{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":5160,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:53:54.241096207Z | 42 | PC: 135dc | Get date 0x135dc: cmp dh, dl 0x135de: jne 0x135ff 0x135e0: mov ah, 0x13 0x135e2: int 0x2f 0x135e4: mov ax, 0x2513 0x135e7: int 0x21 0x135e9: mov cx, 1 0x135ec: mov dx, 0x680 0x135ef: mov ax, 0x310 0x135f2: call 0x2357d 0x135f5: dec dh 0x135f7: jns 0x135ef 0x135f9: mov dh, 6 0x135fb: inc ch 0x135fd: jmp 0x135ef 0x135ff: in al, 0x21 0x13601: push ax 0x13602: mov al, 0xff 0x13604: out 0x21, al 0x13606: pop ax |
| 2018-12-25T11:53:54.245043393Z | 37 | PC: 135e9 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:53:54.24714049Z | 1 | PC: 12992 | Character input |
{"DateBased":true,"Day":2,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":5160,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:53:54.2208028Z | 42 | PC: 135dc | Get date 0x135dc: cmp dh, dl 0x135de: jne 0x135ff 0x135e0: mov ah, 0x13 0x135e2: int 0x2f 0x135e4: mov ax, 0x2513 0x135e7: int 0x21 0x135e9: mov cx, 1 0x135ec: mov dx, 0x680 0x135ef: mov ax, 0x310 0x135f2: call 0x2357d 0x135f5: dec dh 0x135f7: jns 0x135ef 0x135f9: mov dh, 6 0x135fb: inc ch 0x135fd: jmp 0x135ef 0x135ff: in al, 0x21 0x13601: push ax 0x13602: mov al, 0xff 0x13604: out 0x21, al 0x13606: pop ax |
| 2018-12-25T11:53:54.244364933Z | 240 | PC: 13618 | UNKNOWN! |
| 2018-12-25T11:53:56.336799906Z | 72 | PC: 8f1b9 | Allocate memory |
| 2018-12-25T11:53:56.339431396Z | 72 | PC: 8f1bd | Allocate memory |
| 2018-12-25T11:53:56.342621718Z | 99 | PC: 90858 | Get DBCS lead byte table pointer |
| 2018-12-25T11:53:56.346745081Z | 61 | PC: 91f88 | Open file (Filename = 'C:\WINDOWS\HIMEM.SYS') |
| 2018-12-25T11:53:56.358873786Z | 66 | PC: 91f95 | Move file pointer |
| 2018-12-25T11:53:56.360829469Z | 62 | PC: 91fc1 | Close file |
| 2018-12-25T11:53:56.363767315Z | 75 | PC: 91fe0 | Execute program |
| 2018-12-25T11:53:56.38205014Z | 98 | PC: 916f1 | Get current PSP |
| 2018-12-25T11:53:56.383510189Z | 9 | PC: c605 | Display string (String= ' 6� � r�&;] u') |
| 2018-12-25T11:53:56.401415577Z | 48 | PC: c609 | Get DOS version |
| 2018-12-25T11:53:56.405994504Z | 9 | PC: c382 | Display string (String= ' Installed A20 handler number ') |
| 2018-12-25T11:53:56.410958795Z | 2 | PC: c38c | Character output (Char = '32') |
| 2018-12-25T11:53:56.41599837Z | 2 | PC: c3a7 | Character output (Char = '2e') |
| 2018-12-25T11:53:56.421221629Z | 9 | PC: c6d9 | Display string (String= '���� �VH�VD���V@������� �� ���� �_���Ku��t1��� ���� �D�����t �� ��������a 1��Z � �� � �W���� ����� �5 � ��|�����(���������Nj�(������� �p�^') |
| 2018-12-25T11:53:56.427927774Z | 9 | PC: c6e0 | Display string (String= ' �5 � ��|�����(���������Nj�(������� �p�^') |
| 2018-12-25T11:53:56.438607878Z | 61 | PC: 91f88 | Open file (See above) |
| 2018-12-25T11:53:56.453914494Z | 66 | PC: 91f95 | Move file pointer (See above) |
| 2018-12-25T11:53:56.455666266Z | 62 | PC: 91fc1 | Close file (See above) |
| 2018-12-25T11:53:56.458880062Z | 75 | PC: 91fe0 | Execute program (See above) |
| 2018-12-25T11:53:56.488512987Z | 98 | PC: 916f1 | Get current PSP (See above) |
| 2018-12-25T11:53:56.493803488Z | 82 | PC: 13d46 | Get DOS internal pointers (SYSVARS) |
| 2018-12-25T11:53:56.495574369Z | 53 | PC: 13ac3 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:53:56.497309247Z | 37 | PC: 13ad6 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:53:56.498623489Z | 53 | PC: 13ae0 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address') |
| 2018-12-25T11:53:56.49997461Z | 37 | PC: 13af3 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address') |
| 2018-12-25T11:53:56.502187508Z | 9 | PC: 13a0d | Display string (Could not find end pointer) |
| 2018-12-25T11:53:56.519785442Z | 62 | PC: 8f8eb | Close file |
| 2018-12-25T11:53:56.521843043Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-25T11:53:56.52480248Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.526507429Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.528250611Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.531019487Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.533188406Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.535461477Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.539203547Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.541323332Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.543551496Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.54627944Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.548431683Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.550505858Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.552776057Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.554952002Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.557041804Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.55913975Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.56183994Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.563603098Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.565330642Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.568447477Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.570125037Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.571900498Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.574660467Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.576640335Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.578703083Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.581931663Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.583859457Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.585738456Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.588280415Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:56.590148345Z | 61 | PC: 8f8ff | Open file (Filename = '') |
| 2018-12-25T11:53:56.595501132Z | 62 | PC: 8f90e | Close file |
| 2018-12-25T11:53:56.597434483Z | 69 | PC: 8f915 | Duplicate handle |
| 2018-12-25T11:53:56.599471509Z | 69 | PC: 8f919 | Duplicate handle |
| 2018-12-25T11:53:56.601313554Z | 61 | PC: 9387b | Open file (Filename = '') |
| 2018-12-25T11:53:56.606500322Z | 68 | PC: 9386b | I/O control for devices (Set for = '') |
| 2018-12-25T11:53:56.608879346Z | 61 | PC: 9387b | Open file (See above) |
| 2018-12-25T11:53:56.614002256Z | 68 | PC: 9386b | I/O control for devices (See above) |
| 2018-12-25T11:53:56.615791606Z | 74 | PC: 8f9c4 | Reallocate memory |
| 2018-12-25T11:53:56.617869862Z | 72 | PC: 8f9e0 | Allocate memory |
| 2018-12-25T11:53:56.619741148Z | 72 | PC: 8f9e4 | Allocate memory |
| 2018-12-25T11:53:56.621395884Z | 74 | PC: 8f9fb | Reallocate memory |
| 2018-12-25T11:53:56.623816489Z | 72 | PC: 8fa02 | Allocate memory |
| 2018-12-25T11:53:56.626428701Z | 72 | PC: 8fa06 | Allocate memory |
| 2018-12-25T11:53:56.627977543Z | 73 | PC: 8fa11 | Release memory |
| 2018-12-25T11:53:56.630267626Z | 73 | PC: 8efea | Release memory |
| 2018-12-25T11:53:56.632109381Z | 74 | PC: 8f003 | Reallocate memory |
| 2018-12-25T11:53:56.635938257Z | 72 | PC: 8f054 | Allocate memory |
| 2018-12-25T11:53:56.638019616Z | 72 | PC: 8f058 | Allocate memory |
| 2018-12-25T11:53:56.641358144Z | 73 | PC: 8f060 | Release memory |
| 2018-12-25T11:53:56.644011697Z | 61 | PC: 8f080 | Open file (Filename = 'r,� S� �� ����[ �
|
| 2018-12-25T11:53:56.657176521Z | 63 | PC: 8f095 | Read file or device (Read 4 bytes on handle 5) |
| 2018-12-25T11:53:56.664127015Z | 66 | PC: 8f0ad | Move file pointer |
| 2018-12-25T11:53:56.665994501Z | 62 | PC: 8f0d1 | Close file |
| 2018-12-25T11:53:56.667872029Z | 75 | PC: 8f0f2 | Execute program |
| 2018-12-25T11:53:56.69325186Z | 80 | PC: 12be9 | Set current PSP |
| 2018-12-25T11:53:56.694202482Z | 48 | PC: 12bee | Get DOS version |
| 2018-12-25T11:53:56.695745493Z | 99 | PC: 193d0 | Get DBCS lead byte table pointer |
| 2018-12-25T11:53:56.699576174Z | 101 | PC: 12c74 | Get extended country info |
| 2018-12-25T11:53:56.700957533Z | 99 | PC: 12c7a | Get DBCS lead byte table pointer |
| 2018-12-25T11:53:56.702074812Z | 74 | PC: 12cdc | Reallocate memory |
| 2018-12-25T11:53:56.704160489Z | 72 | PC: 1355d | Allocate memory |
| 2018-12-25T11:53:56.705790547Z | 25 | PC: 13596 | Get default drive |
| 2018-12-25T11:53:56.706746028Z | 71 | PC: 135ad | Get current directory |
| 2018-12-25T11:53:56.710237381Z | 59 | PC: 135ba | Change current directory |
| 2018-12-25T11:53:56.716338791Z | 59 | PC: 135c8 | Change current directory |
| 2018-12-25T11:53:56.722887227Z | 59 | PC: 135d3 | Change current directory |
| 2018-12-25T11:53:56.72720337Z | 25 | PC: 12d13 | Get default drive |
| 2018-12-25T11:53:56.729777305Z | 37 | PC: 127d3 | Set interrupt vector (Interrupt = '34' AKA 'Random write') |
| 2018-12-25T11:53:56.731610945Z | 37 | PC: 127da | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records') |
| 2018-12-25T11:53:56.733383871Z | 37 | PC: 127e1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:53:56.737317992Z | 80 | PC: 1301d | Set current PSP |
| 2018-12-25T11:53:56.738764371Z | 37 | PC: 13041 | Set interrupt vector (Interrupt = '46' AKA 'Set verify flag') |
| 2018-12-25T11:53:56.740706891Z | 53 | PC: 13362 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address') |
| 2018-12-25T11:53:56.743690991Z | 37 | PC: 13383 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address') |
| 2018-12-25T11:53:56.745555788Z | 51 | PC: 13417 | Get or set Ctrl-Break |
| 2018-12-25T11:53:56.74828452Z | 72 | PC: 130ec | Allocate memory |
| 2018-12-25T11:53:56.751693686Z | 61 | PC: 131b2 | Open file (Filename = '') |
| 2018-12-25T11:53:56.756162977Z | 62 | PC: 131ba | Close file |
| 2018-12-25T11:53:56.757745021Z | 51 | PC: 1344c | Get or set Ctrl-Break |
| 2018-12-25T11:53:56.758691813Z | 74 | PC: 1197c | Reallocate memory |
| 2018-12-25T11:53:56.760549929Z | 72 | PC: 11991 | Allocate memory |
| 2018-12-25T11:53:56.762683575Z | 73 | PC: 119b2 | Release memory |
| 2018-12-25T11:53:56.764515508Z | 72 | PC: 119bd | Allocate memory |
| 2018-12-25T11:53:56.767093226Z | 73 | PC: 119df | Release memory |
| 2018-12-25T11:53:56.76822333Z | 72 | PC: 119f5 | Allocate memory |
| 2018-12-25T11:53:56.769621453Z | 72 | PC: 119fd | Allocate memory |