Sample viewer

vx.netlux.org/Virus.DOS.Cybercide.2233.a

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:01:15.87256981Z 221 PC: 141b9 | UNKNOWN!
2018-12-17T23:01:15.874223999Z 53 PC: 141c8 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:01:15.875678782Z 53 PC: 141d5 | Get interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-17T23:01:15.87751906Z 53 PC: 141e2 | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-17T23:01:15.879448957Z 37 PC: 1421f | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:01:15.880835322Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:15.883969621Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:15.887059056Z 37 PC: 14227 | Set interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-17T23:01:15.88914182Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:15.891850149Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:15.894994548Z 37 PC: 1422f | Set interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-17T23:01:15.896364963Z 9 PC: 12a86 | Display string (String= 'Goat file (COM/k...). Size=00001770h/0000006000d bytes. ')
2018-12-17T23:01:15.902743949Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:15.905518513Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:15.910366803Z 48 PC: 12a8f | Get DOS version
2018-12-17T23:01:15.912642559Z 61 PC: 9ef04 | Open file (Filename = 'A:\TEST.COM')
2018-12-17T23:01:15.920117105Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:15.923235614Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:15.925577104Z 87 PC: 9ef0d | Get or set file date and time
2018-12-17T23:01:15.927105676Z 62 PC: 9ee86 | Close file
2018-12-17T23:01:15.929827911Z 61 PC: 9ee95 | Open file (Filename = '')
2018-12-17T23:01:15.937268874Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:15.939637956Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:15.944380968Z 93 PC: 12afe | File sharing functions
2018-12-17T23:01:15.94615445Z 9 PC: 12a86 | Display string (String= 'Size change=08B9h/02233d. ')
2018-12-17T23:01:15.949665167Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:15.952053865Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:15.954117573Z 76 PC: 12ae3 | Terminate with return code (Return code = '1')
2018-12-17T23:01:15.956829129Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:15.964958564Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:15.967056647Z 77 PC: 11fe0 | Get program return code
2018-12-17T23:01:15.968351199Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:15.974081306Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:15.976437022Z 72 PC: 12174 | Allocate memory
2018-12-17T23:01:15.978301446Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:15.980252763Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:15.984853538Z 72 PC: 1218d | Allocate memory
2018-12-17T23:01:15.987621489Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:15.989725984Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:15.992574857Z 37 PC: 123c4 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-17T23:01:15.993846646Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:15.995713414Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:15.998474532Z 37 PC: 123cb | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:01:16.014094894Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.016601885Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.022963809Z 37 PC: 123d2 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:01:16.024181618Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.026024471Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.030633131Z 62 PC: 122ab | Close file
2018-12-17T23:01:16.032308559Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.034642524Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.03773732Z 62 PC: 122ab | Close file
2018-12-17T23:01:16.039577517Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.04176616Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.044174756Z 62 PC: 122ab | Close file
2018-12-17T23:01:16.046483755Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.048808103Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.051726416Z 62 PC: 122ab | Close file
2018-12-17T23:01:16.05404335Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.056260075Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.058440973Z 62 PC: 122ab | Close file
2018-12-17T23:01:16.061630125Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.064902114Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.067223676Z 62 PC: 122ab | Close file
2018-12-17T23:01:16.069651228Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.072023566Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.074698763Z 62 PC: 122ab | Close file
2018-12-17T23:01:16.079803955Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.083507334Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.086289382Z 62 PC: 122ab | Close file
2018-12-17T23:01:16.088558195Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.090717072Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.093386949Z 62 PC: 122ab | Close file
2018-12-17T23:01:16.096263073Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.099401841Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.1021369Z 62 PC: 122ab | Close file
2018-12-17T23:01:16.104530768Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.1073575Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.109929793Z 62 PC: 122ab | Close file
2018-12-17T23:01:16.112582618Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.11530853Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.117800353Z 62 PC: 122ab | Close file
2018-12-17T23:01:16.119612688Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.123012777Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.125378633Z 62 PC: 122ab | Close file
2018-12-17T23:01:16.12717047Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.13067261Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.133026573Z 62 PC: 122ab | Close file
2018-12-17T23:01:16.13477046Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.138946568Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.142291844Z 62 PC: 122ab | Close file
2018-12-17T23:01:16.14561592Z 61 PC: 9ef04 | Open file (Filename = 'C:\COMMAND.COM')
2018-12-17T23:01:16.153046813Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.155807189Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.162452828Z 87 PC: 9ef0d | Get or set file date and time
2018-12-17T23:01:16.1687925Z 62 PC: 9ee86 | Close file
2018-12-17T23:01:16.171539281Z 61 PC: 9ee95 | Open file (Filename = 'C:\COMMAND.COM')
2018-12-17T23:01:16.178444546Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.181045183Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.184583562Z 66 PC: 12372 | Move file pointer
2018-12-17T23:01:16.186399715Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.188901326Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.192356278Z 63 PC: 12383 | Read file or device (Read 44693 bytes on handle 5)
2018-12-17T23:01:16.213242955Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.21517215Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.217958876Z 62 PC: 1238a | Close file
2018-12-17T23:01:16.221006192Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.222918405Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.22504984Z 99 PC: 99317 | Get DBCS lead byte table pointer
2018-12-17T23:01:16.227245486Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.229176034Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.231442363Z 56 PC: 93b39 | Get or set country info
2018-12-17T23:01:16.234230853Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.23666173Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.240277965Z 64 PC: 99588 | Write file or device (Write 2 bytes on handle 1)
2018-12-17T23:01:16.245275476Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.247748112Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.250891949Z 25 PC: 93ba2 | Get default drive
2018-12-17T23:01:16.253978279Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.256792507Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.260271114Z 71 PC: 95e1d | Get current directory
2018-12-17T23:01:16.266998735Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.27008286Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.272927776Z 64 PC: 99588 | Write file or device (Write 3 bytes on handle 1)
2018-12-17T23:01:16.279665878Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.282782544Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.285533353Z 2 PC: 95df2 | Character output (Char = '3e')
2018-12-17T23:01:16.290963286Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.29384493Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.296493618Z 93 PC: 93c60 | File sharing functions
2018-12-17T23:01:16.302556621Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.305151867Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.307711477Z 93 PC: 93c67 | File sharing functions
2018-12-17T23:01:16.31086913Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-17T23:01:16.313427217Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-17T23:01:16.316054173Z 10 PC: 93c79 | Buffered keyboard input

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":13809,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:39:11.011109378Z 221 PC: 141b9 | UNKNOWN!
2018-12-25T12:39:11.014086673Z 53 PC: 141c8 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:11.015750804Z 53 PC: 141d5 | Get interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-25T12:39:11.017284884Z 53 PC: 141e2 | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:39:11.019782937Z 37 PC: 1421f | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:11.02141503Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":13809,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:39:11.578923455Z 221 PC: 141b9 | UNKNOWN!
2018-12-25T12:39:11.580726786Z 53 PC: 141c8 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:11.582282344Z 53 PC: 141d5 | Get interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-25T12:39:11.583496837Z 53 PC: 141e2 | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:39:11.584824335Z 37 PC: 1421f | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:11.586675194Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":13809,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:39:11.709683947Z 221 PC: 141b9 | UNKNOWN!
2018-12-25T12:39:11.711635036Z 53 PC: 141c8 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:11.712767146Z 53 PC: 141d5 | Get interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-25T12:39:11.714126591Z 53 PC: 141e2 | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:39:11.717571513Z 37 PC: 1421f | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:11.718858448Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":1,"Min":0,"Second":0,"TimeBased":true,"OriginalID":13809,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:39:11.831003928Z 221 PC: 141b9 | UNKNOWN!
2018-12-25T12:39:11.832253211Z 53 PC: 141c8 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:11.833690234Z 53 PC: 141d5 | Get interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-25T12:39:11.835091971Z 53 PC: 141e2 | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:39:11.837395769Z 37 PC: 1421f | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:11.838809991Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-25T12:39:11.841578493Z 37 PC: 14227 | Set interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-25T12:39:11.843601915Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.845967652Z 37 PC: 1422f | Set interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:39:11.847344504Z 9 PC: 12a86 | Display string (String= 'Goat file (COM/k...). Size=00001770h/0000006000d bytes. ')
2018-12-25T12:39:11.853452957Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.85658578Z 48 PC: 12a8f | Get DOS version
2018-12-25T12:39:11.857973136Z 61 PC: 9ef04 | Open file (Filename = 'A:\TEST.COM')
2018-12-25T12:39:11.86517856Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.868688258Z 87 PC: 9ef0d | Get or set file date and time
2018-12-25T12:39:11.870093702Z 62 PC: 9ee86 | Close file
2018-12-25T12:39:11.872022858Z 61 PC: 9ee95 | Open file (Filename = '')
2018-12-25T12:39:11.879889037Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.882794257Z 93 PC: 12afe | File sharing functions
2018-12-25T12:39:11.885501114Z 9 PC: 12a86 | Display string (See above)
2018-12-25T12:39:11.893692716Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.89733171Z 76 PC: 12ae3 | Terminate with return code (Return code = '1')
2018-12-25T12:39:11.901177509Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.904426528Z 77 PC: 11fe0 | Get program return code
2018-12-25T12:39:11.905822664Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.908968894Z 72 PC: 12174 | Allocate memory
2018-12-25T12:39:11.913876795Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.916665635Z 72 PC: 1218d | Allocate memory
2018-12-25T12:39:11.919627625Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.923598048Z 37 PC: 123c4 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-25T12:39:11.924993788Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.927484105Z 37 PC: 123cb | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-25T12:39:11.929142508Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.932619515Z 37 PC: 123d2 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:39:11.934008115Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.936834211Z 62 PC: 122ab | Close file
2018-12-25T12:39:11.939170752Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.941565962Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.943326755Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.946307921Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.948118576Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.950497481Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.952955407Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.955568671Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.957410303Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.960747003Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.962489559Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.965212957Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.968120481Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.970937767Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.973044305Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.976062748Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.97868296Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.980824472Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.982868153Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.985465009Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.987198357Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.989690768Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.991623856Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.99405659Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.995891733Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.998642666Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.000360916Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.002455318Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.00601513Z 61 PC: 9ef04 | Open file (See above)
2018-12-25T12:39:12.01303219Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.015184559Z 87 PC: 9ef0d | Get or set file date and time (See above)
2018-12-25T12:39:12.017067433Z 62 PC: 9ee86 | Close file (See above)
2018-12-25T12:39:12.020693458Z 61 PC: 9ee95 | Open file (See above)
2018-12-25T12:39:12.02750677Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.030357844Z 66 PC: 12372 | Move file pointer
2018-12-25T12:39:12.031994541Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.034503706Z 63 PC: 12383 | Read file or device (Read 44693 bytes on handle 5)
2018-12-25T12:39:12.051099581Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.053828023Z 62 PC: 1238a | Close file
2018-12-25T12:39:12.057580202Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.06035093Z 99 PC: 99317 | Get DBCS lead byte table pointer
2018-12-25T12:39:12.062311023Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.065034922Z 56 PC: 93b39 | Get or set country info
2018-12-25T12:39:12.067961647Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.070409199Z 64 PC: 99588 | Write file or device (Write 2 bytes on handle 1)
2018-12-25T12:39:12.075420331Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.07824747Z 25 PC: 93ba2 | Get default drive
2018-12-25T12:39:12.080017033Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.08235013Z 71 PC: 95e1d | Get current directory
2018-12-25T12:39:12.088274691Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.090603099Z 64 PC: 99588 | Write file or device (See above)
2018-12-25T12:39:12.094552124Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.104737632Z 2 PC: 95df2 | Character output (Char = '3e')
2018-12-25T12:39:12.107189919Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.109473739Z 93 PC: 93c60 | File sharing functions
2018-12-25T12:39:12.111289233Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.113619455Z 93 PC: 93c67 | File sharing functions
2018-12-25T12:39:12.115634841Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.117792831Z 10 PC: 93c79 | Buffered keyboard input

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":1,"Min":0,"Second":0,"TimeBased":true,"OriginalID":13809,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:39:11.841668888Z 221 PC: 141b9 | UNKNOWN!
2018-12-25T12:39:11.843164272Z 53 PC: 141c8 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:11.844527938Z 53 PC: 141d5 | Get interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-25T12:39:11.84623616Z 53 PC: 141e2 | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:39:11.848746075Z 37 PC: 1421f | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:11.850149558Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-25T12:39:11.852464229Z 37 PC: 14227 | Set interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-25T12:39:11.854254942Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.856813765Z 37 PC: 1422f | Set interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:39:11.858222973Z 9 PC: 12a86 | Display string (String= 'Goat file (COM/k...). Size=00001770h/0000006000d bytes. ')
2018-12-25T12:39:11.864986011Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.867701263Z 48 PC: 12a8f | Get DOS version
2018-12-25T12:39:11.869082731Z 61 PC: 9ef04 | Open file (Filename = 'A:\TEST.COM')
2018-12-25T12:39:11.876648864Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.878639483Z 87 PC: 9ef0d | Get or set file date and time
2018-12-25T12:39:11.879838955Z 62 PC: 9ee86 | Close file
2018-12-25T12:39:11.881443041Z 61 PC: 9ee95 | Open file (Filename = '')
2018-12-25T12:39:11.888278162Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.891828775Z 93 PC: 12afe | File sharing functions
2018-12-25T12:39:11.894232256Z 9 PC: 12a86 | Display string (See above)
2018-12-25T12:39:11.899685804Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.902118813Z 76 PC: 12ae3 | Terminate with return code (Return code = '1')
2018-12-25T12:39:11.905747834Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.90864366Z 77 PC: 11fe0 | Get program return code
2018-12-25T12:39:11.90999226Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.913043343Z 72 PC: 12174 | Allocate memory
2018-12-25T12:39:11.915572832Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.918067271Z 72 PC: 1218d | Allocate memory
2018-12-25T12:39:11.92044418Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.926232304Z 37 PC: 123c4 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-25T12:39:11.927496967Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.929995068Z 37 PC: 123cb | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-25T12:39:11.931303879Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.934218052Z 37 PC: 123d2 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:39:11.935622107Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.938039326Z 62 PC: 122ab | Close file
2018-12-25T12:39:11.942440647Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.944782256Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.946900495Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.949650546Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.95141538Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.953829729Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.961728238Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.964613086Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.96641892Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.975583483Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.977425774Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.979901299Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.982693005Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.985937035Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.988128139Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.990545568Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.992089023Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.993610791Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.994827607Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.997029696Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:11.998272532Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:11.999862839Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.001625313Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.003350677Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.005354192Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.00920715Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.011106161Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.013400416Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.016799969Z 61 PC: 9ef04 | Open file (See above)
2018-12-25T12:39:12.023537445Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.026250685Z 87 PC: 9ef0d | Get or set file date and time (See above)
2018-12-25T12:39:12.029778285Z 62 PC: 9ee86 | Close file (See above)
2018-12-25T12:39:12.032087857Z 61 PC: 9ee95 | Open file (See above)
2018-12-25T12:39:12.037414157Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.03922401Z 66 PC: 12372 | Move file pointer
2018-12-25T12:39:12.040447258Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.042032197Z 63 PC: 12383 | Read file or device (Read 44693 bytes on handle 5)
2018-12-25T12:39:12.053143924Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.055042557Z 62 PC: 1238a | Close file
2018-12-25T12:39:12.057894615Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.059473878Z 99 PC: 99317 | Get DBCS lead byte table pointer
2018-12-25T12:39:12.060767704Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.06234791Z 56 PC: 93b39 | Get or set country info
2018-12-25T12:39:12.063799157Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.065908824Z 64 PC: 99588 | Write file or device (Write 2 bytes on handle 1)
2018-12-25T12:39:12.069016546Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.071851915Z 25 PC: 93ba2 | Get default drive
2018-12-25T12:39:12.074274171Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.07700986Z 71 PC: 95e1d | Get current directory
2018-12-25T12:39:12.082220846Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.085081228Z 64 PC: 99588 | Write file or device (See above)
2018-12-25T12:39:12.088512705Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.090671924Z 2 PC: 95df2 | Character output (Char = '3e')
2018-12-25T12:39:12.093216612Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.09530016Z 93 PC: 93c60 | File sharing functions
2018-12-25T12:39:12.097117663Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.099631709Z 93 PC: 93c67 | File sharing functions
2018-12-25T12:39:12.101348027Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.103430723Z 10 PC: 93c79 | Buffered keyboard input

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":1,"Min":0,"Second":0,"TimeBased":true,"OriginalID":13809,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:39:12.042369939Z 221 PC: 141b9 | UNKNOWN!
2018-12-25T12:39:12.043619306Z 53 PC: 141c8 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:12.045255693Z 53 PC: 141d5 | Get interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-25T12:39:12.04653072Z 53 PC: 141e2 | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:39:12.048271321Z 37 PC: 1421f | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:12.049683303Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-25T12:39:12.051828993Z 37 PC: 14227 | Set interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-25T12:39:12.053762606Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.06939696Z 37 PC: 1422f | Set interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:39:12.070362117Z 9 PC: 12a86 | Display string (String= 'Goat file (COM/k...). Size=00001770h/0000006000d bytes. ')
2018-12-25T12:39:12.074260889Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.076374816Z 48 PC: 12a8f | Get DOS version
2018-12-25T12:39:12.077690317Z 61 PC: 9ef04 | Open file (Filename = 'A:\TEST.COM')
2018-12-25T12:39:12.08526272Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.0883113Z 87 PC: 9ef0d | Get or set file date and time
2018-12-25T12:39:12.08975064Z 62 PC: 9ee86 | Close file
2018-12-25T12:39:12.091582956Z 61 PC: 9ee95 | Open file (Filename = '')
2018-12-25T12:39:12.10021181Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.102484913Z 93 PC: 12afe | File sharing functions
2018-12-25T12:39:12.104341869Z 9 PC: 12a86 | Display string (See above)
2018-12-25T12:39:12.109701064Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.112072162Z 76 PC: 12ae3 | Terminate with return code (Return code = '1')
2018-12-25T12:39:12.114224737Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.123516424Z 77 PC: 11fe0 | Get program return code
2018-12-25T12:39:12.125011194Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.126494804Z 72 PC: 12174 | Allocate memory
2018-12-25T12:39:12.127902217Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.130057575Z 72 PC: 1218d | Allocate memory
2018-12-25T12:39:12.131611132Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.133561524Z 37 PC: 123c4 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-25T12:39:12.134800788Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.136316727Z 37 PC: 123cb | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-25T12:39:12.137247749Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.13917206Z 37 PC: 123d2 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:39:12.14013083Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.141618247Z 62 PC: 122ab | Close file
2018-12-25T12:39:12.144189894Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.145968338Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.147294115Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.149562498Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.150794015Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.15233181Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.156394917Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.158054827Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.1592934Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.16537704Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.166753213Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.168502733Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.169858337Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.172043929Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.173507064Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.175689567Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.177433571Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.179491661Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.180888935Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.183489892Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.185052124Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.187137863Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.196828496Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.199019931Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.200511438Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.203415101Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.20505166Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.208262342Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.211687723Z 61 PC: 9ef04 | Open file (See above)
2018-12-25T12:39:12.218592787Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.22007846Z 87 PC: 9ef0d | Get or set file date and time (See above)
2018-12-25T12:39:12.221972972Z 62 PC: 9ee86 | Close file (See above)
2018-12-25T12:39:12.223215672Z 61 PC: 9ee95 | Open file (See above)
2018-12-25T12:39:12.227086422Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.228528735Z 66 PC: 12372 | Move file pointer
2018-12-25T12:39:12.229960439Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.231344867Z 63 PC: 12383 | Read file or device (Read 44693 bytes on handle 5)
2018-12-25T12:39:12.240879768Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.242852037Z 62 PC: 1238a | Close file
2018-12-25T12:39:12.244939582Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.246359188Z 99 PC: 99317 | Get DBCS lead byte table pointer
2018-12-25T12:39:12.247683543Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.249176973Z 56 PC: 93b39 | Get or set country info
2018-12-25T12:39:12.2505649Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.252689225Z 64 PC: 99588 | Write file or device (Write 2 bytes on handle 1)
2018-12-25T12:39:12.255688936Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.257398258Z 25 PC: 93ba2 | Get default drive
2018-12-25T12:39:12.258941317Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.260443134Z 71 PC: 95e1d | Get current directory
2018-12-25T12:39:12.262877724Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.265560015Z 64 PC: 99588 | Write file or device (See above)
2018-12-25T12:39:12.268956005Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.271124381Z 2 PC: 95df2 | Character output (Char = '3e')
2018-12-25T12:39:12.273639021Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.276530005Z 93 PC: 93c60 | File sharing functions
2018-12-25T12:39:12.278087697Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.280531835Z 93 PC: 93c67 | File sharing functions
2018-12-25T12:39:12.283086566Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.285515865Z 10 PC: 93c79 | Buffered keyboard input

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":1,"Min":1,"Second":0,"TimeBased":true,"OriginalID":13809,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:39:12.823513615Z 221 PC: 141b9 | UNKNOWN!
2018-12-25T12:39:12.825054853Z 53 PC: 141c8 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:12.826877055Z 53 PC: 141d5 | Get interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-25T12:39:12.828525101Z 53 PC: 141e2 | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:39:12.830912628Z 37 PC: 1421f | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:12.832307294Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-25T12:39:12.834661753Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-25T12:39:12.837511408Z 37 PC: 14227 | Set interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-25T12:39:12.840355704Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.843124641Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:12.845895766Z 37 PC: 1422f | Set interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:39:12.848801694Z 9 PC: 12a86 | Display string (String= 'Goat file (COM/k...). Size=00001770h/0000006000d bytes. ')
2018-12-25T12:39:12.855532357Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.857344869Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:12.864948476Z 48 PC: 12a8f | Get DOS version
2018-12-25T12:39:12.871718201Z 61 PC: 9ef04 | Open file (Filename = 'A:\TEST.COM')
2018-12-25T12:39:12.879920741Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.882688849Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:12.885352095Z 87 PC: 9ef0d | Get or set file date and time
2018-12-25T12:39:12.88685747Z 62 PC: 9ee86 | Close file
2018-12-25T12:39:12.888866263Z 61 PC: 9ee95 | Open file (Filename = '')
2018-12-25T12:39:12.896509679Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.898795941Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:12.901761634Z 93 PC: 12afe | File sharing functions
2018-12-25T12:39:12.904102192Z 9 PC: 12a86 | Display string (See above)
2018-12-25T12:39:12.908691971Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.91090334Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:12.914246267Z 76 PC: 12ae3 | Terminate with return code (Return code = '1')
2018-12-25T12:39:12.918548147Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.921301996Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:12.924542277Z 77 PC: 11fe0 | Get program return code
2018-12-25T12:39:12.927089936Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.930486656Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:12.934067235Z 72 PC: 12174 | Allocate memory
2018-12-25T12:39:12.940732086Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.943477646Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:12.946337045Z 72 PC: 1218d | Allocate memory
2018-12-25T12:39:12.94886503Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.951142135Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:12.954535401Z 37 PC: 123c4 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-25T12:39:12.957894927Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.960356165Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:12.963042432Z 37 PC: 123cb | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-25T12:39:12.966445718Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.969094812Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:12.971510562Z 37 PC: 123d2 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:39:12.974055421Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.9765495Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:12.978863075Z 62 PC: 122ab | Close file
2018-12-25T12:39:12.981760976Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.984530847Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:12.987718876Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.990686768Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:12.993170419Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:12.99556438Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:12.998086995Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.000707291Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.002969949Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.004613634Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.007207444Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.009469801Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.01094532Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.014108869Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.016286444Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.017831959Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.020725751Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.023013412Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.024549763Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.027203805Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.029608196Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.031266112Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.034319054Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.036697567Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.038460668Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.041291354Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.043556953Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.045182617Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.047463751Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.049975921Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.051430338Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.053795495Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.056584749Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.058574582Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.060793588Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.06295378Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.064577393Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.066831745Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.06993477Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.071760981Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.074155632Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.079114257Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.082406684Z 61 PC: 9ef04 | Open file (See above)
2018-12-25T12:39:13.089412912Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.092555721Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.095119023Z 87 PC: 9ef0d | Get or set file date and time (See above)
2018-12-25T12:39:13.096546228Z 62 PC: 9ee86 | Close file (See above)
2018-12-25T12:39:13.099022152Z 61 PC: 9ee95 | Open file (See above)
2018-12-25T12:39:13.107120779Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.109921292Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.11364057Z 66 PC: 12372 | Move file pointer
2018-12-25T12:39:13.115404907Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.118144835Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.121129332Z 63 PC: 12383 | Read file or device (Read 44693 bytes on handle 5)
2018-12-25T12:39:13.136652723Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.139079419Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.142341918Z 62 PC: 1238a | Close file
2018-12-25T12:39:13.146426427Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.149354442Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.151930673Z 99 PC: 99317 | Get DBCS lead byte table pointer
2018-12-25T12:39:13.153498944Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.155699754Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.158112045Z 56 PC: 93b39 | Get or set country info
2018-12-25T12:39:13.161238828Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.163748207Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.166105752Z 64 PC: 99588 | Write file or device (Write 2 bytes on handle 1)
2018-12-25T12:39:13.171828434Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.174600948Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.177365837Z 25 PC: 93ba2 | Get default drive
2018-12-25T12:39:13.180202523Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.183471575Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.18592778Z 71 PC: 95e1d | Get current directory
2018-12-25T12:39:13.191092951Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.193536295Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.195923874Z 64 PC: 99588 | Write file or device (See above)
2018-12-25T12:39:13.200498123Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.202960492Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.205630217Z 2 PC: 95df2 | Character output (Char = '3e')
2018-12-25T12:39:13.209107906Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.21070887Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.213930493Z 93 PC: 93c60 | File sharing functions
2018-12-25T12:39:13.216551046Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.218881736Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.221313022Z 93 PC: 93c67 | File sharing functions
2018-12-25T12:39:13.224924934Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.227674643Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.230484003Z 10 PC: 93c79 | Buffered keyboard input

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":1,"Min":1,"Second":0,"TimeBased":true,"OriginalID":13809,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:39:13.188908957Z 221 PC: 141b9 | UNKNOWN!
2018-12-25T12:39:13.195028425Z 53 PC: 141c8 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:13.196151831Z 53 PC: 141d5 | Get interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-25T12:39:13.19723464Z 53 PC: 141e2 | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:39:13.199015266Z 37 PC: 1421f | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:13.20087293Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-25T12:39:13.203598109Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-25T12:39:13.206407545Z 37 PC: 14227 | Set interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-25T12:39:13.207572261Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.216171741Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.218565131Z 37 PC: 1422f | Set interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:39:13.220005276Z 9 PC: 12a86 | Display string (String= 'Goat file (COM/k...). Size=00001770h/0000006000d bytes. ')
2018-12-25T12:39:13.226576278Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.228924417Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.231271285Z 48 PC: 12a8f | Get DOS version
2018-12-25T12:39:13.239805109Z 61 PC: 9ef04 | Open file (Filename = 'A:\TEST.COM')
2018-12-25T12:39:13.247805912Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.249922414Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.253346548Z 87 PC: 9ef0d | Get or set file date and time
2018-12-25T12:39:13.257312855Z 62 PC: 9ee86 | Close file
2018-12-25T12:39:13.25937065Z 61 PC: 9ee95 | Open file (Filename = '')
2018-12-25T12:39:13.267941213Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.270357737Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.272648698Z 93 PC: 12afe | File sharing functions
2018-12-25T12:39:13.275821869Z 9 PC: 12a86 | Display string (See above)
2018-12-25T12:39:13.280053082Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.282407686Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.289710164Z 76 PC: 12ae3 | Terminate with return code (Return code = '1')
2018-12-25T12:39:13.293346971Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.295868026Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.299215122Z 77 PC: 11fe0 | Get program return code
2018-12-25T12:39:13.303400493Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.305955277Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.30959179Z 72 PC: 12174 | Allocate memory
2018-12-25T12:39:13.311669897Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.314113467Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.318801142Z 72 PC: 1218d | Allocate memory
2018-12-25T12:39:13.321501983Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.323932948Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.326515417Z 37 PC: 123c4 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-25T12:39:13.328482271Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.330642458Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.332748622Z 37 PC: 123cb | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-25T12:39:13.334728954Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.33689696Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.339018374Z 37 PC: 123d2 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:39:13.341005952Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.343063391Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.345031882Z 62 PC: 122ab | Close file
2018-12-25T12:39:13.346896995Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.34939821Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.351356174Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.35307872Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.355144015Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.357094475Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.359019969Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.361381773Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.36424769Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.368731786Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.371126846Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.373504837Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.375631473Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.377642351Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.379735077Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.381645229Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.383788869Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.385955187Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.387939061Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.390002999Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.392024706Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.394188263Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.396605614Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.398835498Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.400878601Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.402941959Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.405014381Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.407166706Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.409266884Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.411576235Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.413443062Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.41553003Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.417640236Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.420480744Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.423310104Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.425615765Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.427694784Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.429747688Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.431761487Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.433785154Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.43659916Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.438602127Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.441706021Z 61 PC: 9ef04 | Open file (See above)
2018-12-25T12:39:13.448787859Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.451148363Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.454341293Z 87 PC: 9ef0d | Get or set file date and time (See above)
2018-12-25T12:39:13.456278621Z 62 PC: 9ee86 | Close file (See above)
2018-12-25T12:39:13.458287962Z 61 PC: 9ee95 | Open file (See above)
2018-12-25T12:39:13.465221313Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.467388181Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.469423363Z 66 PC: 12372 | Move file pointer
2018-12-25T12:39:13.471518115Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.473728913Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.476056494Z 63 PC: 12383 | Read file or device (Read 44693 bytes on handle 5)
2018-12-25T12:39:13.488936396Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.491186506Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.493500947Z 62 PC: 1238a | Close file
2018-12-25T12:39:13.497601743Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.500556525Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.502840937Z 99 PC: 99317 | Get DBCS lead byte table pointer
2018-12-25T12:39:13.504530337Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.507372327Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.509372233Z 56 PC: 93b39 | Get or set country info
2018-12-25T12:39:13.511393967Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.513891518Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.516975226Z 64 PC: 99588 | Write file or device (Write 2 bytes on handle 1)
2018-12-25T12:39:13.52213504Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.524548234Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.526756229Z 25 PC: 93ba2 | Get default drive
2018-12-25T12:39:13.528476484Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.530571064Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.532473823Z 71 PC: 95e1d | Get current directory
2018-12-25T12:39:13.536332Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.538554774Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.540793573Z 64 PC: 99588 | Write file or device (See above)
2018-12-25T12:39:13.544524874Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.548022424Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.55058094Z 2 PC: 95df2 | Character output (Char = '3e')
2018-12-25T12:39:13.553240578Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.556854995Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.559398206Z 93 PC: 93c60 | File sharing functions
2018-12-25T12:39:13.561551518Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.566011404Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.56855418Z 93 PC: 93c67 | File sharing functions
2018-12-25T12:39:13.570784949Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.574345903Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.576918057Z 10 PC: 93c79 | Buffered keyboard input

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":1,"Min":1,"Second":0,"TimeBased":true,"OriginalID":13809,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T12:39:13.426530513Z 221 PC: 141b9 | UNKNOWN!
2018-12-25T12:39:13.428693335Z 53 PC: 141c8 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:13.430311494Z 53 PC: 141d5 | Get interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-25T12:39:13.431638074Z 53 PC: 141e2 | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:39:13.438960006Z 37 PC: 1421f | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T12:39:13.44111315Z 44 PC: 9ec97 | Get time 0x9ec97: cmp ch, 0
0x9ec9a: jne 0x9eca1
0x9ec9c: mov dx, 0x236
0x9ec9f: jmp dx
0x9eca1: cmp cl, 0
0x9eca4: jne 0x9ecab
0x9eca6: mov ax, 0x2a1
0x9eca9: jmp ax
0x9ecab: mov ah, 0x2a
0x9ecad: int 0x21
0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
2018-12-25T12:39:13.444422137Z 42 PC: 9ecaf | Get date 0x9ecaf: cmp al, 6
0x9ecb1: je 0x9ec3a
0x9ecb3: pop dx
0x9ecb4: pop cx
0x9ecb5: pop ax
0x9ecb6: popf
0x9ecb7: ljmp 0x19:0x40f8
0x9ecbc: ljmp ptr cs:[0x378]
0x9ecc1: ret
0x9ecc2: push bp
0x9ecc3: mov bp, 0x585
0x9ecc6: jmp bp
0x9ecc8: push bp
0x9ecc9: mov bp, 0x3fa
0x9eccc: jmp bp
0x9ecce: popf
0x9eccf: mov ax, 0x3d33
0x9ecd2: iret
0x9ecd3: popf
0x9ecd4: pushf
2018-12-25T12:39:13.447123827Z 37 PC: 14227 | Set interrupt vector (Interrupt = '9' AKA 'Display string')
2018-12-25T12:39:13.449612143Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.459105796Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.462503681Z 37 PC: 1422f | Set interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T12:39:13.465868182Z 9 PC: 12a86 | Display string (String= 'Goat file (COM/k...). Size=00001770h/0000006000d bytes. ')
2018-12-25T12:39:13.471915894Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.474466524Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.476788503Z 48 PC: 12a8f | Get DOS version
2018-12-25T12:39:13.478562491Z 61 PC: 9ef04 | Open file (Filename = 'A:\TEST.COM')
2018-12-25T12:39:13.485528665Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.487659958Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.490546797Z 87 PC: 9ef0d | Get or set file date and time
2018-12-25T12:39:13.491847254Z 62 PC: 9ee86 | Close file
2018-12-25T12:39:13.493572808Z 61 PC: 9ee95 | Open file (Filename = '')
2018-12-25T12:39:13.512562085Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.515198149Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.518010896Z 93 PC: 12afe | File sharing functions
2018-12-25T12:39:13.521757752Z 9 PC: 12a86 | Display string (See above)
2018-12-25T12:39:13.529411617Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.532211959Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.535832736Z 76 PC: 12ae3 | Terminate with return code (Return code = '1')
2018-12-25T12:39:13.540193933Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.542989729Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.546193207Z 77 PC: 11fe0 | Get program return code
2018-12-25T12:39:13.548934818Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.552412595Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.555853027Z 72 PC: 12174 | Allocate memory
2018-12-25T12:39:13.558665483Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.561148609Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.563984311Z 72 PC: 1218d | Allocate memory
2018-12-25T12:39:13.567092186Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.569525566Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.572005464Z 37 PC: 123c4 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-25T12:39:13.574511287Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.577207754Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.579712034Z 37 PC: 123cb | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-25T12:39:13.58197881Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.584683743Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.58748731Z 37 PC: 123d2 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:39:13.589672367Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.592681615Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.595490861Z 62 PC: 122ab | Close file
2018-12-25T12:39:13.597902193Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.600882168Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.603299141Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.605157986Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.60856474Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.611902554Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.622535363Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.626346286Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.629151917Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.631489525Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.635310976Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.638599678Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.645694658Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.649009718Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.655367565Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.65756967Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.660420311Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.664112332Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.6662831Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.669160605Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.672842896Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.674963441Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.677730317Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.682292938Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.684275642Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.687072514Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.690200863Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.692320387Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.695474548Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.698959534Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.701609529Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.704309738Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.706979665Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.709850303Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.712548728Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.715235606Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.717703355Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.720388686Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.722979642Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.725601865Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.727928798Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.730270218Z 62 PC: 122ab | Close file (See above)
2018-12-25T12:39:13.733863415Z 61 PC: 9ef04 | Open file (See above)
2018-12-25T12:39:13.740930513Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.743456808Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.745599996Z 87 PC: 9ef0d | Get or set file date and time (See above)
2018-12-25T12:39:13.747314182Z 62 PC: 9ee86 | Close file (See above)
2018-12-25T12:39:13.749198038Z 61 PC: 9ee95 | Open file (See above)
2018-12-25T12:39:13.756135892Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.759047402Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.761552408Z 66 PC: 12372 | Move file pointer
2018-12-25T12:39:13.763516883Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.767367219Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.770902264Z 63 PC: 12383 | Read file or device (Read 44693 bytes on handle 5)
2018-12-25T12:39:13.786633624Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.789887094Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.792610384Z 62 PC: 1238a | Close file
2018-12-25T12:39:13.796358942Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.799866001Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.80299249Z 99 PC: 99317 | Get DBCS lead byte table pointer
2018-12-25T12:39:13.804555055Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.806959096Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.810358668Z 56 PC: 93b39 | Get or set country info
2018-12-25T12:39:13.812530555Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.814927052Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.818454177Z 64 PC: 99588 | Write file or device (Write 2 bytes on handle 1)
2018-12-25T12:39:13.823591717Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.826099725Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.829576896Z 25 PC: 93ba2 | Get default drive
2018-12-25T12:39:13.831498407Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.833911334Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.837388578Z 71 PC: 95e1d | Get current directory
2018-12-25T12:39:13.842259804Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.845817676Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.848443022Z 64 PC: 99588 | Write file or device (See above)
2018-12-25T12:39:13.852712163Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.855086688Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.857855406Z 2 PC: 95df2 | Character output (Char = '3e')
2018-12-25T12:39:13.862347221Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.865241229Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.866915189Z 93 PC: 93c60 | File sharing functions
2018-12-25T12:39:13.868895036Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.870557779Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.872210583Z 93 PC: 93c67 | File sharing functions
2018-12-25T12:39:13.874093653Z 44 PC: 9ec97 | Get time (See above)
2018-12-25T12:39:13.875756311Z 42 PC: 9ecaf | Get date (See above)
2018-12-25T12:39:13.878459635Z 10 PC: 93c79 | Buffered keyboard input