.
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-17T22:19:47.91403846Z | 82 | PC: 15670 | Get DOS internal pointers (SYSVARS) |
| 2018-12-17T22:19:47.91590359Z | 74 | PC: 156c0 | Reallocate memory |
| 2018-12-17T22:19:47.917316302Z | 72 | PC: 156c9 | Allocate memory |
| 2018-12-17T22:19:47.918945084Z | 42 | PC: 9f8d2 | Get date 0x9f8d2: mov al, dh 0x9f8d4: sub cx, 0x76c 0x9f8d8: mov ah, cl 0x9f8da: ret 0x9f8db: push ax 0x9f8dc: mov ah, 0x35 0x9f8de: int 0x21 0x9f8e0: mov ax, es 0x9f8e2: mov word ptr [si + 2], ax 0x9f8e5: mov word ptr [si], bx 0x9f8e7: pop ax 0x9f8e8: mov ah, 0x25 0x9f8ea: int 0x21 0x9f8ec: ret 0x9f8ed: push cs 0x9f8ee: pop ds 0x9f8ef: mov byte ptr [0x19], 0 0x9f8f4: mov byte ptr [0x1a], 0 0x9f8f9: call 0xaf8ce 0x9f8fc: cmp ax, word ptr [0x17] |
| 2018-12-17T22:19:47.92203606Z | 53 | PC: 9f8e0 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T22:19:47.923428328Z | 37 | PC: 9f8ec | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T22:19:47.924982902Z | 67 | PC: 9f9e5 | Get or set file attributes |
| 2018-12-17T22:19:47.934994697Z | 61 | PC: 9f9ff | Open file (Filename = 'C:\DOS\FORMAT.COM') |
| 2018-12-17T22:19:47.941752879Z | 87 | PC: 9fa0d | Get or set file date and time |
| 2018-12-17T22:19:47.943156597Z | 63 | PC: 9fa19 | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-17T22:19:47.949445382Z | 66 | PC: 9fa24 | Move file pointer |
| 2018-12-17T22:19:47.950907031Z | 66 | PC: 9fa45 | Move file pointer |
| 2018-12-17T22:19:47.952203173Z | 63 | PC: 9fa4f | Read file or device (Read 26 bytes on handle 5) |
| 2018-12-17T22:19:47.958322969Z | 42 | PC: 9f8d2 | Get date 0x9f8d2: mov al, dh 0x9f8d4: sub cx, 0x76c 0x9f8d8: mov ah, cl 0x9f8da: ret 0x9f8db: push ax 0x9f8dc: mov ah, 0x35 0x9f8de: int 0x21 0x9f8e0: mov ax, es 0x9f8e2: mov word ptr [si + 2], ax 0x9f8e5: mov word ptr [si], bx 0x9f8e7: pop ax 0x9f8e8: mov ah, 0x25 0x9f8ea: int 0x21 0x9f8ec: ret 0x9f8ed: push cs 0x9f8ee: pop ds 0x9f8ef: mov byte ptr [0x19], 0 0x9f8f4: mov byte ptr [0x1a], 0 0x9f8f9: call 0xaf8ce 0x9f8fc: cmp ax, word ptr [0x17] |
| 2018-12-17T22:19:47.961209861Z | 64 | PC: 9fa7e | Write file or device (Write 972 bytes on handle 5) |
| 2018-12-17T22:19:48.305121778Z | 66 | PC: 9fa89 | Move file pointer |
| 2018-12-17T22:19:48.307328012Z | 64 | PC: 9fa9b | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-17T22:19:48.310868285Z | 87 | PC: 9faa2 | Get or set file date and time |
| 2018-12-17T22:19:48.312976728Z | 62 | PC: 9faa6 | Close file |
| 2018-12-17T22:19:48.320469239Z | 37 | PC: 9fac5 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T22:19:48.323379692Z | 53 | PC: 9f8e0 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T22:19:48.325644439Z | 37 | PC: 9f8ec | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T22:19:48.327472188Z | 67 | PC: 9f9e5 | Get or set file attributes |
| 2018-12-17T22:19:48.336046477Z | 37 | PC: 9fac5 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T22:19:48.337476306Z | 30 | PC: 9f923 | Reserved |
| 2018-12-17T22:19:48.338744994Z | 53 | PC: 9f8e0 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T22:19:48.340173569Z | 37 | PC: 9f8ec | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T22:19:48.34180013Z | 67 | PC: 9f9e5 | Get or set file attributes |
| 2018-12-17T22:19:48.349280348Z | 61 | PC: 9f9ff | Open file (Filename = 'C:\DOS\KEYB.COM') |
| 2018-12-17T22:19:48.356707821Z | 87 | PC: 9fa0d | Get or set file date and time |
| 2018-12-17T22:19:48.358288526Z | 63 | PC: 9fa19 | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-17T22:19:48.363681201Z | 66 | PC: 9fa24 | Move file pointer |
| 2018-12-17T22:19:48.365590031Z | 66 | PC: 9fa45 | Move file pointer |
| 2018-12-17T22:19:48.367411307Z | 63 | PC: 9fa4f | Read file or device (Read 26 bytes on handle 5) |
| 2018-12-17T22:19:48.373224334Z | 42 | PC: 9f8d2 | Get date 0x9f8d2: mov al, dh 0x9f8d4: sub cx, 0x76c 0x9f8d8: mov ah, cl 0x9f8da: ret 0x9f8db: push ax 0x9f8dc: mov ah, 0x35 0x9f8de: int 0x21 0x9f8e0: mov ax, es 0x9f8e2: mov word ptr [si + 2], ax 0x9f8e5: mov word ptr [si], bx 0x9f8e7: pop ax 0x9f8e8: mov ah, 0x25 0x9f8ea: int 0x21 0x9f8ec: ret 0x9f8ed: push cs 0x9f8ee: pop ds 0x9f8ef: mov byte ptr [0x19], 0 0x9f8f4: mov byte ptr [0x1a], 0 0x9f8f9: call 0xaf8ce 0x9f8fc: cmp ax, word ptr [0x17] |
| 2018-12-17T22:19:48.375511416Z | 64 | PC: 9fa7e | Write file or device (Write 972 bytes on handle 5) |
| 2018-12-17T22:19:48.3852383Z | 66 | PC: 9fa89 | Move file pointer |
| 2018-12-17T22:19:48.387258321Z | 64 | PC: 9fa9b | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-17T22:19:48.39702989Z | 87 | PC: 9faa2 | Get or set file date and time |
| 2018-12-17T22:19:48.398788546Z | 62 | PC: 9faa6 | Close file |
| 2018-12-17T22:19:48.406814575Z | 37 | PC: 9fac5 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T22:19:48.40846347Z | 53 | PC: 9f8e0 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T22:19:48.409918103Z | 37 | PC: 9f8ec | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T22:19:48.412087459Z | 67 | PC: 9f9e5 | Get or set file attributes |
| 2018-12-17T22:19:48.418635831Z | 37 | PC: 9fac5 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T22:19:48.420629509Z | 53 | PC: 9f8e0 | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-17T22:19:48.421755418Z | 37 | PC: 9f8ec | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-17T22:19:48.423095453Z | 9 | PC: 12a51 | Display string (String= 'This is a sample!') |
| 2018-12-17T22:19:48.426415923Z | 76 | PC: 12a56 | Terminate with return code (Return code = '0') |