Sample viewer

vx.netlux.org/Virus.DOS.Protect.1196

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-17T21:56:42.184655041Z	115	PC: 1371f \| UNKNOWN!
2018-12-17T21:56:42.185747721Z	73	PC: 1372a \| Release memory
2018-12-17T21:56:42.186890715Z	74	PC: 13747 \| Reallocate memory
2018-12-17T21:56:42.188042844Z	18	PC: 1374e \| Find next file
2018-12-17T21:56:42.192187979Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.19414818Z	77	PC: 11fe0 \| Get program return code
2018-12-17T21:56:42.195184502Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.197497163Z	72	PC: 12174 \| Allocate memory
2018-12-17T21:56:42.199113328Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.201497675Z	72	PC: 1218d \| Allocate memory
2018-12-17T21:56:42.203844396Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.206392782Z	37	PC: 123c4 \| Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-17T21:56:42.207343007Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.209686238Z	37	PC: 123cb \| Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T21:56:42.210651457Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.21256617Z	37	PC: 123d2 \| Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T21:56:42.21398415Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.215960565Z	62	PC: 122ab \| Close file
2018-12-17T21:56:42.217259161Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.219510796Z	62	PC: 122ab \| Close file
2018-12-17T21:56:42.220883481Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.222777924Z	62	PC: 122ab \| Close file
2018-12-17T21:56:42.224411062Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.226423179Z	62	PC: 122ab \| Close file
2018-12-17T21:56:42.227729853Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.230613815Z	62	PC: 122ab \| Close file
2018-12-17T21:56:42.23203339Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.233955403Z	62	PC: 122ab \| Close file
2018-12-17T21:56:42.235572938Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.237571232Z	62	PC: 122ab \| Close file
2018-12-17T21:56:42.238676862Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.240130722Z	62	PC: 122ab \| Close file
2018-12-17T21:56:42.241860803Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.243778658Z	62	PC: 122ab \| Close file
2018-12-17T21:56:42.24504136Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.247773987Z	62	PC: 122ab \| Close file
2018-12-17T21:56:42.249075221Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.250893741Z	62	PC: 122ab \| Close file
2018-12-17T21:56:42.252531627Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.253933116Z	62	PC: 122ab \| Close file
2018-12-17T21:56:42.254929151Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.257339996Z	62	PC: 122ab \| Close file
2018-12-17T21:56:42.258565678Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.260916209Z	62	PC: 122ab \| Close file
2018-12-17T21:56:42.262927116Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.264888982Z	62	PC: 122ab \| Close file
2018-12-17T21:56:42.26740668Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.26981047Z	99	PC: 99dc7 \| Get DBCS lead byte table pointer
2018-12-17T21:56:42.270901531Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.272747504Z	56	PC: 945e9 \| Get or set country info
2018-12-17T21:56:42.274893299Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.276772986Z	64	PC: 9a038 \| Write file or device (Write 2 bytes on handle 1)
2018-12-17T21:56:42.280908846Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.283228513Z	25	PC: 94652 \| Get default drive
2018-12-17T21:56:42.284604828Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.286644664Z	71	PC: 968cd \| Get current directory
2018-12-17T21:56:42.290788934Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.292664009Z	64	PC: 9a038 \| Write file or device (Write 3 bytes on handle 1)
2018-12-17T21:56:42.295580728Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.298044605Z	2	PC: 968a2 \| Character output (Char = '3e')
2018-12-17T21:56:42.299990694Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.302613164Z	93	PC: 94710 \| File sharing functions
2018-12-17T21:56:42.306608781Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.308498113Z	93	PC: 94717 \| File sharing functions
2018-12-17T21:56:42.310044284Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-17T21:56:42.312472391Z	10	PC: 94729 \| Buffered keyboard input

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":728,"SideJobID":0}

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T11:41:36.07397451Z	115	PC: 1371f \| UNKNOWN!
2018-12-25T11:41:36.075764558Z	73	PC: 1372a \| Release memory
2018-12-25T11:41:36.077505702Z	74	PC: 13747 \| Reallocate memory
2018-12-25T11:41:36.079238424Z	18	PC: 1374e \| Find next file
2018-12-25T11:41:36.083202213Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-25T11:41:36.08541161Z	77	PC: 11fe0 \| Get program return code
2018-12-25T11:41:36.086670784Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.090605179Z	72	PC: 12174 \| Allocate memory
2018-12-25T11:41:36.094049491Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.096434601Z	72	PC: 1218d \| Allocate memory
2018-12-25T11:41:36.101156789Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.103555844Z	37	PC: 123c4 \| Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-25T11:41:36.104930256Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.112575264Z	37	PC: 123cb \| Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-25T11:41:36.11380768Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.115939557Z	37	PC: 123d2 \| Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:41:36.117430883Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.120353217Z	62	PC: 122ab \| Close file
2018-12-25T11:41:36.122679813Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.125652554Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:36.128386727Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.131218249Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:36.13305074Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.135979614Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:36.137311043Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.139302412Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:36.141886938Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.144109522Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:36.145749266Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.151613113Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:36.153500492Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.155696677Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:36.159492516Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.161653487Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:36.163326698Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.165583359Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:36.167291905Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.170544008Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:36.172202933Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.174450834Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:36.175779357Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.177879912Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:36.180195107Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.18313499Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:36.186689008Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.190189906Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:36.193236409Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.195651875Z	99	PC: 99dc7 \| Get DBCS lead byte table pointer
2018-12-25T11:41:36.197851808Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.200257669Z	56	PC: 945e9 \| Get or set country info
2018-12-25T11:41:36.202391311Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.205471012Z	64	PC: 9a038 \| Write file or device (Write 2 bytes on handle 1)
2018-12-25T11:41:36.210143224Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.21250885Z	25	PC: 94652 \| Get default drive
2018-12-25T11:41:36.215370443Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.217524958Z	71	PC: 968cd \| Get current directory
2018-12-25T11:41:36.221390286Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.224018217Z	64	PC: 9a038 \| Write file or device (See above)
2018-12-25T11:41:36.227117219Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.22955126Z	2	PC: 968a2 \| Character output (Char = '3e')
2018-12-25T11:41:36.232460307Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.234804915Z	93	PC: 94710 \| File sharing functions
2018-12-25T11:41:36.236674Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.239839307Z	93	PC: 94717 \| File sharing functions
2018-12-25T11:41:36.241808344Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:36.244113142Z	10	PC: 94729 \| Buffered keyboard input

{"DateBased":true,"Day":1,"Month":1,"Year":1992,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":728,"SideJobID":0}

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T11:41:37.58177166Z	115	PC: 1371f \| UNKNOWN!
2018-12-25T11:41:37.583287605Z	73	PC: 1372a \| Release memory
2018-12-25T11:41:37.584487Z	74	PC: 13747 \| Reallocate memory
2018-12-25T11:41:37.585521254Z	18	PC: 1374e \| Find next file
2018-12-25T11:41:37.589500166Z	42	PC: 9f6d9 \| Get date 0x9f6d9: cmp cx, 0x7c8 0x9f6dd: jb 0x9f6e5 0x9f6df: mov byte ptr cs:[0x64], 1 0x9f6e5: pop dx 0x9f6e6: pop cx 0x9f6e7: pop ax 0x9f6e8: ljmp ptr cs:[0] 0x9f6ed: mov ax, 0x2371 0x9f6f0: iret 0x9f6f1: push ds 0x9f6f2: push es 0x9f6f3: push bp 0x9f6f4: push si 0x9f6f5: push di 0x9f6f6: push ax 0x9f6f7: push bx 0x9f6f8: push cx 0x9f6f9: push dx 0x9f6fa: pushf 0x9f6fb: push ax
2018-12-25T11:41:37.592016104Z	77	PC: 11fe0 \| Get program return code
2018-12-25T11:41:37.592926535Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.595315634Z	72	PC: 12174 \| Allocate memory
2018-12-25T11:41:37.597044321Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.598966743Z	72	PC: 1218d \| Allocate memory
2018-12-25T11:41:37.601032849Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.603583511Z	37	PC: 123c4 \| Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-25T11:41:37.604780826Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.606853008Z	37	PC: 123cb \| Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-25T11:41:37.620408769Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.623331047Z	37	PC: 123d2 \| Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:41:37.624575652Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.627336747Z	62	PC: 122ab \| Close file
2018-12-25T11:41:37.629003675Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.631103025Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:37.634053643Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.636130789Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:37.637567112Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.640481574Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:37.642056603Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.657840973Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:37.663694608Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.666324176Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:37.66816689Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.671456688Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:37.675897341Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.678016598Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:37.680559804Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.683082994Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:37.684947318Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.691428025Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:37.6930023Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.695246629Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:37.697673506Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.699762472Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:37.701162807Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.704234064Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:37.705654644Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.70848294Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:37.71124796Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.713401844Z	62	PC: 122ab \| Close file (See above)
2018-12-25T11:41:37.716256893Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.718848888Z	99	PC: 99dc7 \| Get DBCS lead byte table pointer
2018-12-25T11:41:37.720776095Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.72317084Z	56	PC: 945e9 \| Get or set country info
2018-12-25T11:41:37.726277639Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.728672016Z	64	PC: 9a038 \| Write file or device (Write 2 bytes on handle 1)
2018-12-25T11:41:37.734293956Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.737898038Z	25	PC: 94652 \| Get default drive
2018-12-25T11:41:37.740079301Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.742180024Z	71	PC: 968cd \| Get current directory
2018-12-25T11:41:37.746117776Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.749457131Z	64	PC: 9a038 \| Write file or device (See above)
2018-12-25T11:41:37.752743534Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.75512679Z	2	PC: 968a2 \| Character output (Char = '3e')
2018-12-25T11:41:37.758256344Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.76070618Z	93	PC: 94710 \| File sharing functions
2018-12-25T11:41:37.762630916Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.765730019Z	93	PC: 94717 \| File sharing functions
2018-12-25T11:41:37.768098198Z	42	PC: 9f6d9 \| Get date (See above)
2018-12-25T11:41:37.770576401Z	10	PC: 94729 \| Buffered keyboard input