{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":5179,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:53:56.169571934Z | 42 | PC: 12afa | Get date 0x12afa: cmp dh, 4 0x12afd: jne 0x12b2c 0x12aff: xor dx, dx 0x12b01: mov ah, 0x19 0x12b03: int 0x21 0x12b05: xor bx, bx 0x12b07: mov ds, bx 0x12b09: mov cx, 0x77 0x12b0c: int 0x26 0x12b0e: jb 0x12b1a 0x12b10: pop di 0x12b11: add dx, 0x78 0x12b14: cmp dx, 0x2d0 0x12b18: jne 0x12b09 0x12b1a: ljmp 0xf000:0xfff0 0x12b1f: add ax, word ptr [bp + di + 0x68] 0x12b22: popaw 0x12b23: outsw dx, word ptr [si] 0x12b24: jae 0x12b4c 0x12b26: inc cx |
| 2018-12-25T11:53:56.172731558Z | 48 | PC: 12b4f | Get DOS version |
{"DateBased":true,"Day":1,"Month":4,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":5179,"SideJobID":0}
.
GIF
Syscalls:
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-25T11:53:57.069706641Z | 42 | PC: 12afa | Get date 0x12afa: cmp dh, 4 0x12afd: jne 0x12b2c 0x12aff: xor dx, dx 0x12b01: mov ah, 0x19 0x12b03: int 0x21 0x12b05: xor bx, bx 0x12b07: mov ds, bx 0x12b09: mov cx, 0x77 0x12b0c: int 0x26 0x12b0e: jb 0x12b1a 0x12b10: pop di 0x12b11: add dx, 0x78 0x12b14: cmp dx, 0x2d0 0x12b18: jne 0x12b09 0x12b1a: ljmp 0xf000:0xfff0 0x12b1f: add ax, word ptr [bp + di + 0x68] 0x12b22: popaw 0x12b23: outsw dx, word ptr [si] 0x12b24: jae 0x12b4c 0x12b26: inc cx |
| 2018-12-25T11:53:57.072679717Z | 25 | PC: 12b05 | Get default drive |
| 2018-12-25T11:53:59.250079778Z | 72 | PC: 8f1b9 | Allocate memory |
| 2018-12-25T11:53:59.25196691Z | 72 | PC: 8f1bd | Allocate memory |
| 2018-12-25T11:53:59.255056879Z | 99 | PC: 90858 | Get DBCS lead byte table pointer |
| 2018-12-25T11:53:59.258734964Z | 61 | PC: 91f88 | Open file (Filename = 'C:\WINDOWS\HIMEM.SYS') |
| 2018-12-25T11:53:59.271246341Z | 66 | PC: 91f95 | Move file pointer |
| 2018-12-25T11:53:59.273077409Z | 62 | PC: 91fc1 | Close file |
| 2018-12-25T11:53:59.276557394Z | 75 | PC: 91fe0 | Execute program |
| 2018-12-25T11:53:59.297632124Z | 98 | PC: 916f1 | Get current PSP |
| 2018-12-25T11:53:59.299189882Z | 9 | PC: c605 | Display string (String= ' 6� � r�&;] u') |
| 2018-12-25T11:53:59.31451974Z | 48 | PC: c609 | Get DOS version |
| 2018-12-25T11:53:59.318731484Z | 9 | PC: c382 | Display string (String= ' Installed A20 handler number ') |
| 2018-12-25T11:53:59.322438503Z | 2 | PC: c38c | Character output (Char = '32') |
| 2018-12-25T11:53:59.326058825Z | 2 | PC: c3a7 | Character output (Char = '2e') |
| 2018-12-25T11:53:59.330297933Z | 9 | PC: c6d9 | Display string (String= '���� �VH�VD���V@������� �� ���� �_���Ku��t1��� ���� �D�����t �� ��������a 1��Z � �� � �W���� ����� �5 � ��|�����(���������Nj�(������� �p�^') |
| 2018-12-25T11:53:59.334774289Z | 9 | PC: c6e0 | Display string (String= ' �5 � ��|�����(���������Nj�(������� �p�^') |
| 2018-12-25T11:53:59.341270163Z | 61 | PC: 91f88 | Open file (See above) |
| 2018-12-25T11:53:59.353249027Z | 66 | PC: 91f95 | Move file pointer (See above) |
| 2018-12-25T11:53:59.355081099Z | 62 | PC: 91fc1 | Close file (See above) |
| 2018-12-25T11:53:59.357862815Z | 75 | PC: 91fe0 | Execute program (See above) |
| 2018-12-25T11:53:59.381450032Z | 98 | PC: 916f1 | Get current PSP (See above) |
| 2018-12-25T11:53:59.38659586Z | 82 | PC: 13d46 | Get DOS internal pointers (SYSVARS) |
| 2018-12-25T11:53:59.388489541Z | 53 | PC: 13ac3 | Get interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:53:59.391183381Z | 37 | PC: 13ad6 | Set interrupt vector (Interrupt = '19' AKA 'Delete file') |
| 2018-12-25T11:53:59.392455549Z | 53 | PC: 13ae0 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address') |
| 2018-12-25T11:53:59.394037946Z | 37 | PC: 13af3 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address') |
| 2018-12-25T11:53:59.396891659Z | 9 | PC: 13a0d | Display string (Could not find end pointer) |
| 2018-12-25T11:53:59.405643985Z | 62 | PC: 8f8eb | Close file |
| 2018-12-25T11:53:59.408014219Z | 62 | PC: 8f8f2 | Close file |
| 2018-12-25T11:53:59.411179071Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.412871444Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.414560808Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.416976733Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.420077148Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.421781918Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.423975905Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.426187218Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.427887282Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.429605208Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.432522277Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.434299444Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.436065608Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.438535568Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.440159746Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.442552085Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.445710706Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.447921374Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.449380549Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.451231745Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.452812431Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.454251619Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.455567972Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.469367671Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.471342906Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.472996022Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.476264363Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.478275544Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.48030305Z | 62 | PC: 8f8f2 | Close file (See above) |
| 2018-12-25T11:53:59.483210971Z | 61 | PC: 8f8ff | Open file (Filename = '') |
| 2018-12-25T11:53:59.489330379Z | 62 | PC: 8f90e | Close file |
| 2018-12-25T11:53:59.491232428Z | 69 | PC: 8f915 | Duplicate handle |
| 2018-12-25T11:53:59.49329792Z | 69 | PC: 8f919 | Duplicate handle |
| 2018-12-25T11:53:59.495117765Z | 61 | PC: 9387b | Open file (Filename = '') |
| 2018-12-25T11:53:59.501552195Z | 68 | PC: 9386b | I/O control for devices (Set for = '') |
| 2018-12-25T11:53:59.503476632Z | 61 | PC: 9387b | Open file (See above) |
| 2018-12-25T11:53:59.509392505Z | 68 | PC: 9386b | I/O control for devices (See above) |
| 2018-12-25T11:53:59.511176894Z | 74 | PC: 8f9c4 | Reallocate memory |
| 2018-12-25T11:53:59.512950403Z | 72 | PC: 8f9e0 | Allocate memory |
| 2018-12-25T11:53:59.515360722Z | 72 | PC: 8f9e4 | Allocate memory |
| 2018-12-25T11:53:59.517027927Z | 74 | PC: 8f9fb | Reallocate memory |
| 2018-12-25T11:53:59.518644717Z | 72 | PC: 8fa02 | Allocate memory |
| 2018-12-25T11:53:59.521725375Z | 72 | PC: 8fa06 | Allocate memory |
| 2018-12-25T11:53:59.523752238Z | 73 | PC: 8fa11 | Release memory |
| 2018-12-25T11:53:59.525717107Z | 73 | PC: 8efea | Release memory |
| 2018-12-25T11:53:59.528188445Z | 74 | PC: 8f003 | Reallocate memory |
| 2018-12-25T11:53:59.530419301Z | 72 | PC: 8f054 | Allocate memory |
| 2018-12-25T11:53:59.532711856Z | 72 | PC: 8f058 | Allocate memory |
| 2018-12-25T11:53:59.535405741Z | 73 | PC: 8f060 | Release memory |
| 2018-12-25T11:53:59.537220554Z | 61 | PC: 8f080 | Open file (Filename = '') |
| 2018-12-25T11:53:59.548230445Z | 63 | PC: 8f095 | Read file or device (Read 4 bytes on handle 5) |
| 2018-12-25T11:53:59.555437607Z | 66 | PC: 8f0ad | Move file pointer |
| 2018-12-25T11:53:59.557183136Z | 62 | PC: 8f0d1 | Close file |
| 2018-12-25T11:53:59.55931575Z | 75 | PC: 8f0f2 | Execute program |
| 2018-12-25T11:53:59.585463737Z | 80 | PC: 12be9 | Set current PSP |
| 2018-12-25T11:53:59.588007516Z | 48 | PC: 12bee | Get DOS version |
| 2018-12-25T11:53:59.590238218Z | 99 | PC: 193d0 | Get DBCS lead byte table pointer |
| 2018-12-25T11:53:59.593316692Z | 101 | PC: 12c74 | Get extended country info |
| 2018-12-25T11:53:59.596407748Z | 99 | PC: 12c7a | Get DBCS lead byte table pointer |
| 2018-12-25T11:53:59.598839787Z | 74 | PC: 12cdc | Reallocate memory |
| 2018-12-25T11:53:59.60089593Z | 72 | PC: 1355d | Allocate memory |
| 2018-12-25T11:53:59.603959708Z | 25 | PC: 13596 | Get default drive |
| 2018-12-25T11:53:59.606228222Z | 71 | PC: 135ad | Get current directory |
| 2018-12-25T11:53:59.609449915Z | 59 | PC: 135ba | Change current directory |
| 2018-12-25T11:53:59.617968142Z | 59 | PC: 135c8 | Change current directory |
| 2018-12-25T11:53:59.625369592Z | 59 | PC: 135d3 | Change current directory |
| 2018-12-25T11:53:59.629943127Z | 25 | PC: 12d13 | Get default drive |
| 2018-12-25T11:53:59.631909642Z | 37 | PC: 127d3 | Set interrupt vector (Interrupt = '34' AKA 'Random write') |
| 2018-12-25T11:53:59.634613164Z | 37 | PC: 127da | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records') |
| 2018-12-25T11:53:59.636249657Z | 37 | PC: 127e1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-25T11:53:59.638749703Z | 80 | PC: 1301d | Set current PSP |
| 2018-12-25T11:53:59.641133209Z | 37 | PC: 13041 | Set interrupt vector (Interrupt = '46' AKA 'Set verify flag') |
| 2018-12-25T11:53:59.642597589Z | 53 | PC: 13362 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address') |
| 2018-12-25T11:53:59.643961115Z | 37 | PC: 13383 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address') |
| 2018-12-25T11:53:59.646400474Z | 51 | PC: 13417 | Get or set Ctrl-Break |
| 2018-12-25T11:53:59.648855848Z | 72 | PC: 130ec | Allocate memory |
| 2018-12-25T11:53:59.651256494Z | 61 | PC: 131b2 | Open file (Filename = '') |
| 2018-12-25T11:53:59.659208033Z | 62 | PC: 131ba | Close file |
| 2018-12-25T11:53:59.661940115Z | 51 | PC: 1344c | Get or set Ctrl-Break |
| 2018-12-25T11:53:59.663602692Z | 74 | PC: 1197c | Reallocate memory |
| 2018-12-25T11:53:59.665947878Z | 72 | PC: 11991 | Allocate memory |
| 2018-12-25T11:53:59.667834162Z | 73 | PC: 119b2 | Release memory |
| 2018-12-25T11:53:59.669939634Z | 72 | PC: 119bd | Allocate memory |
| 2018-12-25T11:53:59.672742262Z | 73 | PC: 119df | Release memory |
| 2018-12-25T11:53:59.674768145Z | 72 | PC: 119f5 | Allocate memory |
| 2018-12-25T11:53:59.676749519Z | 72 | PC: 119fd | Allocate memory |