Sample viewer

vx.netlux.org/Virus.DOS.KOV.Eddy.1463

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T21:50:58.605084375Z 42 PC: 12f2c | Get date 0x12f2c: cmp cx, 0x7cc
0x12f30: jne 0x12f3c
0x12f32: cmp dh, 4
0x12f35: ja 0x12f3c
0x12f37: cmp dl, 0xa
0x12f3a: jb 0x12f85
0x12f3c: mov al, 0xff
0x12f3e: mov ah, 0xf
0x12f40: xchg al, ah
0x12f42: nop
0x12f43: int 0x21
0x12f45: cmp ax, 0x101
0x12f48: jne 0x12f4e
0x12f4a: call 0x12f89
0x12f4d: nop
0x12f4e: mov ax, 0x3521
0x12f51: nop
0x12f52: int 0x21
0x12f54: cmp word ptr es:[0xa], 0x4254
0x12f5b: jne 0x12f69
2018-12-17T21:50:58.608327875Z 255 PC: 12f45 | UNKNOWN!
2018-12-17T21:50:58.609225327Z 53 PC: 12f54 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T21:50:58.610844091Z 240 PC: 12f83 | UNKNOWN!
2018-12-17T21:50:58.613315818Z 44 PC: 12e6e | Get time 0x12e6e: cmp cl, 6
0x12e71: jne 0x12ebb
0x12e73: mov ax, 0xb800
0x12e76: mov es, ax
0x12e78: mov cx, 0x30
0x12e7b: push cx
0x12e7c: mov cx, 0x7c0
0x12e7f: xor si, si
0x12e81: mov ah, 0x19
0x12e83: int 0x21
0x12e85: mov dl, dl
0x12e87: mov bx, 0x673
0x12e8a: mov ch, 0
0x12e8c: mov cl, 2
0x12e8e: mov dh, 0
0x12e90: push cs
0x12e91: pop es
0x12e92: int 0x13
0x12e94: mov ah, byte ptr es:[si]
0x12e97: cmp ah, 0x77
2018-12-17T21:50:58.616479866Z 9 PC: 12a86 | Display string (String= 'Goat file (COM/....). Size=00002774h/0000010100d bytes. ')
2018-12-17T21:50:58.622669763Z 48 PC: 12a8f | Get DOS version
2018-12-17T21:50:58.624727203Z 47 PC: 9ee8d | Get disk transfer address
2018-12-17T21:50:58.626201767Z 26 PC: 9ee8d | Set disk transfer address
2018-12-17T21:50:58.627546429Z 78 PC: 9ee8d | Find first file
2018-12-17T21:50:58.634942793Z 79 PC: 9ee8d | Find next file
2018-12-17T21:50:58.637829941Z 79 PC: 9ee8d | Find next file
2018-12-17T21:50:58.6403148Z 79 PC: 9ee8d | Find next file
2018-12-17T21:50:58.643692811Z 79 PC: 9ee8d | Find next file
2018-12-17T21:50:58.648293043Z 79 PC: 9ee8d | Find next file
2018-12-17T21:50:58.650807053Z 79 PC: 9ee8d | Find next file
2018-12-17T21:50:58.653331636Z 79 PC: 9ee8d | Find next file
2018-12-17T21:50:58.656708573Z 79 PC: 9ee8d | Find next file
2018-12-17T21:50:58.659923722Z 79 PC: 9ee8d | Find next file
2018-12-17T21:50:58.663630376Z 26 PC: 9ef1b | Set disk transfer address
2018-12-17T21:50:58.665866509Z 61 PC: 12b5c | Open file (Filename = '')
2018-12-17T21:50:58.673724914Z 93 PC: 12afe | File sharing functions
2018-12-17T21:50:58.675840497Z 9 PC: 12a86 | Display string (String= 'Size change=05B7h/01463d. ')
2018-12-17T21:50:58.680177518Z 76 PC: 12ae3 | Terminate with return code (Return code = '1')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":68,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:39:51.797762362Z 42 PC: 12f2c | Get date 0x12f2c: cmp cx, 0x7cc
0x12f30: jne 0x12f3c
0x12f32: cmp dh, 4
0x12f35: ja 0x12f3c
0x12f37: cmp dl, 0xa
0x12f3a: jb 0x12f85
0x12f3c: mov al, 0xff
0x12f3e: mov ah, 0xf
0x12f40: xchg al, ah
0x12f42: nop
0x12f43: int 0x21
0x12f45: cmp ax, 0x101
0x12f48: jne 0x12f4e
0x12f4a: call 0x12f89
0x12f4d: nop
0x12f4e: mov ax, 0x3521
0x12f51: nop
0x12f52: int 0x21
0x12f54: cmp word ptr es:[0xa], 0x4254
0x12f5b: jne 0x12f69
2018-12-25T11:39:51.79968722Z 255 PC: 12f45 | UNKNOWN!
2018-12-25T11:39:51.800401394Z 53 PC: 12f54 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T11:39:51.801339014Z 240 PC: 12f83 | UNKNOWN!
2018-12-25T11:39:51.802590277Z 44 PC: 12e6e | Get time 0x12e6e: cmp cl, 6
0x12e71: jne 0x12ebb
0x12e73: mov ax, 0xb800
0x12e76: mov es, ax
0x12e78: mov cx, 0x30
0x12e7b: push cx
0x12e7c: mov cx, 0x7c0
0x12e7f: xor si, si
0x12e81: mov ah, 0x19
0x12e83: int 0x21
0x12e85: mov dl, dl
0x12e87: mov bx, 0x673
0x12e8a: mov ch, 0
0x12e8c: mov cl, 2
0x12e8e: mov dh, 0
0x12e90: push cs
0x12e91: pop es
0x12e92: int 0x13
0x12e94: mov ah, byte ptr es:[si]
0x12e97: cmp ah, 0x77
2018-12-25T11:39:51.805869298Z 9 PC: 12a86 | Display string (String= 'Goat file (COM/....). Size=00002774h/0000010100d bytes. ')
2018-12-25T11:39:51.809417946Z 48 PC: 12a8f | Get DOS version
2018-12-25T11:39:51.810820508Z 47 PC: 9ee8d | Get disk transfer address
2018-12-25T11:39:51.812454815Z 26 PC: 9ee8d | Set disk transfer address (See above)
2018-12-25T11:39:51.813841322Z 78 PC: 9ee8d | Find first file (See above)
2018-12-25T11:39:51.818340166Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:51.821068623Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:51.823738789Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:51.826698554Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:51.829487293Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:51.832154751Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:51.834885064Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:51.837651981Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:51.840217633Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:51.842514873Z 26 PC: 9ef1b | Set disk transfer address
2018-12-25T11:39:51.84360732Z 61 PC: 12b5c | Open file (Filename = '')
2018-12-25T11:39:51.847726595Z 93 PC: 12afe | File sharing functions
2018-12-25T11:39:51.849445363Z 9 PC: 12a86 | Display string (See above)
2018-12-25T11:39:51.852726846Z 76 PC: 12ae3 | Terminate with return code (Return code = '1')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":68,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:39:52.012548606Z 42 PC: 12f2c | Get date 0x12f2c: cmp cx, 0x7cc
0x12f30: jne 0x12f3c
0x12f32: cmp dh, 4
0x12f35: ja 0x12f3c
0x12f37: cmp dl, 0xa
0x12f3a: jb 0x12f85
0x12f3c: mov al, 0xff
0x12f3e: mov ah, 0xf
0x12f40: xchg al, ah
0x12f42: nop
0x12f43: int 0x21
0x12f45: cmp ax, 0x101
0x12f48: jne 0x12f4e
0x12f4a: call 0x12f89
0x12f4d: nop
0x12f4e: mov ax, 0x3521
0x12f51: nop
0x12f52: int 0x21
0x12f54: cmp word ptr es:[0xa], 0x4254
0x12f5b: jne 0x12f69
2018-12-25T11:39:52.015269266Z 255 PC: 12f45 | UNKNOWN!
2018-12-25T11:39:52.016038328Z 53 PC: 12f54 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T11:39:52.017091414Z 240 PC: 12f83 | UNKNOWN!
2018-12-25T11:39:52.018350319Z 44 PC: 12e6e | Get time 0x12e6e: cmp cl, 6
0x12e71: jne 0x12ebb
0x12e73: mov ax, 0xb800
0x12e76: mov es, ax
0x12e78: mov cx, 0x30
0x12e7b: push cx
0x12e7c: mov cx, 0x7c0
0x12e7f: xor si, si
0x12e81: mov ah, 0x19
0x12e83: int 0x21
0x12e85: mov dl, dl
0x12e87: mov bx, 0x673
0x12e8a: mov ch, 0
0x12e8c: mov cl, 2
0x12e8e: mov dh, 0
0x12e90: push cs
0x12e91: pop es
0x12e92: int 0x13
0x12e94: mov ah, byte ptr es:[si]
0x12e97: cmp ah, 0x77
2018-12-25T11:39:52.021554882Z 9 PC: 12a86 | Display string (String= 'Goat file (COM/....). Size=00002774h/0000010100d bytes. ')
2018-12-25T11:39:52.027559958Z 48 PC: 12a8f | Get DOS version
2018-12-25T11:39:52.029176444Z 47 PC: 9ee8d | Get disk transfer address
2018-12-25T11:39:52.030288538Z 26 PC: 9ee8d | Set disk transfer address (See above)
2018-12-25T11:39:52.031150127Z 78 PC: 9ee8d | Find first file (See above)
2018-12-25T11:39:52.03788077Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.040559858Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.043274441Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.048115941Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.055171183Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.057704056Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.060350558Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.063315318Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.065870075Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.06826074Z 26 PC: 9ef1b | Set disk transfer address
2018-12-25T11:39:52.069591657Z 61 PC: 12b5c | Open file (Filename = '')
2018-12-25T11:39:52.07671332Z 93 PC: 12afe | File sharing functions
2018-12-25T11:39:52.079480629Z 9 PC: 12a86 | Display string (See above)
2018-12-25T11:39:52.085057074Z 76 PC: 12ae3 | Terminate with return code (Return code = '1')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":6,"Second":0,"TimeBased":true,"OriginalID":68,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:39:52.219849061Z 42 PC: 12f2c | Get date 0x12f2c: cmp cx, 0x7cc
0x12f30: jne 0x12f3c
0x12f32: cmp dh, 4
0x12f35: ja 0x12f3c
0x12f37: cmp dl, 0xa
0x12f3a: jb 0x12f85
0x12f3c: mov al, 0xff
0x12f3e: mov ah, 0xf
0x12f40: xchg al, ah
0x12f42: nop
0x12f43: int 0x21
0x12f45: cmp ax, 0x101
0x12f48: jne 0x12f4e
0x12f4a: call 0x12f89
0x12f4d: nop
0x12f4e: mov ax, 0x3521
0x12f51: nop
0x12f52: int 0x21
0x12f54: cmp word ptr es:[0xa], 0x4254
0x12f5b: jne 0x12f69
2018-12-25T11:39:52.222489832Z 255 PC: 12f45 | UNKNOWN!
2018-12-25T11:39:52.223208545Z 53 PC: 12f54 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T11:39:52.224410188Z 240 PC: 12f83 | UNKNOWN!
2018-12-25T11:39:52.225804493Z 44 PC: 12e6e | Get time 0x12e6e: cmp cl, 6
0x12e71: jne 0x12ebb
0x12e73: mov ax, 0xb800
0x12e76: mov es, ax
0x12e78: mov cx, 0x30
0x12e7b: push cx
0x12e7c: mov cx, 0x7c0
0x12e7f: xor si, si
0x12e81: mov ah, 0x19
0x12e83: int 0x21
0x12e85: mov dl, dl
0x12e87: mov bx, 0x673
0x12e8a: mov ch, 0
0x12e8c: mov cl, 2
0x12e8e: mov dh, 0
0x12e90: push cs
0x12e91: pop es
0x12e92: int 0x13
0x12e94: mov ah, byte ptr es:[si]
0x12e97: cmp ah, 0x77
2018-12-25T11:39:52.228045443Z 25 PC: 12e85 | Get default drive
2018-12-25T11:39:52.229649354Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.231215302Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.233024196Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.23459759Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.236228192Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.237853285Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.239408466Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.240834883Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.242715493Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.244190179Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.24563748Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.247426036Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.249020634Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.250482355Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.252514827Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.254208229Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.255893004Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.258150367Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.26048984Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.262769486Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.265671506Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.267437087Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.269143318Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.272235876Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.274294975Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.276162214Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.278681565Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.281643945Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.282995915Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.284712722Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.286535365Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.288063411Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.28964099Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.291764519Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.293334356Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.294851623Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.296807885Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.298476684Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.30013548Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.302376477Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.304071942Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.30574011Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.321054709Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.323075801Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.324862068Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.327591713Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.329388334Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.331961265Z 9 PC: 12a86 | Display string (String= 'Goat file (COM/....). Size=00002774h/0000010100d bytes. ')
2018-12-25T11:39:52.338279547Z 48 PC: 12a8f | Get DOS version
2018-12-25T11:39:52.339727388Z 47 PC: 9ee8d | Get disk transfer address
2018-12-25T11:39:52.340817908Z 26 PC: 9ee8d | Set disk transfer address (See above)
2018-12-25T11:39:52.341892627Z 78 PC: 9ee8d | Find first file (See above)
2018-12-25T11:39:52.348500112Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.351042841Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.353536832Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.356409837Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.359069899Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.361651053Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.365639335Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.368449729Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.371216495Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.374138948Z 26 PC: 9ef1b | Set disk transfer address
2018-12-25T11:39:52.375313012Z 61 PC: 12b5c | Open file (Filename = '')
2018-12-25T11:39:52.382594086Z 93 PC: 12afe | File sharing functions
2018-12-25T11:39:52.385038792Z 9 PC: 12a86 | Display string (See above)
2018-12-25T11:39:52.391186778Z 76 PC: 12ae3 | Terminate with return code (Return code = '1')

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":6,"Second":0,"TimeBased":true,"OriginalID":68,"SideJobID":0}

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-25T11:39:52.408836115Z 42 PC: 12f2c | Get date 0x12f2c: cmp cx, 0x7cc
0x12f30: jne 0x12f3c
0x12f32: cmp dh, 4
0x12f35: ja 0x12f3c
0x12f37: cmp dl, 0xa
0x12f3a: jb 0x12f85
0x12f3c: mov al, 0xff
0x12f3e: mov ah, 0xf
0x12f40: xchg al, ah
0x12f42: nop
0x12f43: int 0x21
0x12f45: cmp ax, 0x101
0x12f48: jne 0x12f4e
0x12f4a: call 0x12f89
0x12f4d: nop
0x12f4e: mov ax, 0x3521
0x12f51: nop
0x12f52: int 0x21
0x12f54: cmp word ptr es:[0xa], 0x4254
0x12f5b: jne 0x12f69
2018-12-25T11:39:52.410761782Z 255 PC: 12f45 | UNKNOWN!
2018-12-25T11:39:52.411442897Z 53 PC: 12f54 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T11:39:52.412353645Z 240 PC: 12f83 | UNKNOWN!
2018-12-25T11:39:52.413487719Z 44 PC: 12e6e | Get time 0x12e6e: cmp cl, 6
0x12e71: jne 0x12ebb
0x12e73: mov ax, 0xb800
0x12e76: mov es, ax
0x12e78: mov cx, 0x30
0x12e7b: push cx
0x12e7c: mov cx, 0x7c0
0x12e7f: xor si, si
0x12e81: mov ah, 0x19
0x12e83: int 0x21
0x12e85: mov dl, dl
0x12e87: mov bx, 0x673
0x12e8a: mov ch, 0
0x12e8c: mov cl, 2
0x12e8e: mov dh, 0
0x12e90: push cs
0x12e91: pop es
0x12e92: int 0x13
0x12e94: mov ah, byte ptr es:[si]
0x12e97: cmp ah, 0x77
2018-12-25T11:39:52.415016966Z 25 PC: 12e85 | Get default drive
2018-12-25T11:39:52.416178162Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.418197587Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.420127567Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.422254567Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.42405719Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.426049548Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.427853794Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.429509127Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.43206796Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.433842102Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.435394914Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.437538543Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.43923475Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.440943467Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.443067954Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.445777434Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.447463593Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.452853694Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.454631467Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.457192958Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.459144416Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.46085816Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.462374289Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.464374497Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.466117756Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.467640867Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.469475425Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.471217533Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.472901519Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.47479285Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.476708064Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.47841415Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.480108538Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.481887257Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.483737035Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.48552686Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.487521444Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.489739799Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.491503772Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.493973849Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.495670644Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.497375475Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.49957815Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.501306126Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.502976578Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.504961704Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.506655202Z 25 PC: 12e85 | Get default drive (See above)
2018-12-25T11:39:52.509189257Z 9 PC: 12a86 | Display string (String= 'Goat file (COM/....). Size=00002774h/0000010100d bytes. ')
2018-12-25T11:39:52.515958138Z 48 PC: 12a8f | Get DOS version
2018-12-25T11:39:52.517253773Z 47 PC: 9ee8d | Get disk transfer address
2018-12-25T11:39:52.518340619Z 26 PC: 9ee8d | Set disk transfer address (See above)
2018-12-25T11:39:52.519676062Z 78 PC: 9ee8d | Find first file (See above)
2018-12-25T11:39:52.526220968Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.529571802Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.532520725Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.534337389Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.536036518Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.538186153Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.539981137Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.541639228Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.543758567Z 79 PC: 9ee8d | Find next file (See above)
2018-12-25T11:39:52.545497801Z 26 PC: 9ef1b | Set disk transfer address
2018-12-25T11:39:52.546344303Z 61 PC: 12b5c | Open file (Filename = '')
2018-12-25T11:39:52.550960086Z 93 PC: 12afe | File sharing functions
2018-12-25T11:39:52.553646387Z 9 PC: 12a86 | Display string (See above)
2018-12-25T11:39:52.557457252Z 76 PC: 12ae3 | Terminate with return code (Return code = '1')