Sample viewer

vx.netlux.org/Virus.DOS.Gkchp.800.b

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:00:42.103155873Z 42 PC: 13444 | Get date 0x13444: cmp dx, 0x813
0x13448: jl 0x1344c
0x1344a: int 0x19
0x1344c: mov ax, 0x3524
0x1344f: int 0x21
0x13451: push es
0x13452: push bx
0x13453: mov dx, 0x3d8
0x13456: mov ax, 0x2524
0x13459: int 0x21
0x1345b: mov ah, 0x2f
0x1345d: int 0x21
0x1345f: push es
0x13460: push bx
0x13461: mov dx, 0x973
0x13464: mov ah, 0x1a
0x13466: int 0x21
0x13468: mov ah, 0x19
0x1346a: int 0x21
0x1346c: push ax
2018-12-17T22:00:44.163182659Z 72 PC: 8f1b9 | Allocate memory
2018-12-17T22:00:44.165310595Z 72 PC: 8f1bd | Allocate memory
2018-12-17T22:00:44.167924816Z 99 PC: 90858 | Get DBCS lead byte table pointer
2018-12-17T22:00:44.171433258Z 61 PC: 91f88 | Open file (Filename = 'C:\WINDOWS\HIMEM.SYS')
2018-12-17T22:00:44.182407593Z 66 PC: 91f95 | Move file pointer
2018-12-17T22:00:44.183803174Z 62 PC: 91fc1 | Close file
2018-12-17T22:00:44.185788032Z 75 PC: 91fe0 | Execute program
2018-12-17T22:00:44.202190652Z 98 PC: 916f1 | Get current PSP
2018-12-17T22:00:44.20371431Z 9 PC: c605 | Display string (String= '6r&;] u')
2018-12-17T22:00:44.213100141Z 48 PC: c609 | Get DOS version
2018-12-17T22:00:44.216982553Z 9 PC: c382 | Display string (String= ' Installed A20 handler number ')
2018-12-17T22:00:44.220976446Z 2 PC: c38c | Character output (Char = '32')
2018-12-17T22:00:44.223112537Z 2 PC: c3a7 | Character output (Char = '2e')
2018-12-17T22:00:44.227692916Z 9 PC: c6d9 | Display string (String= 'VHVD[email protected]_Kut1Dt a1ZW 5|(Nj(p^')
2018-12-17T22:00:44.233245892Z 9 PC: c6e0 | Display string (String= '5|(Nj(p^')
2018-12-17T22:00:44.244365461Z 61 PC: 91f88 | Open file (Filename = 'C:\WINDOWS\SMARTDRV.EXE')
2018-12-17T22:00:44.254949816Z 66 PC: 91f95 | Move file pointer
2018-12-17T22:00:44.256551728Z 62 PC: 91fc1 | Close file
2018-12-17T22:00:44.258514844Z 75 PC: 91fe0 | Execute program
2018-12-17T22:00:44.282780684Z 98 PC: 916f1 | Get current PSP
2018-12-17T22:00:44.287410364Z 82 PC: 13d46 | Get DOS internal pointers (SYSVARS)
2018-12-17T22:00:44.290139355Z 53 PC: 13ac3 | Get interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-17T22:00:44.29164804Z 37 PC: 13ad6 | Set interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-17T22:00:44.293385467Z 53 PC: 13ae0 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-17T22:00:44.294961865Z 37 PC: 13af3 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-17T22:00:44.296899291Z 9 PC: 13a0d | Display string (Could not find end pointer)
2018-12-17T22:00:44.307462351Z 62 PC: 8f8eb | Close file
2018-12-17T22:00:44.309933515Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.311841733Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.313627563Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.316258943Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.317876541Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.319578667Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.321842777Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.323305292Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.324703603Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.326849474Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.328547789Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.330352683Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.332517854Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.333852895Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.335741224Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.337413277Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.338908478Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.340499618Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.342269946Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.343675674Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.344937936Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.346385465Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.347936308Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.349204023Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.350685759Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.353118893Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.354428661Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.356014107Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.357745303Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.359040005Z 62 PC: 8f8f2 | Close file
2018-12-17T22:00:44.360618464Z 61 PC: 8f8ff | Open file (Filename = '')
2018-12-17T22:00:44.365340581Z 62 PC: 8f90e | Close file
2018-12-17T22:00:44.367146888Z 69 PC: 8f915 | Duplicate handle
2018-12-17T22:00:44.369532448Z 69 PC: 8f919 | Duplicate handle
2018-12-17T22:00:44.371389737Z 61 PC: 9387b | Open file (Filename = '')
2018-12-17T22:00:44.375813648Z 68 PC: 9386b | I/O control for devices (Set for = '')
2018-12-17T22:00:44.377247202Z 61 PC: 9387b | Open file (Filename = '')
2018-12-17T22:00:44.382067979Z 68 PC: 9386b | I/O control for devices (Set for = '')
2018-12-17T22:00:44.383579108Z 74 PC: 8f9c4 | Reallocate memory
2018-12-17T22:00:44.385718694Z 72 PC: 8f9e0 | Allocate memory
2018-12-17T22:00:44.387548716Z 72 PC: 8f9e4 | Allocate memory
2018-12-17T22:00:44.389076874Z 74 PC: 8f9fb | Reallocate memory
2018-12-17T22:00:44.390512133Z 72 PC: 8fa02 | Allocate memory
2018-12-17T22:00:44.392405433Z 72 PC: 8fa06 | Allocate memory
2018-12-17T22:00:44.393796087Z 73 PC: 8fa11 | Release memory
2018-12-17T22:00:44.395067324Z 73 PC: 8efea | Release memory
2018-12-17T22:00:44.399190155Z 74 PC: 8f003 | Reallocate memory
2018-12-17T22:00:44.400577155Z 72 PC: 8f054 | Allocate memory
2018-12-17T22:00:44.402131013Z 72 PC: 8f058 | Allocate memory
2018-12-17T22:00:44.403777108Z 73 PC: 8f060 | Release memory
2018-12-17T22:00:44.405397013Z 61 PC: 8f080 | Open file (Filename = 'r,S[
2018-12-17T22:00:44.414281952Z 63 PC: 8f095 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:00:44.432788759Z 66 PC: 8f0ad | Move file pointer
2018-12-17T22:00:44.434369047Z 62 PC: 8f0d1 | Close file
2018-12-17T22:00:44.436810779Z 75 PC: 8f0f2 | Execute program
2018-12-17T22:00:44.460658155Z 80 PC: 12be9 | Set current PSP
2018-12-17T22:00:44.461782304Z 48 PC: 12bee | Get DOS version
2018-12-17T22:00:44.463206775Z 99 PC: 193d0 | Get DBCS lead byte table pointer
2018-12-17T22:00:44.466537515Z 101 PC: 12c74 | Get extended country info
2018-12-17T22:00:44.467936301Z 99 PC: 12c7a | Get DBCS lead byte table pointer
2018-12-17T22:00:44.469149419Z 74 PC: 12cdc | Reallocate memory
2018-12-17T22:00:44.471388918Z 72 PC: 1355d | Allocate memory
2018-12-17T22:00:44.473009538Z 25 PC: 13596 | Get default drive
2018-12-17T22:00:44.474144067Z 71 PC: 135ad | Get current directory
2018-12-17T22:00:44.477281492Z 59 PC: 135ba | Change current directory
2018-12-17T22:00:44.482734428Z 59 PC: 135c8 | Change current directory
2018-12-17T22:00:44.488637359Z 59 PC: 135d3 | Change current directory
2018-12-17T22:00:44.493365476Z 25 PC: 12d13 | Get default drive
2018-12-17T22:00:44.494681463Z 37 PC: 127d3 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-17T22:00:44.49580768Z 37 PC: 127da | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:00:44.497453183Z 37 PC: 127e1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:00:44.499606328Z 80 PC: 1301d | Set current PSP
2018-12-17T22:00:44.500320561Z 37 PC: 13041 | Set interrupt vector (Interrupt = '46' AKA 'Set verify flag')
2018-12-17T22:00:44.502207357Z 53 PC: 13362 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-17T22:00:44.503319038Z 37 PC: 13383 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-17T22:00:44.504328219Z 51 PC: 13417 | Get or set Ctrl-Break
2018-12-17T22:00:44.506634406Z 72 PC: 130ec | Allocate memory
2018-12-17T22:00:44.508419056Z 61 PC: 131b2 | Open file (Filename = '')
2018-12-17T22:00:44.514904368Z 62 PC: 131ba | Close file
2018-12-17T22:00:44.517450636Z 51 PC: 1344c | Get or set Ctrl-Break
2018-12-17T22:00:44.518758706Z 74 PC: 1197c | Reallocate memory
2018-12-17T22:00:44.520334208Z 72 PC: 11991 | Allocate memory
2018-12-17T22:00:44.523070453Z 73 PC: 119b2 | Release memory
2018-12-17T22:00:44.524301075Z 72 PC: 119bd | Allocate memory
2018-12-17T22:00:44.525844734Z 73 PC: 119df | Release memory
2018-12-17T22:00:44.527615729Z 72 PC: 119f5 | Allocate memory
2018-12-17T22:00:44.52926716Z 72 PC: 119fd | Allocate memory

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":1191,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:42:59.441734099Z 42 PC: 13444 | Get date 0x13444: cmp dx, 0x813
0x13448: jl 0x1344c
0x1344a: int 0x19
0x1344c: mov ax, 0x3524
0x1344f: int 0x21
0x13451: push es
0x13452: push bx
0x13453: mov dx, 0x3d8
0x13456: mov ax, 0x2524
0x13459: int 0x21
0x1345b: mov ah, 0x2f
0x1345d: int 0x21
0x1345f: push es
0x13460: push bx
0x13461: mov dx, 0x973
0x13464: mov ah, 0x1a
0x13466: int 0x21
0x13468: mov ah, 0x19
0x1346a: int 0x21
0x1346c: push ax
2018-12-25T11:42:59.446456042Z 53 PC: 13451 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:42:59.447617773Z 37 PC: 1345b | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:42:59.44919206Z 47 PC: 1345f | Get disk transfer address
2018-12-25T11:42:59.454331763Z 26 PC: 13468 | Set disk transfer address
2018-12-25T11:42:59.455388671Z 25 PC: 1346c | Get default drive
2018-12-25T11:42:59.456369269Z 71 PC: 13476 | Get current directory
2018-12-25T11:43:01.174114025Z 14 PC: 134b4 | Set default drive (Drive = 'C')
2018-12-25T11:43:01.17578835Z 59 PC: 136b9 | Change current directory
2018-12-25T11:43:01.179205714Z 78 PC: 134da | Find first file
2018-12-25T11:43:01.184614412Z 79 PC: 134da | Find next file (See above)
2018-12-25T11:43:01.187468475Z 78 PC: 134da | Find first file (See above)
2018-12-25T11:43:01.192764393Z 78 PC: 1366b | Find first file
2018-12-25T11:43:01.19812872Z 79 PC: 1366b | Find next file (See above)
2018-12-25T11:43:01.206817868Z 79 PC: 1366b | Find next file (See above)
2018-12-25T11:43:01.209460073Z 59 PC: 136b9 | Change current directory (See above)
2018-12-25T11:43:01.218224313Z 78 PC: 134da | Find first file (See above)
2018-12-25T11:43:01.23030269Z 67 PC: 13534 | Get or set file attributes
2018-12-25T11:43:01.240315095Z 61 PC: 13539 | Open file (Filename = 'WIN.COM')
2018-12-25T11:43:01.253960304Z 63 PC: 13544 | Read file or device (Read 24 bytes on handle 5)
2018-12-25T11:43:01.278425987Z 66 PC: 1354d | Move file pointer
2018-12-25T11:43:01.27996889Z 64 PC: 13601 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:43:01.283497661Z 66 PC: 13608 | Move file pointer
2018-12-25T11:43:01.286362289Z 64 PC: 13625 | Write file or device (Write 800 bytes on handle 5)
2018-12-25T11:43:01.294050675Z 87 PC: 13632 | Get or set file date and time
2018-12-25T11:43:01.295843152Z 62 PC: 13636 | Close file
2018-12-25T11:43:01.303200733Z 67 PC: 13644 | Get or set file attributes
2018-12-25T11:43:01.3126573Z 14 PC: 136d0 | Set default drive (Drive = 'A')
2018-12-25T11:43:01.314173197Z 59 PC: 136dd | Change current directory
2018-12-25T11:43:01.319091193Z 59 PC: 136e4 | Change current directory
2018-12-25T11:43:01.321155833Z 26 PC: 136ea | Set disk transfer address
2018-12-25T11:43:01.322535045Z 37 PC: 136f1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:43:01.324961896Z 9 PC: 133f2 | Display string (Could not find end pointer)
2018-12-25T11:43:01.330728307Z 76 PC: 133f8 | Terminate with return code (Return code = '0')

{"DateBased":true,"Day":19,"Month":8,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":1191,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:42:59.711706014Z 42 PC: 13444 | Get date 0x13444: cmp dx, 0x813
0x13448: jl 0x1344c
0x1344a: int 0x19
0x1344c: mov ax, 0x3524
0x1344f: int 0x21
0x13451: push es
0x13452: push bx
0x13453: mov dx, 0x3d8
0x13456: mov ax, 0x2524
0x13459: int 0x21
0x1345b: mov ah, 0x2f
0x1345d: int 0x21
0x1345f: push es
0x13460: push bx
0x13461: mov dx, 0x973
0x13464: mov ah, 0x1a
0x13466: int 0x21
0x13468: mov ah, 0x19
0x1346a: int 0x21
0x1346c: push ax
2018-12-25T11:43:01.805175084Z 72 PC: 8f1b9 | Allocate memory
2018-12-25T11:43:01.807138924Z 72 PC: 8f1bd | Allocate memory
2018-12-25T11:43:01.809987217Z 99 PC: 90858 | Get DBCS lead byte table pointer
2018-12-25T11:43:01.81402876Z 61 PC: 91f88 | Open file (Filename = 'C:\WINDOWS\HIMEM.SYS')
2018-12-25T11:43:01.826227777Z 66 PC: 91f95 | Move file pointer
2018-12-25T11:43:01.827853299Z 62 PC: 91fc1 | Close file
2018-12-25T11:43:01.830090565Z 75 PC: 91fe0 | Execute program
2018-12-25T11:43:01.848356192Z 98 PC: 916f1 | Get current PSP
2018-12-25T11:43:01.849910066Z 9 PC: c605 | Display string (String= '6r&;] u')
2018-12-25T11:43:01.860964683Z 48 PC: c609 | Get DOS version
2018-12-25T11:43:01.866490485Z 9 PC: c382 | Display string (String= ' Installed A20 handler number ')
2018-12-25T11:43:01.871206067Z 2 PC: c38c | Character output (Char = '32')
2018-12-25T11:43:01.873544737Z 2 PC: c3a7 | Character output (Char = '2e')
2018-12-25T11:43:01.878017134Z 9 PC: c6d9 | Display string (String= 'VHVD[email protected]_Kut1Dt a1ZW 5|(Nj(p^')
2018-12-25T11:43:01.88418813Z 9 PC: c6e0 | Display string (String= '5|(Nj(p^')
2018-12-25T11:43:01.893981366Z 61 PC: 91f88 | Open file (See above)
2018-12-25T11:43:01.906626095Z 66 PC: 91f95 | Move file pointer (See above)
2018-12-25T11:43:01.908816729Z 62 PC: 91fc1 | Close file (See above)
2018-12-25T11:43:01.911206907Z 75 PC: 91fe0 | Execute program (See above)
2018-12-25T11:43:01.937221708Z 98 PC: 916f1 | Get current PSP (See above)
2018-12-25T11:43:01.941670545Z 82 PC: 13d46 | Get DOS internal pointers (SYSVARS)
2018-12-25T11:43:01.943292312Z 53 PC: 13ac3 | Get interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-25T11:43:01.946081447Z 37 PC: 13ad6 | Set interrupt vector (Interrupt = '19' AKA 'Delete file')
2018-12-25T11:43:01.947519158Z 53 PC: 13ae0 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T11:43:01.948915644Z 37 PC: 13af3 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T11:43:01.950222644Z 9 PC: 13a0d | Display string (Could not find end pointer)
2018-12-25T11:43:01.962742021Z 62 PC: 8f8eb | Close file
2018-12-25T11:43:01.964616817Z 62 PC: 8f8f2 | Close file
2018-12-25T11:43:01.966455384Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:01.969126754Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:01.971122016Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:01.973089332Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:01.975513169Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:01.977421174Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:01.979475599Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:01.98256908Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:01.984615044Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:01.986644509Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:01.98973291Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:01.991875131Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:01.993904057Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:01.995935751Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:01.997722897Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:01.999203506Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:02.000941633Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:02.00312395Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:02.004756477Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:02.007172278Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:02.009870495Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:02.011487733Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:02.013141373Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:02.015336393Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:02.016987256Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:02.01904169Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:02.021469539Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:02.023085839Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:02.024701094Z 62 PC: 8f8f2 | Close file (See above)
2018-12-25T11:43:02.027291663Z 61 PC: 8f8ff | Open file (Filename = '')
2018-12-25T11:43:02.034222308Z 62 PC: 8f90e | Close file
2018-12-25T11:43:02.038049182Z 69 PC: 8f915 | Duplicate handle
2018-12-25T11:43:02.040906917Z 69 PC: 8f919 | Duplicate handle
2018-12-25T11:43:02.043276559Z 61 PC: 9387b | Open file (Filename = '')
2018-12-25T11:43:02.048769092Z 68 PC: 9386b | I/O control for devices (Set for = '')
2018-12-25T11:43:02.050539756Z 61 PC: 9387b | Open file (See above)
2018-12-25T11:43:02.055962525Z 68 PC: 9386b | I/O control for devices (See above)
2018-12-25T11:43:02.058029713Z 74 PC: 8f9c4 | Reallocate memory
2018-12-25T11:43:02.060131166Z 72 PC: 8f9e0 | Allocate memory
2018-12-25T11:43:02.06256259Z 72 PC: 8f9e4 | Allocate memory
2018-12-25T11:43:02.064341851Z 74 PC: 8f9fb | Reallocate memory
2018-12-25T11:43:02.06601079Z 72 PC: 8fa02 | Allocate memory
2018-12-25T11:43:02.076773612Z 72 PC: 8fa06 | Allocate memory
2018-12-25T11:43:02.084182214Z 73 PC: 8fa11 | Release memory
2018-12-25T11:43:02.085939112Z 73 PC: 8efea | Release memory
2018-12-25T11:43:02.088120812Z 74 PC: 8f003 | Reallocate memory
2018-12-25T11:43:02.090284027Z 72 PC: 8f054 | Allocate memory
2018-12-25T11:43:02.092608139Z 72 PC: 8f058 | Allocate memory
2018-12-25T11:43:02.094570102Z 73 PC: 8f060 | Release memory
2018-12-25T11:43:02.096294089Z 61 PC: 8f080 | Open file (Filename = 'r,S[
2018-12-25T11:43:02.107874319Z 63 PC: 8f095 | Read file or device (Read 4 bytes on handle 5)
2018-12-25T11:43:02.115139288Z 66 PC: 8f0ad | Move file pointer
2018-12-25T11:43:02.117088919Z 62 PC: 8f0d1 | Close file
2018-12-25T11:43:02.119219586Z 75 PC: 8f0f2 | Execute program
2018-12-25T11:43:02.143954636Z 80 PC: 12be9 | Set current PSP
2018-12-25T11:43:02.145164479Z 48 PC: 12bee | Get DOS version
2018-12-25T11:43:02.147000352Z 99 PC: 193d0 | Get DBCS lead byte table pointer
2018-12-25T11:43:02.150087014Z 101 PC: 12c74 | Get extended country info
2018-12-25T11:43:02.1526761Z 99 PC: 12c7a | Get DBCS lead byte table pointer
2018-12-25T11:43:02.154459576Z 74 PC: 12cdc | Reallocate memory
2018-12-25T11:43:02.156084217Z 72 PC: 1355d | Allocate memory
2018-12-25T11:43:02.158553346Z 25 PC: 13596 | Get default drive
2018-12-25T11:43:02.15975541Z 71 PC: 135ad | Get current directory
2018-12-25T11:43:02.162472393Z 59 PC: 135ba | Change current directory
2018-12-25T11:43:02.169563181Z 59 PC: 135c8 | Change current directory
2018-12-25T11:43:02.17664885Z 59 PC: 135d3 | Change current directory
2018-12-25T11:43:02.180532361Z 25 PC: 12d13 | Get default drive
2018-12-25T11:43:02.182354438Z 37 PC: 127d3 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-25T11:43:02.183637506Z 37 PC: 127da | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-25T11:43:02.184871117Z 37 PC: 127e1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:43:02.188476516Z 80 PC: 1301d | Set current PSP
2018-12-25T11:43:02.1894038Z 37 PC: 13041 | Set interrupt vector (Interrupt = '46' AKA 'Set verify flag')
2018-12-25T11:43:02.190745341Z 53 PC: 13362 | Get interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T11:43:02.192030581Z 37 PC: 13383 | Set interrupt vector (Interrupt = '47' AKA 'Get disk transfer address')
2018-12-25T11:43:02.193848705Z 51 PC: 13417 | Get or set Ctrl-Break
2018-12-25T11:43:02.195991378Z 72 PC: 130ec | Allocate memory
2018-12-25T11:43:02.197893578Z 61 PC: 131b2 | Open file (Filename = '')
2018-12-25T11:43:02.205049304Z 62 PC: 131ba | Close file
2018-12-25T11:43:02.207135584Z 51 PC: 1344c | Get or set Ctrl-Break
2018-12-25T11:43:02.208204444Z 74 PC: 1197c | Reallocate memory
2018-12-25T11:43:02.215970693Z 72 PC: 11991 | Allocate memory
2018-12-25T11:43:02.217899079Z 73 PC: 119b2 | Release memory
2018-12-25T11:43:02.219221819Z 72 PC: 119bd | Allocate memory
2018-12-25T11:43:02.221575005Z 73 PC: 119df | Release memory
2018-12-25T11:43:02.2233116Z 72 PC: 119f5 | Allocate memory
2018-12-25T11:43:02.22527515Z 72 PC: 119fd | Allocate memory