{"DateBased":true,"Day":13,"Month":3,"Year":1992,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":16525,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:53:07.888354284Z | 53 | PC: 12b53 | Get interrupt vector (Interrupt = '3' AKA 'Auxiliary input') |
| 2018-12-25T12:53:07.890407045Z | 37 | PC: 12b63 | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input') |
| 2018-12-25T12:53:07.891441951Z | 53 | PC: 12b68 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T12:53:07.8925119Z | 53 | PC: 12b75 | Get interrupt vector (Interrupt = '16' AKA 'Close file') |
| 2018-12-25T12:53:07.894171582Z | 37 | PC: 12b85 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T12:53:07.895194284Z | 25 | PC: 12b94 | Get default drive |
| 2018-12-25T12:53:07.896135124Z | 47 | PC: 12bab | Get disk transfer address |
| 2018-12-25T12:53:07.898088464Z | 26 | PC: 12bbd | Set disk transfer address |
| 2018-12-25T12:53:07.899317927Z | 71 | PC: 12bc7 | Get current directory |
| 2018-12-25T12:53:07.902290274Z | 42 | PC: 12bcc | Get date 0x12bcc: cmp cl, 0xc8 0x12bcf: jb 0x12bdd 0x12bd1: cmp dl, 0xd 0x12bd4: jne 0x12bdd 0x12bd6: cmp al, 5 0x12bd8: jne 0x12bdd 0x12bda: jmp 0x12a43 0x12bdd: mov ah, 0x2c 0x12bdf: int 0x21 0x12be1: cmp dl, byte ptr cs:[0x1d8] 0x12be6: ja 0x12beb 0x12be8: jmp 0x12c03 0x12bea: nop 0x12beb: mov word ptr cs:[0x60e], dx 0x12bf0: cli 0x12bf1: mov dx, 0x1da 0x12bf4: mov ax, 0x2510 0x12bf7: int 0x21 0x12bf9: sti 0x12bfa: clc |
| 2018-12-25T12:53:07.908749672Z | 9 | PC: 12a6a | Display string (String= ' External Override. Dedicated to the jerk who told lies about my girlfriend and almost ruined my life. Out of sight, not out of mind sucker ! ') |
{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":16525,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:53:08.566062763Z | 53 | PC: 12b53 | Get interrupt vector (Interrupt = '3' AKA 'Auxiliary input') |
| 2018-12-25T12:53:08.567732593Z | 37 | PC: 12b63 | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input') |
| 2018-12-25T12:53:08.568658377Z | 53 | PC: 12b68 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T12:53:08.569675001Z | 53 | PC: 12b75 | Get interrupt vector (Interrupt = '16' AKA 'Close file') |
| 2018-12-25T12:53:08.571620426Z | 37 | PC: 12b85 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T12:53:08.572642572Z | 25 | PC: 12b94 | Get default drive |
| 2018-12-25T12:53:08.573577554Z | 47 | PC: 12bab | Get disk transfer address |
| 2018-12-25T12:53:08.575099245Z | 26 | PC: 12bbd | Set disk transfer address |
| 2018-12-25T12:53:08.576168268Z | 71 | PC: 12bc7 | Get current directory |
| 2018-12-25T12:53:08.579495471Z | 42 | PC: 12bcc | Get date 0x12bcc: cmp cl, 0xc8 0x12bcf: jb 0x12bdd 0x12bd1: cmp dl, 0xd 0x12bd4: jne 0x12bdd 0x12bd6: cmp al, 5 0x12bd8: jne 0x12bdd 0x12bda: jmp 0x12a43 0x12bdd: mov ah, 0x2c 0x12bdf: int 0x21 0x12be1: cmp dl, byte ptr cs:[0x1d8] 0x12be6: ja 0x12beb 0x12be8: jmp 0x12c03 0x12bea: nop 0x12beb: mov word ptr cs:[0x60e], dx 0x12bf0: cli 0x12bf1: mov dx, 0x1da 0x12bf4: mov ax, 0x2510 0x12bf7: int 0x21 0x12bf9: sti 0x12bfa: clc |
| 2018-12-25T12:53:08.58214921Z | 44 | PC: 12be1 | Get time 0x12be1: cmp dl, byte ptr cs:[0x1d8] 0x12be6: ja 0x12beb 0x12be8: jmp 0x12c03 0x12bea: nop 0x12beb: mov word ptr cs:[0x60e], dx 0x12bf0: cli 0x12bf1: mov dx, 0x1da 0x12bf4: mov ax, 0x2510 0x12bf7: int 0x21 0x12bf9: sti 0x12bfa: clc 0x12bfb: inc byte ptr cs:[0x1d6] 0x12c00: jmp 0x12c5e 0x12c02: nop 0x12c03: call 0x12e69 0x12c06: jmp 0x12df0 0x12c09: sub ch, byte ptr [0x4f43] 0x12c0d: dec bp 0x12c0e: add al, bh 0x12c10: lea dx, word ptr [0x1f4] |
| 2018-12-25T12:53:08.584320078Z | 37 | PC: 12bf9 | Set interrupt vector (Interrupt = '16' AKA 'Close file') |
| 2018-12-25T12:53:08.58544465Z | 78 | PC: 12c6a | Find first file |
| 2018-12-25T12:53:08.59241311Z | 61 | PC: 12cb6 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T12:53:08.598777565Z | 63 | PC: 12cc2 | Read file or device (Read 2 bytes on handle 5) |
| 2018-12-25T12:53:08.604928564Z | 62 | PC: 12cc8 | Close file |
| 2018-12-25T12:53:08.607503939Z | 79 | PC: 12c9a | Find next file |
| 2018-12-25T12:53:08.61005579Z | 61 | PC: 12cb6 | Open file (See above) |
| 2018-12-25T12:53:08.617391852Z | 63 | PC: 12cc2 | Read file or device (See above) |
| 2018-12-25T12:53:08.635762688Z | 62 | PC: 12cc8 | Close file (See above) |
| 2018-12-25T12:53:08.638029877Z | 79 | PC: 12c9a | Find next file (See above) |
| 2018-12-25T12:53:08.640765433Z | 61 | PC: 12cb6 | Open file (See above) |
| 2018-12-25T12:53:08.648440001Z | 63 | PC: 12cc2 | Read file or device (See above) |
| 2018-12-25T12:53:08.655026434Z | 62 | PC: 12cc8 | Close file (See above) |
| 2018-12-25T12:53:08.656613144Z | 79 | PC: 12c9a | Find next file (See above) |
| 2018-12-25T12:53:08.659290061Z | 61 | PC: 12cb6 | Open file (See above) |
| 2018-12-25T12:53:08.666090833Z | 63 | PC: 12cc2 | Read file or device (See above) |
| 2018-12-25T12:53:08.672062547Z | 62 | PC: 12cc8 | Close file (See above) |
| 2018-12-25T12:53:08.674195364Z | 79 | PC: 12c9a | Find next file (See above) |
| 2018-12-25T12:53:08.677204687Z | 61 | PC: 12cb6 | Open file (See above) |
| 2018-12-25T12:53:08.683976377Z | 63 | PC: 12cc2 | Read file or device (See above) |
| 2018-12-25T12:53:08.690335597Z | 62 | PC: 12cc8 | Close file (See above) |
| 2018-12-25T12:53:08.693269427Z | 79 | PC: 12c9a | Find next file (See above) |
| 2018-12-25T12:53:08.696090122Z | 61 | PC: 12cb6 | Open file (See above) |
| 2018-12-25T12:53:08.702488585Z | 63 | PC: 12cc2 | Read file or device (See above) |
| 2018-12-25T12:53:08.709082147Z | 62 | PC: 12cc8 | Close file (See above) |
| 2018-12-25T12:53:08.710269575Z | 79 | PC: 12c9a | Find next file (See above) |
| 2018-12-25T12:53:08.711945387Z | 61 | PC: 12cb6 | Open file (See above) |
| 2018-12-25T12:53:08.716328094Z | 63 | PC: 12cc2 | Read file or device (See above) |
| 2018-12-25T12:53:08.72251307Z | 62 | PC: 12cc8 | Close file (See above) |
| 2018-12-25T12:53:08.723931631Z | 79 | PC: 12c9a | Find next file (See above) |
| 2018-12-25T12:53:08.726751747Z | 61 | PC: 12cb6 | Open file (See above) |
| 2018-12-25T12:53:08.732833173Z | 63 | PC: 12cc2 | Read file or device (See above) |
| 2018-12-25T12:53:08.73508039Z | 62 | PC: 12cc8 | Close file (See above) |
| 2018-12-25T12:53:08.737481728Z | 79 | PC: 12c9a | Find next file (See above) |
| 2018-12-25T12:53:08.739619578Z | 59 | PC: 12c18 | Change current directory |
| 2018-12-25T12:53:08.743210115Z | 78 | PC: 12c23 | Find first file |
| 2018-12-25T12:53:08.748995008Z | 14 | PC: 12df9 | Set default drive (Drive = 'A') |
| 2018-12-25T12:53:08.750090971Z | 59 | PC: 12e01 | Change current directory |
| 2018-12-25T12:53:08.753821668Z | 59 | PC: 12e09 | Change current directory |
| 2018-12-25T12:53:08.755700448Z | 37 | PC: 12e14 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T12:53:08.756631934Z | 37 | PC: 12e1e | Set interrupt vector (Interrupt = '16' AKA 'Close file') |
| 2018-12-25T12:53:08.757458191Z | 37 | PC: 12e28 | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input') |
| 2018-12-25T12:53:08.759084719Z | 26 | PC: 12e37 | Set disk transfer address |
| 2018-12-25T12:53:08.760600605Z | 9 | PC: 13dc6 | Display string (String= 'Hello - This is a 5000 COM test file, 1993 ') |
{"DateBased":true,"Day":1,"Month":1,"Year":1992,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":16525,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:53:09.111670946Z | 53 | PC: 12b53 | Get interrupt vector (Interrupt = '3' AKA 'Auxiliary input') |
| 2018-12-25T12:53:09.112964177Z | 37 | PC: 12b63 | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input') |
| 2018-12-25T12:53:09.114780038Z | 53 | PC: 12b68 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T12:53:09.115842319Z | 53 | PC: 12b75 | Get interrupt vector (Interrupt = '16' AKA 'Close file') |
| 2018-12-25T12:53:09.11691134Z | 37 | PC: 12b85 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T12:53:09.118347765Z | 25 | PC: 12b94 | Get default drive |
| 2018-12-25T12:53:09.119320416Z | 47 | PC: 12bab | Get disk transfer address |
| 2018-12-25T12:53:09.120374484Z | 26 | PC: 12bbd | Set disk transfer address |
| 2018-12-25T12:53:09.121924572Z | 71 | PC: 12bc7 | Get current directory |
| 2018-12-25T12:53:09.124859436Z | 42 | PC: 12bcc | Get date 0x12bcc: cmp cl, 0xc8 0x12bcf: jb 0x12bdd 0x12bd1: cmp dl, 0xd 0x12bd4: jne 0x12bdd 0x12bd6: cmp al, 5 0x12bd8: jne 0x12bdd 0x12bda: jmp 0x12a43 0x12bdd: mov ah, 0x2c 0x12bdf: int 0x21 0x12be1: cmp dl, byte ptr cs:[0x1d8] 0x12be6: ja 0x12beb 0x12be8: jmp 0x12c03 0x12bea: nop 0x12beb: mov word ptr cs:[0x60e], dx 0x12bf0: cli 0x12bf1: mov dx, 0x1da 0x12bf4: mov ax, 0x2510 0x12bf7: int 0x21 0x12bf9: sti 0x12bfa: clc |
| 2018-12-25T12:53:09.126996831Z | 44 | PC: 12be1 | Get time 0x12be1: cmp dl, byte ptr cs:[0x1d8] 0x12be6: ja 0x12beb 0x12be8: jmp 0x12c03 0x12bea: nop 0x12beb: mov word ptr cs:[0x60e], dx 0x12bf0: cli 0x12bf1: mov dx, 0x1da 0x12bf4: mov ax, 0x2510 0x12bf7: int 0x21 0x12bf9: sti 0x12bfa: clc 0x12bfb: inc byte ptr cs:[0x1d6] 0x12c00: jmp 0x12c5e 0x12c02: nop 0x12c03: call 0x12e69 0x12c06: jmp 0x12df0 0x12c09: sub ch, byte ptr [0x4f43] 0x12c0d: dec bp 0x12c0e: add al, bh 0x12c10: lea dx, word ptr [0x1f4] |
| 2018-12-25T12:53:09.129809881Z | 14 | PC: 12df9 | Set default drive (Drive = 'A') |
| 2018-12-25T12:53:09.130985436Z | 59 | PC: 12e01 | Change current directory |
| 2018-12-25T12:53:09.134763765Z | 59 | PC: 12e09 | Change current directory |
| 2018-12-25T12:53:09.136734605Z | 37 | PC: 12e14 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T12:53:09.137661748Z | 37 | PC: 12e1e | Set interrupt vector (Interrupt = '16' AKA 'Close file') |
| 2018-12-25T12:53:09.138401875Z | 37 | PC: 12e28 | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input') |
| 2018-12-25T12:53:09.139409898Z | 26 | PC: 12e37 | Set disk transfer address |
| 2018-12-25T12:53:09.140665824Z | 9 | PC: 13dc6 | Display string (String= 'Hello - This is a 5000 COM test file, 1993 ') |
{"DateBased":true,"Day":13,"Month":1,"Year":1992,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":16525,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T12:53:09.302174052Z | 53 | PC: 12b53 | Get interrupt vector (Interrupt = '3' AKA 'Auxiliary input') |
| 2018-12-25T12:53:09.303877085Z | 37 | PC: 12b63 | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input') |
| 2018-12-25T12:53:09.305078914Z | 53 | PC: 12b68 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T12:53:09.306150801Z | 53 | PC: 12b75 | Get interrupt vector (Interrupt = '16' AKA 'Close file') |
| 2018-12-25T12:53:09.307601926Z | 37 | PC: 12b85 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T12:53:09.308685766Z | 25 | PC: 12b94 | Get default drive |
| 2018-12-25T12:53:09.309661483Z | 47 | PC: 12bab | Get disk transfer address |
| 2018-12-25T12:53:09.31077473Z | 26 | PC: 12bbd | Set disk transfer address |
| 2018-12-25T12:53:09.312089269Z | 71 | PC: 12bc7 | Get current directory |
| 2018-12-25T12:53:09.314835594Z | 42 | PC: 12bcc | Get date 0x12bcc: cmp cl, 0xc8 0x12bcf: jb 0x12bdd 0x12bd1: cmp dl, 0xd 0x12bd4: jne 0x12bdd 0x12bd6: cmp al, 5 0x12bd8: jne 0x12bdd 0x12bda: jmp 0x12a43 0x12bdd: mov ah, 0x2c 0x12bdf: int 0x21 0x12be1: cmp dl, byte ptr cs:[0x1d8] 0x12be6: ja 0x12beb 0x12be8: jmp 0x12c03 0x12bea: nop 0x12beb: mov word ptr cs:[0x60e], dx 0x12bf0: cli 0x12bf1: mov dx, 0x1da 0x12bf4: mov ax, 0x2510 0x12bf7: int 0x21 0x12bf9: sti 0x12bfa: clc |
| 2018-12-25T12:53:09.316858483Z | 44 | PC: 12be1 | Get time 0x12be1: cmp dl, byte ptr cs:[0x1d8] 0x12be6: ja 0x12beb 0x12be8: jmp 0x12c03 0x12bea: nop 0x12beb: mov word ptr cs:[0x60e], dx 0x12bf0: cli 0x12bf1: mov dx, 0x1da 0x12bf4: mov ax, 0x2510 0x12bf7: int 0x21 0x12bf9: sti 0x12bfa: clc 0x12bfb: inc byte ptr cs:[0x1d6] 0x12c00: jmp 0x12c5e 0x12c02: nop 0x12c03: call 0x12e69 0x12c06: jmp 0x12df0 0x12c09: sub ch, byte ptr [0x4f43] 0x12c0d: dec bp 0x12c0e: add al, bh 0x12c10: lea dx, word ptr [0x1f4] |
| 2018-12-25T12:53:09.319237902Z | 37 | PC: 12bf9 | Set interrupt vector (Interrupt = '16' AKA 'Close file') |
| 2018-12-25T12:53:09.320282755Z | 78 | PC: 12c6a | Find first file |
| 2018-12-25T12:53:09.326018892Z | 61 | PC: 12cb6 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-25T12:53:09.332894071Z | 63 | PC: 12cc2 | Read file or device (Read 2 bytes on handle 5) |
| 2018-12-25T12:53:09.338831769Z | 62 | PC: 12cc8 | Close file |
| 2018-12-25T12:53:09.340400085Z | 79 | PC: 12c9a | Find next file |
| 2018-12-25T12:53:09.34327999Z | 61 | PC: 12cb6 | Open file (See above) |
| 2018-12-25T12:53:09.349486242Z | 63 | PC: 12cc2 | Read file or device (See above) |
| 2018-12-25T12:53:09.355491399Z | 62 | PC: 12cc8 | Close file (See above) |
| 2018-12-25T12:53:09.357739461Z | 79 | PC: 12c9a | Find next file (See above) |
| 2018-12-25T12:53:09.360261197Z | 61 | PC: 12cb6 | Open file (See above) |
| 2018-12-25T12:53:09.371703931Z | 63 | PC: 12cc2 | Read file or device (See above) |
| 2018-12-25T12:53:09.379166719Z | 62 | PC: 12cc8 | Close file (See above) |
| 2018-12-25T12:53:09.38090903Z | 79 | PC: 12c9a | Find next file (See above) |
| 2018-12-25T12:53:09.383536198Z | 61 | PC: 12cb6 | Open file (See above) |
| 2018-12-25T12:53:09.390274691Z | 63 | PC: 12cc2 | Read file or device (See above) |
| 2018-12-25T12:53:09.39645707Z | 62 | PC: 12cc8 | Close file (See above) |
| 2018-12-25T12:53:09.398426282Z | 79 | PC: 12c9a | Find next file (See above) |
| 2018-12-25T12:53:09.401576634Z | 61 | PC: 12cb6 | Open file (See above) |
| 2018-12-25T12:53:09.407799752Z | 63 | PC: 12cc2 | Read file or device (See above) |
| 2018-12-25T12:53:09.413871546Z | 62 | PC: 12cc8 | Close file (See above) |
| 2018-12-25T12:53:09.416143652Z | 79 | PC: 12c9a | Find next file (See above) |
| 2018-12-25T12:53:09.418628258Z | 61 | PC: 12cb6 | Open file (See above) |
| 2018-12-25T12:53:09.424789916Z | 63 | PC: 12cc2 | Read file or device (See above) |
| 2018-12-25T12:53:09.431941572Z | 62 | PC: 12cc8 | Close file (See above) |
| 2018-12-25T12:53:09.434065354Z | 79 | PC: 12c9a | Find next file (See above) |
| 2018-12-25T12:53:09.437093599Z | 61 | PC: 12cb6 | Open file (See above) |
| 2018-12-25T12:53:09.444145475Z | 63 | PC: 12cc2 | Read file or device (See above) |
| 2018-12-25T12:53:09.448147572Z | 62 | PC: 12cc8 | Close file (See above) |
| 2018-12-25T12:53:09.449444163Z | 79 | PC: 12c9a | Find next file (See above) |
| 2018-12-25T12:53:09.45226803Z | 61 | PC: 12cb6 | Open file (See above) |
| 2018-12-25T12:53:09.456240951Z | 63 | PC: 12cc2 | Read file or device (See above) |
| 2018-12-25T12:53:09.460025265Z | 62 | PC: 12cc8 | Close file (See above) |
| 2018-12-25T12:53:09.461991169Z | 79 | PC: 12c9a | Find next file (See above) |
| 2018-12-25T12:53:09.463761934Z | 59 | PC: 12c18 | Change current directory |
| 2018-12-25T12:53:09.466361537Z | 78 | PC: 12c23 | Find first file |
| 2018-12-25T12:53:09.470399994Z | 14 | PC: 12df9 | Set default drive (Drive = 'A') |
| 2018-12-25T12:53:09.471293858Z | 59 | PC: 12e01 | Change current directory |
| 2018-12-25T12:53:09.476530789Z | 59 | PC: 12e09 | Change current directory |
| 2018-12-25T12:53:09.47807118Z | 37 | PC: 12e14 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T12:53:09.478885629Z | 37 | PC: 12e1e | Set interrupt vector (Interrupt = '16' AKA 'Close file') |
| 2018-12-25T12:53:09.479630747Z | 37 | PC: 12e28 | Set interrupt vector (Interrupt = '3' AKA 'Auxiliary input') |
| 2018-12-25T12:53:09.480794019Z | 26 | PC: 12e37 | Set disk transfer address |
| 2018-12-25T12:53:09.481832225Z | 9 | PC: 13dc6 | Display string (String= 'Hello - This is a 5000 COM test file, 1993 ') |