Sample viewer

vx.netlux.org/Trojan.DOS.KillFiles.r

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:19:18.916346077Z 53 PC: 1328a | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:19:18.918098231Z 53 PC: 1328a | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:19:18.919213639Z 53 PC: 1328a | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:19:18.920337529Z 53 PC: 1328a | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:19:18.922592418Z 53 PC: 1328a | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:19:18.92380474Z 53 PC: 1328a | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:19:18.92540393Z 53 PC: 1328a | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:19:18.927626139Z 53 PC: 1328a | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:19:18.928782908Z 53 PC: 1328a | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:19:18.929851841Z 53 PC: 1328a | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:19:18.931498064Z 53 PC: 1328a | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:19:18.933152357Z 53 PC: 1328a | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:19:18.93474368Z 53 PC: 1328a | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:19:18.936609347Z 53 PC: 1328a | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:19:18.9390088Z 53 PC: 1328a | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:19:18.940787389Z 53 PC: 1328a | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:19:18.94248272Z 53 PC: 1328a | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:19:18.945153306Z 53 PC: 1328a | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:19:18.946693465Z 53 PC: 1328a | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:19:18.949555404Z 37 PC: 1329f | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:19:18.952367443Z 37 PC: 132a7 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:19:18.953818552Z 37 PC: 132af | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:19:18.955278873Z 37 PC: 132b7 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:19:18.963838823Z 68 PC: 13c47 | I/O control for devices (Set for = '�[��')
2018-12-17T22:19:19.020567058Z 37 PC: 12bf1 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:19:19.022225222Z 14 PC: 1396d | Set default drive (Drive = 'C')
2018-12-17T22:19:19.024204459Z 25 PC: 13971 | Get default drive
2018-12-17T22:19:19.025331454Z 59 PC: 139db | Change current directory
2018-12-17T22:19:19.034285931Z 26 PC: 131d7 | Set disk transfer address
2018-12-17T22:19:19.036261574Z 78 PC: 131e3 | Find first file
2018-12-17T22:19:19.044841287Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:19.388362582Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:19.40177883Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.403586398Z 61 PC: 1374d | Open file (Filename = 'SETUP.EXE')
2018-12-17T22:19:19.411002203Z 65 PC: 13896 | Delete file (Filename = 'SETUP.EXE')
2018-12-17T22:19:19.424556797Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.426652989Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:19.427943867Z 79 PC: 13200 | Find next file
2018-12-17T22:19:19.432279495Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:19.441763146Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:19.454915894Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.457025445Z 61 PC: 1374d | Open file (Filename = 'WINHELP.EXE')
2018-12-17T22:19:19.464655345Z 65 PC: 13896 | Delete file (Filename = 'WINHELP.EXE')
2018-12-17T22:19:19.474324752Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.476400251Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:19.478269888Z 79 PC: 13200 | Find next file
2018-12-17T22:19:19.482955352Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:19.492934855Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:19.506209048Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.508243245Z 61 PC: 1374d | Open file (Filename = 'MSD.EXE')
2018-12-17T22:19:19.515594065Z 65 PC: 13896 | Delete file (Filename = 'MSD.EXE')
2018-12-17T22:19:19.525841306Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.527694939Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:19.528759691Z 79 PC: 13200 | Find next file
2018-12-17T22:19:19.532993968Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:19.542882063Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:19.554587081Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.557354249Z 61 PC: 1374d | Open file (Filename = 'PACKAGER.EXE')
2018-12-17T22:19:19.564011025Z 65 PC: 13896 | Delete file (Filename = 'PACKAGER.EXE')
2018-12-17T22:19:19.573979227Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.577273816Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:19.57858757Z 79 PC: 13200 | Find next file
2018-12-17T22:19:19.582936974Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:19.593256376Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:19.60577878Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.607648211Z 61 PC: 1374d | Open file (Filename = 'PBRUSH.EXE')
2018-12-17T22:19:19.615138789Z 65 PC: 13896 | Delete file (Filename = 'PBRUSH.EXE')
2018-12-17T22:19:19.625167608Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.627158879Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:19.628599258Z 79 PC: 13200 | Find next file
2018-12-17T22:19:19.632909571Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:19.642494636Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:19.655132583Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.658650602Z 61 PC: 1374d | Open file (Filename = 'SOL.EXE')
2018-12-17T22:19:19.665495058Z 65 PC: 13896 | Delete file (Filename = 'SOL.EXE')
2018-12-17T22:19:19.677047255Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.681212027Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:19.682871816Z 79 PC: 13200 | Find next file
2018-12-17T22:19:19.686975971Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:19.69755499Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:19.709367914Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.711087821Z 61 PC: 1374d | Open file (Filename = 'TERMINAL.EXE')
2018-12-17T22:19:19.71907886Z 65 PC: 13896 | Delete file (Filename = 'TERMINAL.EXE')
2018-12-17T22:19:19.72918825Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.731384792Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:19.733715227Z 79 PC: 13200 | Find next file
2018-12-17T22:19:19.736941211Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:19.746006582Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:19.759400186Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.761136902Z 61 PC: 1374d | Open file (Filename = 'WINFILE.EXE')
2018-12-17T22:19:19.767624153Z 65 PC: 13896 | Delete file (Filename = 'WINFILE.EXE')
2018-12-17T22:19:19.777971487Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.779696679Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:19.781315749Z 79 PC: 13200 | Find next file
2018-12-17T22:19:19.78518784Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:19.795224798Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:19.818009268Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.832055953Z 61 PC: 1374d | Open file (Filename = 'WINTUTOR.EXE')
2018-12-17T22:19:19.840026424Z 65 PC: 13896 | Delete file (Filename = 'WINTUTOR.EXE')
2018-12-17T22:19:19.851655967Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.855199575Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:19.856823098Z 79 PC: 13200 | Find next file
2018-12-17T22:19:19.860579428Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:19.871436882Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:19.884748634Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.886540868Z 61 PC: 1374d | Open file (Filename = 'WRITE.EXE')
2018-12-17T22:19:19.893168969Z 65 PC: 13896 | Delete file (Filename = 'WRITE.EXE')
2018-12-17T22:19:19.910772279Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.912668373Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:19.913765289Z 79 PC: 13200 | Find next file
2018-12-17T22:19:19.918123354Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:19.927513562Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:19.939836272Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.942824697Z 61 PC: 1374d | Open file (Filename = 'CALC.EXE')
2018-12-17T22:19:19.949787298Z 65 PC: 13896 | Delete file (Filename = 'CALC.EXE')
2018-12-17T22:19:19.959891956Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.962772798Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:19.964251817Z 79 PC: 13200 | Find next file
2018-12-17T22:19:19.967450283Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:19.978118589Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:19.991544477Z 62 PC: 1379d | Close file
2018-12-17T22:19:19.993969101Z 61 PC: 1374d | Open file (Filename = 'CALENDAR.EXE')
2018-12-17T22:19:20.001868835Z 65 PC: 13896 | Delete file (Filename = 'CALENDAR.EXE')
2018-12-17T22:19:20.012308124Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.014364195Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.016370735Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.019816943Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.029609534Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:20.043765422Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.046035605Z 61 PC: 1374d | Open file (Filename = 'CARDFILE.EXE')
2018-12-17T22:19:20.053208597Z 65 PC: 13896 | Delete file (Filename = 'CARDFILE.EXE')
2018-12-17T22:19:20.063372617Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.066055022Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.067363556Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.07176568Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.081334267Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:20.093102701Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.095330522Z 61 PC: 1374d | Open file (Filename = 'CHARMAP.EXE')
2018-12-17T22:19:20.10504467Z 65 PC: 13896 | Delete file (Filename = 'CHARMAP.EXE')
2018-12-17T22:19:20.115792982Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.11834008Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.120159331Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.123820677Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.133430877Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:20.157843808Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.16224474Z 61 PC: 1374d | Open file (Filename = 'CLIPBRD.EXE')
2018-12-17T22:19:20.169621451Z 65 PC: 13896 | Delete file (Filename = 'CLIPBRD.EXE')
2018-12-17T22:19:20.185914345Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.190107226Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.191932124Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.197271078Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.207313366Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:20.220079114Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.223183652Z 61 PC: 1374d | Open file (Filename = 'CONTROL.EXE')
2018-12-17T22:19:20.230600609Z 65 PC: 13896 | Delete file (Filename = 'CONTROL.EXE')
2018-12-17T22:19:20.239661344Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.242368139Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.243668064Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.246380759Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.253857886Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:20.273093931Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.274848631Z 61 PC: 1374d | Open file (Filename = 'DRWATSON.EXE')
2018-12-17T22:19:20.282587203Z 65 PC: 13896 | Delete file (Filename = 'DRWATSON.EXE')
2018-12-17T22:19:20.29215351Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.293919007Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.295626472Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.298855654Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.308879432Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:20.321286075Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.322997453Z 61 PC: 1374d | Open file (Filename = 'EMM386.EXE')
2018-12-17T22:19:20.329578862Z 65 PC: 13896 | Delete file (Filename = 'EMM386.EXE')
2018-12-17T22:19:20.340112321Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.341902619Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.342932979Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.347034478Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.356417427Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:20.368858096Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.371255566Z 61 PC: 1374d | Open file (Filename = 'EXPAND.EXE')
2018-12-17T22:19:20.377878153Z 65 PC: 13896 | Delete file (Filename = 'EXPAND.EXE')
2018-12-17T22:19:20.387584402Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.39013294Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.391450763Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.395003865Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.404750578Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:20.41696081Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.418753789Z 61 PC: 1374d | Open file (Filename = 'MPLAYER.EXE')
2018-12-17T22:19:20.425044851Z 65 PC: 13896 | Delete file (Filename = 'MPLAYER.EXE')
2018-12-17T22:19:20.435384049Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.437216026Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.439075746Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.442395641Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.451716266Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:20.463897708Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.465784205Z 61 PC: 1374d | Open file (Filename = 'NOTEPAD.EXE')
2018-12-17T22:19:20.472461884Z 65 PC: 13896 | Delete file (Filename = 'NOTEPAD.EXE')
2018-12-17T22:19:20.482427249Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.484462301Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.485707919Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.491283162Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.501741458Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:20.513547214Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.51573316Z 61 PC: 1374d | Open file (Filename = 'PIFEDIT.EXE')
2018-12-17T22:19:20.522487739Z 65 PC: 13896 | Delete file (Filename = 'PIFEDIT.EXE')
2018-12-17T22:19:20.533125085Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.535013474Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.535955213Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.540150493Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.549351163Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:20.562214929Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.564118882Z 61 PC: 1374d | Open file (Filename = 'PRINTMAN.EXE')
2018-12-17T22:19:20.571082852Z 65 PC: 13896 | Delete file (Filename = 'PRINTMAN.EXE')
2018-12-17T22:19:20.580488638Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.58338892Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.5847068Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.588192903Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.597816332Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:20.610426924Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.612485154Z 61 PC: 1374d | Open file (Filename = 'PROGMAN.EXE')
2018-12-17T22:19:20.619672662Z 65 PC: 13896 | Delete file (Filename = 'PROGMAN.EXE')
2018-12-17T22:19:20.630997443Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.632746588Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.634247796Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.637556405Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.646765517Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:20.659448469Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.661246704Z 61 PC: 1374d | Open file (Filename = 'RECORDER.EXE')
2018-12-17T22:19:20.66805238Z 65 PC: 13896 | Delete file (Filename = 'RECORDER.EXE')
2018-12-17T22:19:20.678612348Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.680483779Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.681502675Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.686284421Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.701463783Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:20.713411911Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.715922767Z 61 PC: 1374d | Open file (Filename = 'REGEDIT.EXE')
2018-12-17T22:19:20.722704756Z 65 PC: 13896 | Delete file (Filename = 'REGEDIT.EXE')
2018-12-17T22:19:20.732661495Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.735774725Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.736918914Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.740162404Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.750499805Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:20.763036024Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.764734266Z 61 PC: 1374d | Open file (Filename = 'SMARTDRV.EXE')
2018-12-17T22:19:20.772464Z 65 PC: 13896 | Delete file (Filename = 'SMARTDRV.EXE')
2018-12-17T22:19:20.782342741Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.784484837Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.786994418Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.790604425Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.800221485Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:20.813253273Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.815345843Z 61 PC: 1374d | Open file (Filename = 'SOUNDREC.EXE')
2018-12-17T22:19:20.82233159Z 65 PC: 13896 | Delete file (Filename = 'SOUNDREC.EXE')
2018-12-17T22:19:20.833881235Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.836014138Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.837395029Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.842040543Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.85159597Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:20.863382994Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.865697488Z 61 PC: 1374d | Open file (Filename = 'WINMINE.EXE')
2018-12-17T22:19:20.872238268Z 65 PC: 13896 | Delete file (Filename = 'WINMINE.EXE')
2018-12-17T22:19:20.882020796Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.884475532Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.885787002Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.890183963Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.900155795Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:20.912503006Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.9147502Z 61 PC: 1374d | Open file (Filename = 'CLOCK.EXE')
2018-12-17T22:19:20.922998912Z 65 PC: 13896 | Delete file (Filename = 'CLOCK.EXE')
2018-12-17T22:19:20.931623356Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.93335532Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.934339969Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.936528861Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.943248527Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:20.95593823Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.957659856Z 61 PC: 1374d | Open file (Filename = 'TASKMAN.EXE')
2018-12-17T22:19:20.965593361Z 65 PC: 13896 | Delete file (Filename = 'TASKMAN.EXE')
2018-12-17T22:19:20.975412024Z 62 PC: 1379d | Close file
2018-12-17T22:19:20.97721095Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:20.979252876Z 79 PC: 13200 | Find next file
2018-12-17T22:19:20.983081706Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:20.992645069Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:21.00554462Z 62 PC: 1379d | Close file
2018-12-17T22:19:21.007263336Z 61 PC: 1374d | Open file (Filename = 'WINVER.EXE')
2018-12-17T22:19:21.014290827Z 65 PC: 13896 | Delete file (Filename = 'WINVER.EXE')
2018-12-17T22:19:21.025230844Z 62 PC: 1379d | Close file
2018-12-17T22:19:21.027029162Z 26 PC: 131fb | Set disk transfer address
2018-12-17T22:19:21.028580214Z 79 PC: 13200 | Find next file
2018-12-17T22:19:21.032844916Z 67 PC: 131a6 | Get or set file attributes
2018-12-17T22:19:21.042897463Z 60 PC: 1374d | Create or truncate file
2018-12-17T22:19:21.054319986Z 62 PC: 1379d | Close file
2018-12-17T22:19:21.056063742Z 61 PC: 1374d | Open file (Filename = 'WINVER.EXE')
2018-12-17T22:19:21.062621925Z 65 PC: 13896 | Delete file (Filename = 'WINVER.EXE')
2018-12-17T22:19:21.073671332Z 62 PC: 1379d | Close file
2018-12-17T22:19:21.076000586Z 37 PC: 133e1 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:19:21.077278369Z 37 PC: 133e1 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:19:21.092980115Z 37 PC: 133e1 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:19:21.094063032Z 37 PC: 133e1 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:19:21.095087369Z 37 PC: 133e1 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:19:21.105346116Z 37 PC: 133e1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:19:21.106748282Z 37 PC: 133e1 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:19:21.108284498Z 37 PC: 133e1 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:19:21.110461693Z 37 PC: 133e1 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:19:21.11261939Z 37 PC: 133e1 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:19:21.115323848Z 37 PC: 133e1 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:19:21.116411809Z 37 PC: 133e1 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:19:21.117532986Z 37 PC: 133e1 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:19:21.119640857Z 37 PC: 133e1 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:19:21.120915212Z 37 PC: 133e1 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:19:21.122660488Z 37 PC: 133e1 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:19:21.127814225Z 37 PC: 133e1 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:19:21.128985434Z 37 PC: 133e1 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:19:21.130117363Z 37 PC: 133e1 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:19:21.132708218Z 76 PC: 13420 | Terminate with return code (Return code = '0')