{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":3056,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:48:07.03989022Z | 75 | PC: 12f27 | Execute program |
| 2018-12-25T11:48:07.041476973Z | 53 | PC: 12f34 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:07.042848389Z | 53 | PC: 12f42 | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:07.043927517Z | 53 | PC: 12f50 | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:07.045375944Z | 82 | PC: 12f5e | Get DOS internal pointers (SYSVARS) |
| 2018-12-25T11:48:07.046657559Z | 42 | PC: 13094 | Get date 0x13094: mov ch, byte ptr cs:[si + 0x470] 0x13099: and cx, 0x707 0x1309d: dec cl 0x1309f: cmp ch, cl 0x130a1: je 0x130ab 0x130a3: dec cl 0x130a5: cmp ch, cl 0x130a7: je 0x130b2 0x130a9: clc 0x130aa: ret 0x130ab: cmp dx, word ptr cs:[si + 0x46e] 0x130b0: cmc 0x130b1: ret 0x130b2: cmp dx, word ptr cs:[si + 0x46e] 0x130b7: ret 0x130b8: push sp 0x130b9: push 0x7369 0x130bc: and byte ptr [bx + di + 0x73], ch 0x130bf: and byte ptr [bx + si + 0x4f], cl 0x130c2: push dx |
| 2018-12-25T11:48:07.049939978Z | 37 | PC: 12fb1 | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:07.051717222Z | 53 | PC: 9fa19 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:07.053065729Z | 53 | PC: 9fa1f | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:07.053969345Z | 53 | PC: 9fa25 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:07.054978985Z | 53 | PC: 9fa2b | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:07.056287656Z | 37 | PC: 9f9ad | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:07.057071395Z | 37 | PC: 9f9b6 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:07.057801581Z | 37 | PC: 9fa3d | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:07.058925868Z | 37 | PC: 9fa46 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:07.059643592Z | 42 | PC: 9fa4a | Get date 0x9fa4a: mov word ptr cs:[0x46e], dx 0x9fa4f: mov byte ptr cs:[0x470], cl 0x9fa54: pop ds 0x9fa55: pop dx 0x9fa56: mov ax, 0x3d00 0x9fa59: int 0x21 0x9fa5b: jb 0x9fa0f 0x9fa5d: mov bx, ax 0x9fa5f: mov ax, 0x4202 0x9fa62: mov cx, 0xffff 0x9fa65: mov dx, 0xfb62 0x9fa68: int 0x21 0x9fa6a: jb 0x9fa0b 0x9fa6c: mov ah, 0x3f 0x9fa6e: mov dx, 0x47d 0x9fa71: mov cx, 0xa 0x9fa74: push cs 0x9fa75: pop ds 0x9fa76: int 0x21 0x9fa78: jb 0x9fa0b |
| 2018-12-25T11:48:07.060999243Z | 61 | PC: 9fa5b | Open file (Filename = 'S�') |
| 2018-12-25T11:48:07.065031114Z | 66 | PC: 9fa6a | Move file pointer |
| 2018-12-25T11:48:07.066266737Z | 63 | PC: 9fa78 | Read file or device (Read 10 bytes on handle 5) |
| 2018-12-25T11:48:07.071558645Z | 62 | PC: 9fa7e | Close file |
| 2018-12-25T11:48:07.073309213Z | 67 | PC: 9fa92 | Get or set file attributes |
| 2018-12-25T11:48:07.078486621Z | 67 | PC: 9fa9c | Get or set file attributes |
| 2018-12-25T11:48:07.413114348Z | 61 | PC: 9faa8 | Open file (Filename = '(>Ҡ�*#ۭ�a��&,Ķ�81���w��4"���NG��r���@�3@����ԕ�W��ځ�-d��� ����������c.��� Jj� ]��EM�~ƿ�[���� x� *���5�72�� �=') |
| 2018-12-25T11:48:07.420294353Z | 63 | PC: 9fab8 | Read file or device (Read 24 bytes on handle 5) |
| 2018-12-25T11:48:07.422903007Z | 66 | PC: 9fac7 | Move file pointer |
| 2018-12-25T11:48:07.424227828Z | 87 | PC: 9fb09 | Get or set file date and time |
| 2018-12-25T11:48:07.430822404Z | 64 | PC: 9fb16 | Write file or device (Write 1182 bytes on handle 5) |
| 2018-12-25T11:48:07.758435177Z | 66 | PC: 9fb25 | Move file pointer |
| 2018-12-25T11:48:07.760295791Z | 64 | PC: 9fb31 | Write file or device (Write 24 bytes on handle 5) |
| 2018-12-25T11:48:07.764240702Z | 87 | PC: 9fade | Get or set file date and time |
| 2018-12-25T11:48:07.766099549Z | 62 | PC: 9fae2 | Close file |
| 2018-12-25T11:48:07.848067656Z | 67 | PC: 9faea | Get or set file attributes |
| 2018-12-25T11:48:07.860478278Z | 37 | PC: 9faf1 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:07.861540247Z | 37 | PC: 9faf7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:07.863288469Z | 37 | PC: 9fafd | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:07.870618312Z | 37 | PC: 9fb03 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:07.872124301Z | 42 | PC: 13094 | Get date (See above) |
| 2018-12-25T11:48:07.87458149Z | 240 | PC: 12ab5 | UNKNOWN! |
| 2018-12-25T11:48:07.876145265Z | 53 | PC: 12ac2 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:07.877297453Z | 53 | PC: 12ad0 | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:07.878432383Z | 53 | PC: 12ade | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:07.880330756Z | 82 | PC: 12aec | Get DOS internal pointers (SYSVARS) |
| 2018-12-25T11:48:07.88388338Z | 42 | PC: 12b2e | Get date 0x12b2e: cmp dh, 6 0x12b31: ja 0x12b3b 0x12b33: mov ax, 0x2513 0x12b36: mov dx, 0x471 0x12b39: int 0x21 0x12b3b: mov ax, 0x2521 0x12b3e: mov dx, 0x4a5 0x12b41: int 0x21 0x12b43: pop ds 0x12b44: push ds 0x12b45: push si 0x12b46: push cs 0x12b47: pop es 0x12b48: mov ax, word ptr [0x2c] 0x12b4b: mov ds, ax 0x12b4d: xor cx, cx 0x12b4f: mov di, si 0x12b51: add di, 0x17e 0x12b55: mov bx, di 0x12b57: mov ax, di |
| 2018-12-25T11:48:07.886286987Z | 37 | PC: 12b3b | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:07.88802051Z | 37 | PC: 12b43 | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:07.889684485Z | 61 | PC: 9f2f7 | Open file (Filename = '<') |
| 2018-12-25T11:48:07.895636402Z | 66 | PC: 9f306 | Move file pointer |
| 2018-12-25T11:48:07.897749516Z | 63 | PC: 9f314 | Read file or device (Read 10 bytes on handle 5) |
| 2018-12-25T11:48:07.90368604Z | 62 | PC: 9f31a | Close file |
| 2018-12-25T11:48:07.905673652Z | 53 | PC: 9f32f | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:07.907114701Z | 53 | PC: 9f335 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:07.909182668Z | 53 | PC: 9f33b | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:07.910583716Z | 37 | PC: 9f349 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:07.911945406Z | 37 | PC: 9f273 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:07.914284363Z | 37 | PC: 9f281 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:07.915670944Z | 67 | PC: 9f353 | Get or set file attributes |
| 2018-12-25T11:48:07.923197032Z | 67 | PC: 9f35d | Get or set file attributes |
| 2018-12-25T11:48:07.933410451Z | 61 | PC: 9f369 | Open file (Filename = 'S�') |
| 2018-12-25T11:48:07.940362535Z | 63 | PC: 9f379 | Read file or device (Read 24 bytes on handle 5) |
| 2018-12-25T11:48:07.943122751Z | 66 | PC: 9f384 | Move file pointer |
| 2018-12-25T11:48:07.945249076Z | 87 | PC: 9f3bb | Get or set file date and time |
| 2018-12-25T11:48:07.947583138Z | 64 | PC: 9f3c8 | Write file or device (Write 1137 bytes on handle 5) |
| 2018-12-25T11:48:07.95509775Z | 66 | PC: 9f3d7 | Move file pointer |
| 2018-12-25T11:48:07.956928816Z | 64 | PC: 9f3e3 | Write file or device (Write 24 bytes on handle 5) |
| 2018-12-25T11:48:07.959639225Z | 87 | PC: 9f396 | Get or set file date and time |
| 2018-12-25T11:48:07.961149823Z | 62 | PC: 9f39a | Close file |
| 2018-12-25T11:48:08.004594535Z | 67 | PC: 9f3a2 | Get or set file attributes |
| 2018-12-25T11:48:08.022882341Z | 37 | PC: 9f3a9 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:08.024030154Z | 37 | PC: 9f3af | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:08.025681508Z | 37 | PC: 9f3b5 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:08.026959975Z | 42 | PC: 12b8d | Get date 0x12b8d: cmp dh, 6 0x12b90: ja 0x12bd5 0x12b92: xor ax, ax 0x12b94: mov ds, ax 0x12b96: test word ptr [0x46c], 0x1ff 0x12b9c: jne 0x12bd5 0x12b9e: mov al, 0x3f 0x12ba0: out 0x21, al 0x12ba2: mov ah, 0xf2 0x12ba4: int 0x21 0x12ba6: mov ax, 3 0x12ba9: cmp byte ptr [0x488], 0xfb 0x12bae: jne 0x12bb2 0x12bb0: mov al, 7 0x12bb2: int 0x10 0x12bb4: push cs 0x12bb5: pop ds 0x12bb6: mov ah, 9 0x12bb8: mov dx, 0x16a 0x12bbb: add dx, si |
| 2018-12-25T11:48:08.029051987Z | 9 | PC: 12aa2 | Display string (String= 'Hello - Copyright S & S International, 1990 ') |
{"DateBased":true,"Day":1,"Month":7,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":3056,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:48:07.352544577Z | 75 | PC: 12f27 | Execute program |
| 2018-12-25T11:48:07.354041546Z | 53 | PC: 12f34 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:07.355357961Z | 53 | PC: 12f42 | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:07.356745444Z | 53 | PC: 12f50 | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:07.358447117Z | 82 | PC: 12f5e | Get DOS internal pointers (SYSVARS) |
| 2018-12-25T11:48:07.359563287Z | 42 | PC: 13094 | Get date 0x13094: mov ch, byte ptr cs:[si + 0x470] 0x13099: and cx, 0x707 0x1309d: dec cl 0x1309f: cmp ch, cl 0x130a1: je 0x130ab 0x130a3: dec cl 0x130a5: cmp ch, cl 0x130a7: je 0x130b2 0x130a9: clc 0x130aa: ret 0x130ab: cmp dx, word ptr cs:[si + 0x46e] 0x130b0: cmc 0x130b1: ret 0x130b2: cmp dx, word ptr cs:[si + 0x46e] 0x130b7: ret 0x130b8: push sp 0x130b9: push 0x7369 0x130bc: and byte ptr [bx + di + 0x73], ch 0x130bf: and byte ptr [bx + si + 0x4f], cl 0x130c2: push dx |
| 2018-12-25T11:48:07.361487168Z | 37 | PC: 12fb1 | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:07.378615195Z | 53 | PC: 9fa19 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:07.379740285Z | 53 | PC: 9fa1f | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:07.380803741Z | 53 | PC: 9fa25 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:07.386284147Z | 53 | PC: 9fa2b | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:07.387355938Z | 37 | PC: 9f9ad | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:07.388306577Z | 37 | PC: 9f9b6 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:07.389294016Z | 37 | PC: 9fa3d | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:07.390510974Z | 37 | PC: 9fa46 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:07.39146069Z | 42 | PC: 9fa4a | Get date 0x9fa4a: mov word ptr cs:[0x46e], dx 0x9fa4f: mov byte ptr cs:[0x470], cl 0x9fa54: pop ds 0x9fa55: pop dx 0x9fa56: mov ax, 0x3d00 0x9fa59: int 0x21 0x9fa5b: jb 0x9fa0f 0x9fa5d: mov bx, ax 0x9fa5f: mov ax, 0x4202 0x9fa62: mov cx, 0xffff 0x9fa65: mov dx, 0xfb62 0x9fa68: int 0x21 0x9fa6a: jb 0x9fa0b 0x9fa6c: mov ah, 0x3f 0x9fa6e: mov dx, 0x47d 0x9fa71: mov cx, 0xa 0x9fa74: push cs 0x9fa75: pop ds 0x9fa76: int 0x21 0x9fa78: jb 0x9fa0b |
| 2018-12-25T11:48:07.393467561Z | 61 | PC: 9fa5b | Open file (Filename = 'S�') |
| 2018-12-25T11:48:07.400116287Z | 66 | PC: 9fa6a | Move file pointer |
| 2018-12-25T11:48:07.401339075Z | 63 | PC: 9fa78 | Read file or device (Read 10 bytes on handle 5) |
| 2018-12-25T11:48:07.407333503Z | 62 | PC: 9fa7e | Close file |
| 2018-12-25T11:48:07.409914588Z | 67 | PC: 9fa92 | Get or set file attributes |
| 2018-12-25T11:48:07.415348577Z | 67 | PC: 9fa9c | Get or set file attributes |
| 2018-12-25T11:48:08.429724589Z | 61 | PC: 9faa8 | Open file (Filename = '(>Ҡ�*#ۭ�a��&,Ķ�81���w��4"���NG��r���@�3@����ԕ�W��ځ�-d��� ����������c.��� Jj� ]��EM�~ƿ�[���� x� *���5�72�� �=') |
| 2018-12-25T11:48:08.437105562Z | 63 | PC: 9fab8 | Read file or device (Read 24 bytes on handle 5) |
| 2018-12-25T11:48:08.439738191Z | 66 | PC: 9fac7 | Move file pointer |
| 2018-12-25T11:48:08.441196222Z | 87 | PC: 9fb09 | Get or set file date and time |
| 2018-12-25T11:48:08.44331856Z | 64 | PC: 9fb16 | Write file or device (Write 1182 bytes on handle 5) |
| 2018-12-25T11:48:08.483424258Z | 66 | PC: 9fb25 | Move file pointer |
| 2018-12-25T11:48:08.484503191Z | 64 | PC: 9fb31 | Write file or device (Write 24 bytes on handle 5) |
| 2018-12-25T11:48:08.489212803Z | 87 | PC: 9fade | Get or set file date and time |
| 2018-12-25T11:48:08.490374976Z | 62 | PC: 9fae2 | Close file |
| 2018-12-25T11:48:08.532204682Z | 67 | PC: 9faea | Get or set file attributes |
| 2018-12-25T11:48:08.563941368Z | 37 | PC: 9faf1 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:08.565134046Z | 37 | PC: 9faf7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:08.566128879Z | 37 | PC: 9fafd | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:08.567719527Z | 37 | PC: 9fb03 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:08.569266849Z | 42 | PC: 13094 | Get date (See above) |
| 2018-12-25T11:48:08.571795406Z | 240 | PC: 12ab5 | UNKNOWN! |
| 2018-12-25T11:48:08.572950675Z | 53 | PC: 12ac2 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:08.573953576Z | 53 | PC: 12ad0 | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:08.575016106Z | 53 | PC: 12ade | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:08.576626811Z | 82 | PC: 12aec | Get DOS internal pointers (SYSVARS) |
| 2018-12-25T11:48:08.579212459Z | 42 | PC: 12b2e | Get date 0x12b2e: cmp dh, 6 0x12b31: ja 0x12b3b 0x12b33: mov ax, 0x2513 0x12b36: mov dx, 0x471 0x12b39: int 0x21 0x12b3b: mov ax, 0x2521 0x12b3e: mov dx, 0x4a5 0x12b41: int 0x21 0x12b43: pop ds 0x12b44: push ds 0x12b45: push si 0x12b46: push cs 0x12b47: pop es 0x12b48: mov ax, word ptr [0x2c] 0x12b4b: mov ds, ax 0x12b4d: xor cx, cx 0x12b4f: mov di, si 0x12b51: add di, 0x17e 0x12b55: mov bx, di 0x12b57: mov ax, di |
| 2018-12-25T11:48:08.581156679Z | 37 | PC: 12b43 | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:08.583030328Z | 61 | PC: 9f2f7 | Open file (Filename = '<') |
| 2018-12-25T11:48:08.589848124Z | 66 | PC: 9f306 | Move file pointer |
| 2018-12-25T11:48:08.591417122Z | 63 | PC: 9f314 | Read file or device (Read 10 bytes on handle 5) |
| 2018-12-25T11:48:08.597959902Z | 62 | PC: 9f31a | Close file |
| 2018-12-25T11:48:08.599760484Z | 53 | PC: 9f32f | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:08.601007844Z | 53 | PC: 9f335 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:08.602302001Z | 53 | PC: 9f33b | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:08.604239647Z | 37 | PC: 9f349 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:08.605276927Z | 37 | PC: 9f273 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:08.606140845Z | 37 | PC: 9f281 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:08.608734107Z | 67 | PC: 9f353 | Get or set file attributes |
| 2018-12-25T11:48:08.61387569Z | 67 | PC: 9f35d | Get or set file attributes |
| 2018-12-25T11:48:08.649499944Z | 61 | PC: 9f369 | Open file (Filename = 'S�') |
| 2018-12-25T11:48:08.655897178Z | 63 | PC: 9f379 | Read file or device (Read 24 bytes on handle 5) |
| 2018-12-25T11:48:08.658417454Z | 66 | PC: 9f384 | Move file pointer |
| 2018-12-25T11:48:08.659840281Z | 87 | PC: 9f3bb | Get or set file date and time |
| 2018-12-25T11:48:08.661888524Z | 64 | PC: 9f3c8 | Write file or device (Write 1137 bytes on handle 5) |
| 2018-12-25T11:48:08.725854379Z | 66 | PC: 9f3d7 | Move file pointer |
| 2018-12-25T11:48:08.727115354Z | 64 | PC: 9f3e3 | Write file or device (Write 24 bytes on handle 5) |
| 2018-12-25T11:48:08.729925056Z | 87 | PC: 9f396 | Get or set file date and time |
| 2018-12-25T11:48:08.731274025Z | 62 | PC: 9f39a | Close file |
| 2018-12-25T11:48:08.737582133Z | 67 | PC: 9f3a2 | Get or set file attributes |
| 2018-12-25T11:48:08.747863079Z | 37 | PC: 9f3a9 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:08.748980579Z | 37 | PC: 9f3af | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:08.750074862Z | 37 | PC: 9f3b5 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:08.751776598Z | 42 | PC: 12b8d | Get date 0x12b8d: cmp dh, 6 0x12b90: ja 0x12bd5 0x12b92: xor ax, ax 0x12b94: mov ds, ax 0x12b96: test word ptr [0x46c], 0x1ff 0x12b9c: jne 0x12bd5 0x12b9e: mov al, 0x3f 0x12ba0: out 0x21, al 0x12ba2: mov ah, 0xf2 0x12ba4: int 0x21 0x12ba6: mov ax, 3 0x12ba9: cmp byte ptr [0x488], 0xfb 0x12bae: jne 0x12bb2 0x12bb0: mov al, 7 0x12bb2: int 0x10 0x12bb4: push cs 0x12bb5: pop ds 0x12bb6: mov ah, 9 0x12bb8: mov dx, 0x16a 0x12bbb: add dx, si |
| 2018-12-25T11:48:08.75382319Z | 9 | PC: 12aa2 | Display string (String= 'Hello - Copyright S & S International, 1990 ') |
{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":3056,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:48:07.799159095Z | 75 | PC: 12f27 | Execute program |
| 2018-12-25T11:48:07.801557283Z | 53 | PC: 12f34 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:07.803195977Z | 53 | PC: 12f42 | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:07.804802759Z | 53 | PC: 12f50 | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:07.806626852Z | 82 | PC: 12f5e | Get DOS internal pointers (SYSVARS) |
| 2018-12-25T11:48:07.808632857Z | 42 | PC: 13094 | Get date 0x13094: mov ch, byte ptr cs:[si + 0x470] 0x13099: and cx, 0x707 0x1309d: dec cl 0x1309f: cmp ch, cl 0x130a1: je 0x130ab 0x130a3: dec cl 0x130a5: cmp ch, cl 0x130a7: je 0x130b2 0x130a9: clc 0x130aa: ret 0x130ab: cmp dx, word ptr cs:[si + 0x46e] 0x130b0: cmc 0x130b1: ret 0x130b2: cmp dx, word ptr cs:[si + 0x46e] 0x130b7: ret 0x130b8: push sp 0x130b9: push 0x7369 0x130bc: and byte ptr [bx + di + 0x73], ch 0x130bf: and byte ptr [bx + si + 0x4f], cl 0x130c2: push dx |
| 2018-12-25T11:48:07.811096484Z | 37 | PC: 12fb1 | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:07.813151836Z | 53 | PC: 9fa19 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:07.814992037Z | 53 | PC: 9fa1f | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:07.816409559Z | 53 | PC: 9fa25 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:07.817717376Z | 53 | PC: 9fa2b | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:07.819809506Z | 37 | PC: 9f9ad | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:07.821245103Z | 37 | PC: 9f9b6 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:07.822716463Z | 37 | PC: 9fa3d | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:07.824732259Z | 37 | PC: 9fa46 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:07.825890736Z | 42 | PC: 9fa4a | Get date 0x9fa4a: mov word ptr cs:[0x46e], dx 0x9fa4f: mov byte ptr cs:[0x470], cl 0x9fa54: pop ds 0x9fa55: pop dx 0x9fa56: mov ax, 0x3d00 0x9fa59: int 0x21 0x9fa5b: jb 0x9fa0f 0x9fa5d: mov bx, ax 0x9fa5f: mov ax, 0x4202 0x9fa62: mov cx, 0xffff 0x9fa65: mov dx, 0xfb62 0x9fa68: int 0x21 0x9fa6a: jb 0x9fa0b 0x9fa6c: mov ah, 0x3f 0x9fa6e: mov dx, 0x47d 0x9fa71: mov cx, 0xa 0x9fa74: push cs 0x9fa75: pop ds 0x9fa76: int 0x21 0x9fa78: jb 0x9fa0b |
| 2018-12-25T11:48:07.828240356Z | 61 | PC: 9fa5b | Open file (Filename = 'S�') |
| 2018-12-25T11:48:07.836318783Z | 66 | PC: 9fa6a | Move file pointer |
| 2018-12-25T11:48:07.837870957Z | 63 | PC: 9fa78 | Read file or device (Read 10 bytes on handle 5) |
| 2018-12-25T11:48:07.844761546Z | 62 | PC: 9fa7e | Close file |
| 2018-12-25T11:48:07.847558424Z | 67 | PC: 9fa92 | Get or set file attributes |
| 2018-12-25T11:48:07.853706328Z | 67 | PC: 9fa9c | Get or set file attributes |
| 2018-12-25T11:48:09.215085949Z | 61 | PC: 9faa8 | Open file (Filename = '=)dz�5>ȸ �r��K_���KL��{�') |
| 2018-12-25T11:48:09.222486693Z | 63 | PC: 9fab8 | Read file or device (Read 24 bytes on handle 5) |
| 2018-12-25T11:48:09.226338645Z | 66 | PC: 9fac7 | Move file pointer |
| 2018-12-25T11:48:09.227823198Z | 87 | PC: 9fb09 | Get or set file date and time |
| 2018-12-25T11:48:09.229408921Z | 64 | PC: 9fb16 | Write file or device (Write 1182 bytes on handle 5) |
| 2018-12-25T11:48:09.240978782Z | 66 | PC: 9fb25 | Move file pointer |
| 2018-12-25T11:48:09.242446244Z | 64 | PC: 9fb31 | Write file or device (Write 24 bytes on handle 5) |
| 2018-12-25T11:48:09.245832389Z | 87 | PC: 9fade | Get or set file date and time |
| 2018-12-25T11:48:09.248197328Z | 62 | PC: 9fae2 | Close file |
| 2018-12-25T11:48:09.255910566Z | 67 | PC: 9faea | Get or set file attributes |
| 2018-12-25T11:48:09.265625481Z | 37 | PC: 9faf1 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.268607762Z | 37 | PC: 9faf7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:09.270725454Z | 37 | PC: 9fafd | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:09.273383018Z | 37 | PC: 9fb03 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.278235868Z | 42 | PC: 13094 | Get date (See above) |
| 2018-12-25T11:48:09.296463616Z | 240 | PC: 12ab5 | UNKNOWN! |
| 2018-12-25T11:48:09.298727316Z | 53 | PC: 12ac2 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.30102682Z | 53 | PC: 12ad0 | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:09.302978152Z | 53 | PC: 12ade | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.304978572Z | 82 | PC: 12aec | Get DOS internal pointers (SYSVARS) |
| 2018-12-25T11:48:09.306925766Z | 42 | PC: 12b2e | Get date 0x12b2e: cmp dh, 6 0x12b31: ja 0x12b3b 0x12b33: mov ax, 0x2513 0x12b36: mov dx, 0x471 0x12b39: int 0x21 0x12b3b: mov ax, 0x2521 0x12b3e: mov dx, 0x4a5 0x12b41: int 0x21 0x12b43: pop ds 0x12b44: push ds 0x12b45: push si 0x12b46: push cs 0x12b47: pop es 0x12b48: mov ax, word ptr [0x2c] 0x12b4b: mov ds, ax 0x12b4d: xor cx, cx 0x12b4f: mov di, si 0x12b51: add di, 0x17e 0x12b55: mov bx, di 0x12b57: mov ax, di |
| 2018-12-25T11:48:09.309735396Z | 37 | PC: 12b3b | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.311391733Z | 37 | PC: 12b43 | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:09.313624509Z | 61 | PC: 9f2f7 | Open file (Filename = '<') |
| 2018-12-25T11:48:09.321405605Z | 66 | PC: 9f306 | Move file pointer |
| 2018-12-25T11:48:09.323439169Z | 63 | PC: 9f314 | Read file or device (Read 10 bytes on handle 5) |
| 2018-12-25T11:48:09.330470621Z | 62 | PC: 9f31a | Close file |
| 2018-12-25T11:48:09.333879175Z | 53 | PC: 9f32f | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.335297443Z | 53 | PC: 9f335 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:09.337088623Z | 53 | PC: 9f33b | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.339691992Z | 37 | PC: 9f349 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:09.341637836Z | 37 | PC: 9f273 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.343347008Z | 37 | PC: 9f281 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.345770543Z | 67 | PC: 9f353 | Get or set file attributes |
| 2018-12-25T11:48:09.352416056Z | 67 | PC: 9f35d | Get or set file attributes |
| 2018-12-25T11:48:09.363108242Z | 61 | PC: 9f369 | Open file (Filename = 'S�') |
| 2018-12-25T11:48:09.371033222Z | 63 | PC: 9f379 | Read file or device (Read 24 bytes on handle 5) |
| 2018-12-25T11:48:09.374410172Z | 66 | PC: 9f384 | Move file pointer |
| 2018-12-25T11:48:09.376760831Z | 87 | PC: 9f3bb | Get or set file date and time |
| 2018-12-25T11:48:09.378938186Z | 64 | PC: 9f3c8 | Write file or device (Write 1137 bytes on handle 5) |
| 2018-12-25T11:48:09.390177367Z | 66 | PC: 9f3d7 | Move file pointer |
| 2018-12-25T11:48:09.391824925Z | 64 | PC: 9f3e3 | Write file or device (Write 24 bytes on handle 5) |
| 2018-12-25T11:48:09.395000993Z | 87 | PC: 9f396 | Get or set file date and time |
| 2018-12-25T11:48:09.398222948Z | 62 | PC: 9f39a | Close file |
| 2018-12-25T11:48:09.405613482Z | 67 | PC: 9f3a2 | Get or set file attributes |
| 2018-12-25T11:48:09.415893941Z | 37 | PC: 9f3a9 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.418714956Z | 37 | PC: 9f3af | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:09.420218134Z | 37 | PC: 9f3b5 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.422089828Z | 42 | PC: 12b8d | Get date 0x12b8d: cmp dh, 6 0x12b90: ja 0x12bd5 0x12b92: xor ax, ax 0x12b94: mov ds, ax 0x12b96: test word ptr [0x46c], 0x1ff 0x12b9c: jne 0x12bd5 0x12b9e: mov al, 0x3f 0x12ba0: out 0x21, al 0x12ba2: mov ah, 0xf2 0x12ba4: int 0x21 0x12ba6: mov ax, 3 0x12ba9: cmp byte ptr [0x488], 0xfb 0x12bae: jne 0x12bb2 0x12bb0: mov al, 7 0x12bb2: int 0x10 0x12bb4: push cs 0x12bb5: pop ds 0x12bb6: mov ah, 9 0x12bb8: mov dx, 0x16a 0x12bbb: add dx, si |
| 2018-12-25T11:48:09.425184745Z | 9 | PC: 12aa2 | Display string (String= 'Hello - Copyright S & S International, 1990 ') |
{"DateBased":true,"Day":1,"Month":7,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":3056,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:48:07.822129936Z | 75 | PC: 12f27 | Execute program |
| 2018-12-25T11:48:07.825025824Z | 53 | PC: 12f34 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:07.827037289Z | 53 | PC: 12f42 | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:07.828783622Z | 53 | PC: 12f50 | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:07.830455689Z | 82 | PC: 12f5e | Get DOS internal pointers (SYSVARS) |
| 2018-12-25T11:48:07.8367729Z | 42 | PC: 13094 | Get date 0x13094: mov ch, byte ptr cs:[si + 0x470] 0x13099: and cx, 0x707 0x1309d: dec cl 0x1309f: cmp ch, cl 0x130a1: je 0x130ab 0x130a3: dec cl 0x130a5: cmp ch, cl 0x130a7: je 0x130b2 0x130a9: clc 0x130aa: ret 0x130ab: cmp dx, word ptr cs:[si + 0x46e] 0x130b0: cmc 0x130b1: ret 0x130b2: cmp dx, word ptr cs:[si + 0x46e] 0x130b7: ret 0x130b8: push sp 0x130b9: push 0x7369 0x130bc: and byte ptr [bx + di + 0x73], ch 0x130bf: and byte ptr [bx + si + 0x4f], cl 0x130c2: push dx |
| 2018-12-25T11:48:07.839225861Z | 37 | PC: 12fb1 | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:07.841191264Z | 53 | PC: 9fa19 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:07.843885588Z | 53 | PC: 9fa1f | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:07.845366456Z | 53 | PC: 9fa25 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:07.846797777Z | 53 | PC: 9fa2b | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:07.848889664Z | 37 | PC: 9f9ad | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:07.850580443Z | 37 | PC: 9f9b6 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:07.852253117Z | 37 | PC: 9fa3d | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:07.854476766Z | 37 | PC: 9fa46 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:07.856051785Z | 42 | PC: 9fa4a | Get date 0x9fa4a: mov word ptr cs:[0x46e], dx 0x9fa4f: mov byte ptr cs:[0x470], cl 0x9fa54: pop ds 0x9fa55: pop dx 0x9fa56: mov ax, 0x3d00 0x9fa59: int 0x21 0x9fa5b: jb 0x9fa0f 0x9fa5d: mov bx, ax 0x9fa5f: mov ax, 0x4202 0x9fa62: mov cx, 0xffff 0x9fa65: mov dx, 0xfb62 0x9fa68: int 0x21 0x9fa6a: jb 0x9fa0b 0x9fa6c: mov ah, 0x3f 0x9fa6e: mov dx, 0x47d 0x9fa71: mov cx, 0xa 0x9fa74: push cs 0x9fa75: pop ds 0x9fa76: int 0x21 0x9fa78: jb 0x9fa0b |
| 2018-12-25T11:48:07.858646586Z | 61 | PC: 9fa5b | Open file (Filename = 'S�') |
| 2018-12-25T11:48:07.863409162Z | 66 | PC: 9fa6a | Move file pointer |
| 2018-12-25T11:48:07.86522228Z | 63 | PC: 9fa78 | Read file or device (Read 10 bytes on handle 5) |
| 2018-12-25T11:48:07.871645728Z | 62 | PC: 9fa7e | Close file |
| 2018-12-25T11:48:07.873482262Z | 67 | PC: 9fa92 | Get or set file attributes |
| 2018-12-25T11:48:07.88000245Z | 67 | PC: 9fa9c | Get or set file attributes |
| 2018-12-25T11:48:09.219561989Z | 61 | PC: 9faa8 | Open file (Filename = '=)dz�5>ȸ �r��K_���KL��{�') |
| 2018-12-25T11:48:09.233173508Z | 63 | PC: 9fab8 | Read file or device (Read 24 bytes on handle 5) |
| 2018-12-25T11:48:09.237912928Z | 66 | PC: 9fac7 | Move file pointer |
| 2018-12-25T11:48:09.239714274Z | 87 | PC: 9fb09 | Get or set file date and time |
| 2018-12-25T11:48:09.241997217Z | 64 | PC: 9fb16 | Write file or device (Write 1182 bytes on handle 5) |
| 2018-12-25T11:48:09.255471346Z | 66 | PC: 9fb25 | Move file pointer |
| 2018-12-25T11:48:09.257772141Z | 64 | PC: 9fb31 | Write file or device (Write 24 bytes on handle 5) |
| 2018-12-25T11:48:09.261312696Z | 87 | PC: 9fade | Get or set file date and time |
| 2018-12-25T11:48:09.263934581Z | 62 | PC: 9fae2 | Close file |
| 2018-12-25T11:48:09.282551273Z | 67 | PC: 9faea | Get or set file attributes |
| 2018-12-25T11:48:09.297291189Z | 37 | PC: 9faf1 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.299567246Z | 37 | PC: 9faf7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:09.301135982Z | 37 | PC: 9fafd | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:09.302609983Z | 37 | PC: 9fb03 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.309678738Z | 42 | PC: 13094 | Get date (See above) |
| 2018-12-25T11:48:09.313980715Z | 240 | PC: 12ab5 | UNKNOWN! |
| 2018-12-25T11:48:09.315045766Z | 53 | PC: 12ac2 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.316599144Z | 53 | PC: 12ad0 | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:09.319138677Z | 53 | PC: 12ade | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.320490512Z | 82 | PC: 12aec | Get DOS internal pointers (SYSVARS) |
| 2018-12-25T11:48:09.332821956Z | 42 | PC: 12b2e | Get date 0x12b2e: cmp dh, 6 0x12b31: ja 0x12b3b 0x12b33: mov ax, 0x2513 0x12b36: mov dx, 0x471 0x12b39: int 0x21 0x12b3b: mov ax, 0x2521 0x12b3e: mov dx, 0x4a5 0x12b41: int 0x21 0x12b43: pop ds 0x12b44: push ds 0x12b45: push si 0x12b46: push cs 0x12b47: pop es 0x12b48: mov ax, word ptr [0x2c] 0x12b4b: mov ds, ax 0x12b4d: xor cx, cx 0x12b4f: mov di, si 0x12b51: add di, 0x17e 0x12b55: mov bx, di 0x12b57: mov ax, di |
| 2018-12-25T11:48:09.33611816Z | 37 | PC: 12b43 | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:09.340165281Z | 61 | PC: 9f2f7 | Open file (Filename = '<') |
| 2018-12-25T11:48:09.347932236Z | 66 | PC: 9f306 | Move file pointer |
| 2018-12-25T11:48:09.350201798Z | 63 | PC: 9f314 | Read file or device (Read 10 bytes on handle 5) |
| 2018-12-25T11:48:09.35757367Z | 62 | PC: 9f31a | Close file |
| 2018-12-25T11:48:09.359513032Z | 53 | PC: 9f32f | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.362936928Z | 53 | PC: 9f335 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:09.364398852Z | 53 | PC: 9f33b | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.365812333Z | 37 | PC: 9f349 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:09.368140016Z | 37 | PC: 9f273 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.369477174Z | 37 | PC: 9f281 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.370661966Z | 67 | PC: 9f353 | Get or set file attributes |
| 2018-12-25T11:48:09.376478166Z | 67 | PC: 9f35d | Get or set file attributes |
| 2018-12-25T11:48:09.387431713Z | 61 | PC: 9f369 | Open file (Filename = 'S�') |
| 2018-12-25T11:48:09.394394004Z | 63 | PC: 9f379 | Read file or device (Read 24 bytes on handle 5) |
| 2018-12-25T11:48:09.397605625Z | 66 | PC: 9f384 | Move file pointer |
| 2018-12-25T11:48:09.400548366Z | 87 | PC: 9f3bb | Get or set file date and time |
| 2018-12-25T11:48:09.402460372Z | 64 | PC: 9f3c8 | Write file or device (Write 1137 bytes on handle 5) |
| 2018-12-25T11:48:09.410529784Z | 66 | PC: 9f3d7 | Move file pointer |
| 2018-12-25T11:48:09.4132878Z | 64 | PC: 9f3e3 | Write file or device (Write 24 bytes on handle 5) |
| 2018-12-25T11:48:09.417415241Z | 87 | PC: 9f396 | Get or set file date and time |
| 2018-12-25T11:48:09.419272152Z | 62 | PC: 9f39a | Close file |
| 2018-12-25T11:48:09.427040874Z | 67 | PC: 9f3a2 | Get or set file attributes |
| 2018-12-25T11:48:09.437020274Z | 37 | PC: 9f3a9 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.438264302Z | 37 | PC: 9f3af | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:09.439842823Z | 37 | PC: 9f3b5 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.441344517Z | 42 | PC: 12b8d | Get date 0x12b8d: cmp dh, 6 0x12b90: ja 0x12bd5 0x12b92: xor ax, ax 0x12b94: mov ds, ax 0x12b96: test word ptr [0x46c], 0x1ff 0x12b9c: jne 0x12bd5 0x12b9e: mov al, 0x3f 0x12ba0: out 0x21, al 0x12ba2: mov ah, 0xf2 0x12ba4: int 0x21 0x12ba6: mov ax, 3 0x12ba9: cmp byte ptr [0x488], 0xfb 0x12bae: jne 0x12bb2 0x12bb0: mov al, 7 0x12bb2: int 0x10 0x12bb4: push cs 0x12bb5: pop ds 0x12bb6: mov ah, 9 0x12bb8: mov dx, 0x16a 0x12bbb: add dx, si |
| 2018-12-25T11:48:09.444670563Z | 9 | PC: 12aa2 | Display string (String= 'Hello - Copyright S & S International, 1990 ') |
{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":3056,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:48:08.003692573Z | 75 | PC: 12f27 | Execute program |
| 2018-12-25T11:48:08.006589954Z | 53 | PC: 12f34 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:08.008241988Z | 53 | PC: 12f42 | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:08.010218972Z | 53 | PC: 12f50 | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:08.012004138Z | 82 | PC: 12f5e | Get DOS internal pointers (SYSVARS) |
| 2018-12-25T11:48:08.013726592Z | 42 | PC: 13094 | Get date 0x13094: mov ch, byte ptr cs:[si + 0x470] 0x13099: and cx, 0x707 0x1309d: dec cl 0x1309f: cmp ch, cl 0x130a1: je 0x130ab 0x130a3: dec cl 0x130a5: cmp ch, cl 0x130a7: je 0x130b2 0x130a9: clc 0x130aa: ret 0x130ab: cmp dx, word ptr cs:[si + 0x46e] 0x130b0: cmc 0x130b1: ret 0x130b2: cmp dx, word ptr cs:[si + 0x46e] 0x130b7: ret 0x130b8: push sp 0x130b9: push 0x7369 0x130bc: and byte ptr [bx + di + 0x73], ch 0x130bf: and byte ptr [bx + si + 0x4f], cl 0x130c2: push dx |
| 2018-12-25T11:48:08.016529028Z | 37 | PC: 12fb1 | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:08.019082388Z | 53 | PC: 9fa19 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:08.020678607Z | 53 | PC: 9fa1f | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:08.021949205Z | 53 | PC: 9fa25 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:08.023206121Z | 53 | PC: 9fa2b | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:08.024845548Z | 37 | PC: 9f9ad | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:08.025973947Z | 37 | PC: 9f9b6 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:08.026999575Z | 37 | PC: 9fa3d | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:08.028882803Z | 37 | PC: 9fa46 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:08.030515776Z | 42 | PC: 9fa4a | Get date 0x9fa4a: mov word ptr cs:[0x46e], dx 0x9fa4f: mov byte ptr cs:[0x470], cl 0x9fa54: pop ds 0x9fa55: pop dx 0x9fa56: mov ax, 0x3d00 0x9fa59: int 0x21 0x9fa5b: jb 0x9fa0f 0x9fa5d: mov bx, ax 0x9fa5f: mov ax, 0x4202 0x9fa62: mov cx, 0xffff 0x9fa65: mov dx, 0xfb62 0x9fa68: int 0x21 0x9fa6a: jb 0x9fa0b 0x9fa6c: mov ah, 0x3f 0x9fa6e: mov dx, 0x47d 0x9fa71: mov cx, 0xa 0x9fa74: push cs 0x9fa75: pop ds 0x9fa76: int 0x21 0x9fa78: jb 0x9fa0b |
| 2018-12-25T11:48:08.033718526Z | 61 | PC: 9fa5b | Open file (Filename = 'S�') |
| 2018-12-25T11:48:08.041738802Z | 66 | PC: 9fa6a | Move file pointer |
| 2018-12-25T11:48:08.043161082Z | 63 | PC: 9fa78 | Read file or device (Read 10 bytes on handle 5) |
| 2018-12-25T11:48:08.049583794Z | 62 | PC: 9fa7e | Close file |
| 2018-12-25T11:48:08.052748379Z | 67 | PC: 9fa92 | Get or set file attributes |
| 2018-12-25T11:48:08.058649483Z | 67 | PC: 9fa9c | Get or set file attributes |
| 2018-12-25T11:48:09.219738908Z | 61 | PC: 9faa8 | Open file (Filename = '=)dz�5>ȸ �r��K_���KL��{�') |
| 2018-12-25T11:48:09.236049405Z | 63 | PC: 9fab8 | Read file or device (Read 24 bytes on handle 5) |
| 2018-12-25T11:48:09.240400445Z | 66 | PC: 9fac7 | Move file pointer |
| 2018-12-25T11:48:09.242296781Z | 87 | PC: 9fb09 | Get or set file date and time |
| 2018-12-25T11:48:09.244093348Z | 64 | PC: 9fb16 | Write file or device (Write 1182 bytes on handle 5) |
| 2018-12-25T11:48:09.255793409Z | 66 | PC: 9fb25 | Move file pointer |
| 2018-12-25T11:48:09.258219736Z | 64 | PC: 9fb31 | Write file or device (Write 24 bytes on handle 5) |
| 2018-12-25T11:48:09.261948405Z | 87 | PC: 9fade | Get or set file date and time |
| 2018-12-25T11:48:09.264499065Z | 62 | PC: 9fae2 | Close file |
| 2018-12-25T11:48:09.273094879Z | 67 | PC: 9faea | Get or set file attributes |
| 2018-12-25T11:48:09.284142751Z | 37 | PC: 9faf1 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.286387782Z | 37 | PC: 9faf7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:09.287786698Z | 37 | PC: 9fafd | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:09.289524074Z | 37 | PC: 9fb03 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.292629976Z | 42 | PC: 13094 | Get date (See above) |
| 2018-12-25T11:48:09.295706198Z | 240 | PC: 12ab5 | UNKNOWN! |
| 2018-12-25T11:48:09.297008717Z | 53 | PC: 12ac2 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.299565375Z | 53 | PC: 12ad0 | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:09.301370172Z | 53 | PC: 12ade | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.303144492Z | 82 | PC: 12aec | Get DOS internal pointers (SYSVARS) |
| 2018-12-25T11:48:09.305930643Z | 42 | PC: 12b2e | Get date 0x12b2e: cmp dh, 6 0x12b31: ja 0x12b3b 0x12b33: mov ax, 0x2513 0x12b36: mov dx, 0x471 0x12b39: int 0x21 0x12b3b: mov ax, 0x2521 0x12b3e: mov dx, 0x4a5 0x12b41: int 0x21 0x12b43: pop ds 0x12b44: push ds 0x12b45: push si 0x12b46: push cs 0x12b47: pop es 0x12b48: mov ax, word ptr [0x2c] 0x12b4b: mov ds, ax 0x12b4d: xor cx, cx 0x12b4f: mov di, si 0x12b51: add di, 0x17e 0x12b55: mov bx, di 0x12b57: mov ax, di |
| 2018-12-25T11:48:09.309200323Z | 37 | PC: 12b3b | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.310910986Z | 37 | PC: 12b43 | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:09.313382978Z | 61 | PC: 9f2f7 | Open file (Filename = '<') |
| 2018-12-25T11:48:09.321664095Z | 66 | PC: 9f306 | Move file pointer |
| 2018-12-25T11:48:09.323743402Z | 63 | PC: 9f314 | Read file or device (Read 10 bytes on handle 5) |
| 2018-12-25T11:48:09.330662941Z | 62 | PC: 9f31a | Close file |
| 2018-12-25T11:48:09.334057215Z | 53 | PC: 9f32f | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.336614133Z | 53 | PC: 9f335 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:09.338436443Z | 53 | PC: 9f33b | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.341245159Z | 37 | PC: 9f349 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:09.343494725Z | 37 | PC: 9f273 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.345325195Z | 37 | PC: 9f281 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.347501792Z | 67 | PC: 9f353 | Get or set file attributes |
| 2018-12-25T11:48:09.353377834Z | 67 | PC: 9f35d | Get or set file attributes |
| 2018-12-25T11:48:09.364353825Z | 61 | PC: 9f369 | Open file (Filename = 'S�') |
| 2018-12-25T11:48:09.372449013Z | 63 | PC: 9f379 | Read file or device (Read 24 bytes on handle 5) |
| 2018-12-25T11:48:09.376472982Z | 66 | PC: 9f384 | Move file pointer |
| 2018-12-25T11:48:09.378684752Z | 87 | PC: 9f3bb | Get or set file date and time |
| 2018-12-25T11:48:09.380753475Z | 64 | PC: 9f3c8 | Write file or device (Write 1137 bytes on handle 5) |
| 2018-12-25T11:48:09.395845885Z | 66 | PC: 9f3d7 | Move file pointer |
| 2018-12-25T11:48:09.397327211Z | 64 | PC: 9f3e3 | Write file or device (Write 24 bytes on handle 5) |
| 2018-12-25T11:48:09.400940995Z | 87 | PC: 9f396 | Get or set file date and time |
| 2018-12-25T11:48:09.40309528Z | 62 | PC: 9f39a | Close file |
| 2018-12-25T11:48:09.41065286Z | 67 | PC: 9f3a2 | Get or set file attributes |
| 2018-12-25T11:48:09.420467088Z | 37 | PC: 9f3a9 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.422359513Z | 37 | PC: 9f3af | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:09.423684135Z | 37 | PC: 9f3b5 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.425503573Z | 42 | PC: 12b8d | Get date 0x12b8d: cmp dh, 6 0x12b90: ja 0x12bd5 0x12b92: xor ax, ax 0x12b94: mov ds, ax 0x12b96: test word ptr [0x46c], 0x1ff 0x12b9c: jne 0x12bd5 0x12b9e: mov al, 0x3f 0x12ba0: out 0x21, al 0x12ba2: mov ah, 0xf2 0x12ba4: int 0x21 0x12ba6: mov ax, 3 0x12ba9: cmp byte ptr [0x488], 0xfb 0x12bae: jne 0x12bb2 0x12bb0: mov al, 7 0x12bb2: int 0x10 0x12bb4: push cs 0x12bb5: pop ds 0x12bb6: mov ah, 9 0x12bb8: mov dx, 0x16a 0x12bbb: add dx, si |
| 2018-12-25T11:48:09.429860849Z | 9 | PC: 12aa2 | Display string (String= 'Hello - Copyright S & S International, 1990 ') |
{"DateBased":true,"Day":1,"Month":7,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":3056,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:48:08.007743052Z | 75 | PC: 12f27 | Execute program |
| 2018-12-25T11:48:08.009974228Z | 53 | PC: 12f34 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:08.011359314Z | 53 | PC: 12f42 | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:08.012611518Z | 53 | PC: 12f50 | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:08.014443284Z | 82 | PC: 12f5e | Get DOS internal pointers (SYSVARS) |
| 2018-12-25T11:48:08.016224928Z | 42 | PC: 13094 | Get date 0x13094: mov ch, byte ptr cs:[si + 0x470] 0x13099: and cx, 0x707 0x1309d: dec cl 0x1309f: cmp ch, cl 0x130a1: je 0x130ab 0x130a3: dec cl 0x130a5: cmp ch, cl 0x130a7: je 0x130b2 0x130a9: clc 0x130aa: ret 0x130ab: cmp dx, word ptr cs:[si + 0x46e] 0x130b0: cmc 0x130b1: ret 0x130b2: cmp dx, word ptr cs:[si + 0x46e] 0x130b7: ret 0x130b8: push sp 0x130b9: push 0x7369 0x130bc: and byte ptr [bx + di + 0x73], ch 0x130bf: and byte ptr [bx + si + 0x4f], cl 0x130c2: push dx |
| 2018-12-25T11:48:08.020434893Z | 37 | PC: 12fb1 | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:08.022311827Z | 53 | PC: 9fa19 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:08.024757191Z | 53 | PC: 9fa1f | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:08.02654869Z | 53 | PC: 9fa25 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:08.028302142Z | 53 | PC: 9fa2b | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:08.030351703Z | 37 | PC: 9f9ad | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:08.031716427Z | 37 | PC: 9f9b6 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:08.033132316Z | 37 | PC: 9fa3d | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:08.035288762Z | 37 | PC: 9fa46 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:08.036767014Z | 42 | PC: 9fa4a | Get date 0x9fa4a: mov word ptr cs:[0x46e], dx 0x9fa4f: mov byte ptr cs:[0x470], cl 0x9fa54: pop ds 0x9fa55: pop dx 0x9fa56: mov ax, 0x3d00 0x9fa59: int 0x21 0x9fa5b: jb 0x9fa0f 0x9fa5d: mov bx, ax 0x9fa5f: mov ax, 0x4202 0x9fa62: mov cx, 0xffff 0x9fa65: mov dx, 0xfb62 0x9fa68: int 0x21 0x9fa6a: jb 0x9fa0b 0x9fa6c: mov ah, 0x3f 0x9fa6e: mov dx, 0x47d 0x9fa71: mov cx, 0xa 0x9fa74: push cs 0x9fa75: pop ds 0x9fa76: int 0x21 0x9fa78: jb 0x9fa0b |
| 2018-12-25T11:48:08.039344804Z | 61 | PC: 9fa5b | Open file (Filename = 'S�') |
| 2018-12-25T11:48:08.046758277Z | 66 | PC: 9fa6a | Move file pointer |
| 2018-12-25T11:48:08.04835499Z | 63 | PC: 9fa78 | Read file or device (Read 10 bytes on handle 5) |
| 2018-12-25T11:48:08.057554925Z | 62 | PC: 9fa7e | Close file |
| 2018-12-25T11:48:08.061008841Z | 67 | PC: 9fa92 | Get or set file attributes |
| 2018-12-25T11:48:08.067062384Z | 67 | PC: 9fa9c | Get or set file attributes |
| 2018-12-25T11:48:09.215881711Z | 61 | PC: 9faa8 | Open file |
| 2018-12-25T11:48:09.226316643Z | 63 | PC: 9fab8 | Read file or device (Read 24 bytes on handle 5) |
| 2018-12-25T11:48:09.230252205Z | 66 | PC: 9fac7 | Move file pointer |
| 2018-12-25T11:48:09.23169044Z | 87 | PC: 9fb09 | Get or set file date and time |
| 2018-12-25T11:48:09.233460998Z | 64 | PC: 9fb16 | Write file or device (Write 1182 bytes on handle 5) |
| 2018-12-25T11:48:09.240346282Z | 66 | PC: 9fb25 | Move file pointer |
| 2018-12-25T11:48:09.241755844Z | 64 | PC: 9fb31 | Write file or device (Write 24 bytes on handle 5) |
| 2018-12-25T11:48:09.245337941Z | 87 | PC: 9fade | Get or set file date and time |
| 2018-12-25T11:48:09.247344461Z | 62 | PC: 9fae2 | Close file |
| 2018-12-25T11:48:09.255451714Z | 67 | PC: 9faea | Get or set file attributes |
| 2018-12-25T11:48:09.265534549Z | 37 | PC: 9faf1 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.268250897Z | 37 | PC: 9faf7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:09.270462789Z | 37 | PC: 9fafd | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:09.271801114Z | 37 | PC: 9fb03 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.274220544Z | 42 | PC: 13094 | Get date (See above) |
| 2018-12-25T11:48:09.277612468Z | 240 | PC: 12ab5 | UNKNOWN! |
| 2018-12-25T11:48:09.278956629Z | 53 | PC: 12ac2 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.281153775Z | 53 | PC: 12ad0 | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:09.282609254Z | 53 | PC: 12ade | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.283972785Z | 82 | PC: 12aec | Get DOS internal pointers (SYSVARS) |
| 2018-12-25T11:48:09.286363144Z | 42 | PC: 12b2e | Get date 0x12b2e: cmp dh, 6 0x12b31: ja 0x12b3b 0x12b33: mov ax, 0x2513 0x12b36: mov dx, 0x471 0x12b39: int 0x21 0x12b3b: mov ax, 0x2521 0x12b3e: mov dx, 0x4a5 0x12b41: int 0x21 0x12b43: pop ds 0x12b44: push ds 0x12b45: push si 0x12b46: push cs 0x12b47: pop es 0x12b48: mov ax, word ptr [0x2c] 0x12b4b: mov ds, ax 0x12b4d: xor cx, cx 0x12b4f: mov di, si 0x12b51: add di, 0x17e 0x12b55: mov bx, di 0x12b57: mov ax, di |
| 2018-12-25T11:48:09.289077654Z | 37 | PC: 12b43 | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-25T11:48:09.291014403Z | 61 | PC: 9f2f7 | Open file (Filename = '<') |
| 2018-12-25T11:48:09.299753523Z | 66 | PC: 9f306 | Move file pointer |
| 2018-12-25T11:48:09.303320837Z | 63 | PC: 9f314 | Read file or device (Read 10 bytes on handle 5) |
| 2018-12-25T11:48:09.312502583Z | 62 | PC: 9f31a | Close file |
| 2018-12-25T11:48:09.316078186Z | 53 | PC: 9f32f | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.31859925Z | 53 | PC: 9f335 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:09.320549167Z | 53 | PC: 9f33b | Get interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.322607563Z | 37 | PC: 9f349 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:09.325803676Z | 37 | PC: 9f273 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.327768893Z | 37 | PC: 9f281 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.329745201Z | 67 | PC: 9f353 | Get or set file attributes |
| 2018-12-25T11:48:09.33681707Z | 67 | PC: 9f35d | Get or set file attributes |
| 2018-12-25T11:48:09.347204066Z | 61 | PC: 9f369 | Open file (Filename = 'S�') |
| 2018-12-25T11:48:09.354582905Z | 63 | PC: 9f379 | Read file or device (Read 24 bytes on handle 5) |
| 2018-12-25T11:48:09.359611646Z | 66 | PC: 9f384 | Move file pointer |
| 2018-12-25T11:48:09.36171095Z | 87 | PC: 9f3bb | Get or set file date and time |
| 2018-12-25T11:48:09.364622176Z | 64 | PC: 9f3c8 | Write file or device (Write 1137 bytes on handle 5) |
| 2018-12-25T11:48:09.374056729Z | 66 | PC: 9f3d7 | Move file pointer |
| 2018-12-25T11:48:09.375870362Z | 64 | PC: 9f3e3 | Write file or device (Write 24 bytes on handle 5) |
| 2018-12-25T11:48:09.379066557Z | 87 | PC: 9f396 | Get or set file date and time |
| 2018-12-25T11:48:09.38165588Z | 62 | PC: 9f39a | Close file |
| 2018-12-25T11:48:09.391307921Z | 67 | PC: 9f3a2 | Get or set file attributes |
| 2018-12-25T11:48:09.402125997Z | 37 | PC: 9f3a9 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP') |
| 2018-12-25T11:48:09.404016357Z | 37 | PC: 9f3af | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:48:09.407059396Z | 37 | PC: 9f3b5 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:48:09.409216348Z | 42 | PC: 12b8d | Get date 0x12b8d: cmp dh, 6 0x12b90: ja 0x12bd5 0x12b92: xor ax, ax 0x12b94: mov ds, ax 0x12b96: test word ptr [0x46c], 0x1ff 0x12b9c: jne 0x12bd5 0x12b9e: mov al, 0x3f 0x12ba0: out 0x21, al 0x12ba2: mov ah, 0xf2 0x12ba4: int 0x21 0x12ba6: mov ax, 3 0x12ba9: cmp byte ptr [0x488], 0xfb 0x12bae: jne 0x12bb2 0x12bb0: mov al, 7 0x12bb2: int 0x10 0x12bb4: push cs 0x12bb5: pop ds 0x12bb6: mov ah, 9 0x12bb8: mov dx, 0x16a 0x12bbb: add dx, si |
| 2018-12-25T11:48:09.412235437Z | 9 | PC: 12aa2 | Display string (String= 'Hello - Copyright S & S International, 1990 ') |