Sample viewer

vx.netlux.org/Virus.DOS.HLLP.Kornik.6256

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:59:43.265190339Z 53 PC: 139ca | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:59:43.26670493Z 53 PC: 139ca | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:59:43.26807658Z 53 PC: 139ca | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:59:43.270397009Z 53 PC: 139ca | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:59:43.27191395Z 53 PC: 139ca | Get interrupt vector (Interrupt = '244' AKA 'UNKNOWN!')
2018-12-17T22:59:43.273228036Z 53 PC: 139ca | Get interrupt vector (Interrupt = '187' AKA 'UNKNOWN!')
2018-12-17T22:59:43.274538598Z 53 PC: 139ca | Get interrupt vector (Interrupt = '160' AKA 'UNKNOWN!')
2018-12-17T22:59:43.276164144Z 53 PC: 139ca | Get interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:59:43.277332219Z 53 PC: 139ca | Get interrupt vector (Interrupt = '112' AKA 'UNKNOWN!')
2018-12-17T22:59:43.278551973Z 53 PC: 139ca | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:59:43.280652816Z 53 PC: 139ca | Get interrupt vector (Interrupt = '38' AKA 'Create PSP')
2018-12-17T22:59:43.282245519Z 53 PC: 139ca | Get interrupt vector (Interrupt = '198' AKA 'UNKNOWN!')
2018-12-17T22:59:43.283826412Z 53 PC: 139ca | Get interrupt vector (Interrupt = '7' AKA 'Direct console input without echo')
2018-12-17T22:59:43.285828279Z 53 PC: 139ca | Get interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:59:43.287509464Z 53 PC: 139ca | Get interrupt vector (Interrupt = '51' AKA 'Get or set Ctrl-Break')
2018-12-17T22:59:43.289177017Z 53 PC: 139ca | Get interrupt vector (Interrupt = '237' AKA 'UNKNOWN!')
2018-12-17T22:59:43.291089556Z 53 PC: 139ca | Get interrupt vector (Interrupt = '124' AKA 'UNKNOWN!')
2018-12-17T22:59:43.310188722Z 53 PC: 139ca | Get interrupt vector (Interrupt = '190' AKA 'UNKNOWN!')
2018-12-17T22:59:43.312291242Z 53 PC: 139ca | Get interrupt vector (Interrupt = '190' AKA 'UNKNOWN!')
2018-12-17T22:59:43.315151984Z 37 PC: 139df | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:59:43.316486517Z 37 PC: 139e7 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:59:43.317740792Z 37 PC: 139ef | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:59:43.319004951Z 37 PC: 139f7 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:59:43.32166445Z 68 PC: 146df | I/O control for devices (Set for = '')
2018-12-17T22:59:43.324206389Z 44 PC: 14816 | Get time 0x14816: mov word ptr [0x3a0], cx
0x1481a: mov word ptr [0x3a2], dx
0x1481e: retf
0x1481f: call 0x14866
0x14822: jb 0x14833
0x14824: mov cx, word ptr es:[di + 4]
0x14828: cmp cx, 1
0x1482b: je 0x14833
0x1482d: xor bx, bx
0x1482f: push cs
0x14830: call 0x243a7
0x14833: retf 4
0x14836: call 0x14866
0x14839: jb 0x1484e
0x1483b: mov ax, cx
0x1483d: mov dx, bx
0x1483f: mov cx, word ptr es:[di + 4]
0x14843: cmp cx, 1
0x14846: je 0x1484e
0x14848: xor bx, bx
2018-12-17T22:59:43.326843668Z 48 PC: 141f7 | Get DOS version
2018-12-17T22:59:43.329699577Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:43.337296944Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:43.597017877Z 61 PC: 14035 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T22:59:43.606347564Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:43.616486584Z 62 PC: 14085 | Close file
2018-12-17T22:59:43.621923627Z 48 PC: 141f7 | Get DOS version
2018-12-17T22:59:43.639467497Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:43.647647948Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:43.91020455Z 61 PC: 14035 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T22:59:43.92125029Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:43.92448807Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:43.927616113Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:43.930830355Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:43.935256524Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:43.93857909Z 66 PC: 14167 | Move file pointer
2018-12-17T22:59:43.941405403Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:43.952543997Z 66 PC: 14167 | Move file pointer
2018-12-17T22:59:43.956066046Z 64 PC: 14108 | Write file or device (Write 6256 bytes on handle 5)
2018-12-17T22:59:43.976876904Z 62 PC: 14085 | Close file
2018-12-17T22:59:43.988854841Z 53 PC: 13945 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:59:43.991636762Z 37 PC: 1394e | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:59:43.995821083Z 53 PC: 13945 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:59:44.001017381Z 37 PC: 1394e | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:59:44.004729914Z 53 PC: 13945 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:59:44.008381673Z 37 PC: 1394e | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:59:44.01213022Z 53 PC: 13945 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:59:44.015350839Z 37 PC: 1394e | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:59:44.018203553Z 53 PC: 13945 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:59:44.021201123Z 37 PC: 1394e | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:59:44.0247211Z 53 PC: 13945 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:59:44.02799195Z 37 PC: 1394e | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:59:44.033069802Z 53 PC: 13945 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:59:44.037175863Z 37 PC: 1394e | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:59:44.040467241Z 53 PC: 13945 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:59:44.043820568Z 37 PC: 1394e | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:59:44.047863944Z 53 PC: 13945 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:59:44.051065407Z 37 PC: 1394e | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:59:44.053831037Z 53 PC: 13945 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:59:44.057325464Z 37 PC: 1394e | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:59:44.060328341Z 53 PC: 13945 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:59:44.063089988Z 37 PC: 1394e | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:59:44.066045359Z 53 PC: 13945 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:59:44.068353226Z 37 PC: 1394e | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:59:44.071006647Z 53 PC: 13945 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:59:44.073847306Z 37 PC: 1394e | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:59:44.07767298Z 53 PC: 13945 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:59:44.080373728Z 37 PC: 1394e | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:59:44.083123206Z 53 PC: 13945 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:59:44.087339256Z 37 PC: 1394e | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:59:44.104220516Z 53 PC: 13945 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:59:44.107368032Z 37 PC: 1394e | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:59:44.110992223Z 53 PC: 13945 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:59:44.113725575Z 37 PC: 1394e | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:59:44.116503074Z 53 PC: 13945 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:59:44.120085998Z 37 PC: 1394e | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:59:44.12320231Z 53 PC: 13945 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:59:44.125936118Z 37 PC: 1394e | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:59:44.130582304Z 48 PC: 141f7 | Get DOS version
2018-12-17T22:59:44.135830529Z 41 PC: 13894 | Parse filename
2018-12-17T22:59:44.144672542Z 41 PC: 138a2 | Parse filename
2018-12-17T22:59:44.156027245Z 75 PC: 138ad | Execute program
2018-12-17T22:59:44.179145185Z 9 PC: 1b48a | Display string (Could not find end pointer)
2018-12-17T22:59:44.184937879Z 76 PC: 1b490 | Terminate with return code (Return code = '0')
2018-12-17T22:59:44.189711999Z 53 PC: 13945 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:59:44.193665414Z 37 PC: 1394e | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:59:44.196750457Z 53 PC: 13945 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:59:44.199854094Z 37 PC: 1394e | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:59:44.203409899Z 53 PC: 13945 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:59:44.206366826Z 37 PC: 1394e | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:59:44.209426255Z 53 PC: 13945 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:59:44.213411995Z 37 PC: 1394e | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:59:44.216166608Z 53 PC: 13945 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:59:44.219249837Z 37 PC: 1394e | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:59:44.222529661Z 53 PC: 13945 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:59:44.225420286Z 37 PC: 1394e | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:59:44.228819422Z 53 PC: 13945 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:59:44.232546071Z 37 PC: 1394e | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T22:59:44.235809007Z 53 PC: 13945 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:59:44.238675215Z 37 PC: 1394e | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T22:59:44.241692583Z 53 PC: 13945 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:59:44.2445114Z 37 PC: 1394e | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T22:59:44.247174703Z 53 PC: 13945 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:59:44.250050387Z 37 PC: 1394e | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T22:59:44.253177644Z 53 PC: 13945 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:59:44.255889937Z 37 PC: 1394e | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T22:59:44.258540112Z 53 PC: 13945 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:59:44.262096137Z 37 PC: 1394e | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T22:59:44.264768482Z 53 PC: 13945 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:59:44.267544352Z 37 PC: 1394e | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T22:59:44.27067614Z 53 PC: 13945 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:59:44.273372636Z 37 PC: 1394e | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T22:59:44.276032524Z 53 PC: 13945 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:59:44.279246377Z 37 PC: 1394e | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T22:59:44.281891252Z 53 PC: 13945 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:59:44.284606747Z 37 PC: 1394e | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T22:59:44.287760086Z 53 PC: 13945 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:59:44.290409688Z 37 PC: 1394e | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T22:59:44.292967449Z 53 PC: 13945 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:59:44.296060962Z 37 PC: 1394e | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T22:59:44.298722868Z 53 PC: 13945 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:59:44.301450977Z 37 PC: 1394e | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T22:59:44.304735963Z 48 PC: 141f7 | Get DOS version
2018-12-17T22:59:44.307762229Z 61 PC: 14035 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T22:59:44.326311898Z 64 PC: 14108 | Write file or device (Write 6256 bytes on handle 5)
2018-12-17T22:59:44.338188564Z 62 PC: 14085 | Close file
2018-12-17T22:59:44.3486479Z 61 PC: 14035 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T22:59:44.357701682Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:44.361262106Z 62 PC: 14085 | Close file
2018-12-17T22:59:44.370463436Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:44.383305056Z 26 PC: 136ad | Set disk transfer address
2018-12-17T22:59:44.386471454Z 78 PC: 136b9 | Find first file
2018-12-17T22:59:44.394808901Z 26 PC: 136ad | Set disk transfer address
2018-12-17T22:59:44.397308633Z 78 PC: 136b9 | Find first file
2018-12-17T22:59:44.410160285Z 25 PC: 14284 | Get default drive
2018-12-17T22:59:44.415872403Z 71 PC: 14297 | Get current directory
2018-12-17T22:59:44.420373397Z 26 PC: 136ad | Set disk transfer address
2018-12-17T22:59:44.423465634Z 78 PC: 136b9 | Find first file
2018-12-17T22:59:44.431675919Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:44.447066501Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:44.46086Z 61 PC: 14035 | Open file (Filename = 'TEST.EXE')
2018-12-17T22:59:44.470595017Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:44.472554342Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:44.475963185Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:44.478951982Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:44.481640488Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:44.48549701Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:44.489073165Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:44.492532236Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:44.496926075Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:44.508944139Z 62 PC: 14085 | Close file
2018-12-17T22:59:44.512576447Z 61 PC: 14035 | Open file (Filename = 'TEST.EXE')
2018-12-17T22:59:44.524055423Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:44.527528783Z 62 PC: 14085 | Close file
2018-12-17T22:59:44.537076114Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:44.550601132Z 26 PC: 136d1 | Set disk transfer address
2018-12-17T22:59:44.554155635Z 79 PC: 136d6 | Find next file
2018-12-17T22:59:44.559316494Z 14 PC: 142dd | Set default drive (Drive = 'C')
2018-12-17T22:59:44.562096474Z 25 PC: 142e1 | Get default drive
2018-12-17T22:59:44.565774577Z 59 PC: 1434b | Change current directory
2018-12-17T22:59:44.574519Z 26 PC: 136ad | Set disk transfer address
2018-12-17T22:59:44.577111047Z 78 PC: 136b9 | Find first file
2018-12-17T22:59:44.590564582Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:44.599301705Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:45.30339628Z 61 PC: 14035 | Open file (Filename = 'ATTRIB.EXE')
2018-12-17T22:59:45.3133417Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:45.316321577Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:45.319284873Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:45.322744715Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:45.32553185Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:45.328335959Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:45.33207796Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:45.335145493Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:45.337941833Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:45.350012476Z 66 PC: 14167 | Move file pointer
2018-12-17T22:59:45.353013699Z 64 PC: 14108 | Write file or device (Write 6256 bytes on handle 5)
2018-12-17T22:59:45.363283534Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:45.367290488Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:45.370063982Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:45.372877409Z 66 PC: 14167 | Move file pointer
2018-12-17T22:59:45.376699379Z 64 PC: 14108 | Write file or device (Write 6256 bytes on handle 5)
2018-12-17T22:59:45.392279854Z 62 PC: 14085 | Close file
2018-12-17T22:59:45.403084329Z 61 PC: 14035 | Open file (Filename = 'ATTRIB.EXE')
2018-12-17T22:59:45.413685192Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:45.416680887Z 62 PC: 14085 | Close file
2018-12-17T22:59:45.425022866Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:45.439400363Z 14 PC: 142dd | Set default drive (Drive = 'C')
2018-12-17T22:59:45.442176173Z 25 PC: 142e1 | Get default drive
2018-12-17T22:59:45.443688755Z 59 PC: 1434b | Change current directory
2018-12-17T22:59:45.452297007Z 26 PC: 136ad | Set disk transfer address
2018-12-17T22:59:45.455190492Z 78 PC: 136b9 | Find first file
2018-12-17T22:59:45.464163438Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:45.472470806Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:45.484767081Z 61 PC: 14035 | Open file (Filename = 'ATTRIB.EXE')
2018-12-17T22:59:45.49373086Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:45.496268803Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:45.499101479Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:45.501697062Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:45.505608572Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:45.507897758Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:45.51053875Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:45.513545066Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:45.517140869Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:45.527669964Z 62 PC: 14085 | Close file
2018-12-17T22:59:45.531151573Z 61 PC: 14035 | Open file (Filename = 'ATTRIB.EXE')
2018-12-17T22:59:45.541223433Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:45.544383501Z 62 PC: 14085 | Close file
2018-12-17T22:59:45.552901695Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:45.56648131Z 26 PC: 136d1 | Set disk transfer address
2018-12-17T22:59:45.567813917Z 79 PC: 136d6 | Find next file
2018-12-17T22:59:45.57264505Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:45.581406991Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:45.594269024Z 61 PC: 14035 | Open file (Filename = 'CHKDSK.EXE')
2018-12-17T22:59:45.603861686Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:45.607560976Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:45.610181844Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:45.612729194Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:45.616099619Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:45.618896805Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:45.621707259Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:45.625491929Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:45.628234803Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:45.638776554Z 66 PC: 14167 | Move file pointer
2018-12-17T22:59:45.642301874Z 64 PC: 14108 | Write file or device (Write 6256 bytes on handle 5)
2018-12-17T22:59:45.657338106Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:45.660133386Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:45.663348972Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:45.666311044Z 66 PC: 14167 | Move file pointer
2018-12-17T22:59:45.669295054Z 64 PC: 14108 | Write file or device (Write 6256 bytes on handle 5)
2018-12-17T22:59:45.688178364Z 62 PC: 14085 | Close file
2018-12-17T22:59:45.698658045Z 61 PC: 14035 | Open file (Filename = 'CHKDSK.EXE')
2018-12-17T22:59:45.707520997Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:45.711259959Z 62 PC: 14085 | Close file
2018-12-17T22:59:45.719028844Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:45.731695014Z 14 PC: 142dd | Set default drive (Drive = 'C')
2018-12-17T22:59:45.735295594Z 25 PC: 142e1 | Get default drive
2018-12-17T22:59:45.737975247Z 59 PC: 1434b | Change current directory
2018-12-17T22:59:45.746815268Z 26 PC: 136ad | Set disk transfer address
2018-12-17T22:59:45.750268486Z 78 PC: 136b9 | Find first file
2018-12-17T22:59:45.762542495Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:45.772612463Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:45.785675617Z 61 PC: 14035 | Open file (Filename = 'ATTRIB.EXE')
2018-12-17T22:59:45.796280081Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:45.799287758Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:45.802318957Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:45.805553961Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:45.808141057Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:45.811166011Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:45.815072956Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:45.818440083Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:45.821428588Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:45.833109456Z 62 PC: 14085 | Close file
2018-12-17T22:59:45.836657519Z 61 PC: 14035 | Open file (Filename = 'ATTRIB.EXE')
2018-12-17T22:59:45.846882166Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:45.851642501Z 62 PC: 14085 | Close file
2018-12-17T22:59:45.860516636Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:45.873698099Z 26 PC: 136d1 | Set disk transfer address
2018-12-17T22:59:45.877003615Z 79 PC: 136d6 | Find next file
2018-12-17T22:59:45.882645125Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:45.891410888Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:45.905339082Z 61 PC: 14035 | Open file (Filename = 'CHKDSK.EXE')
2018-12-17T22:59:45.915663243Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:45.918737899Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:45.922744362Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:45.926220117Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:45.929221795Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:45.9341175Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:45.937596281Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:45.941058038Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:45.945071994Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:45.956594909Z 62 PC: 14085 | Close file
2018-12-17T22:59:45.959787112Z 61 PC: 14035 | Open file (Filename = 'CHKDSK.EXE')
2018-12-17T22:59:45.96997865Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:45.972824998Z 62 PC: 14085 | Close file
2018-12-17T22:59:45.981936064Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:45.996021189Z 26 PC: 136d1 | Set disk transfer address
2018-12-17T22:59:45.999103464Z 79 PC: 136d6 | Find next file
2018-12-17T22:59:46.004669969Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:46.014005611Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:46.026644734Z 61 PC: 14035 | Open file (Filename = 'DEBUG.EXE')
2018-12-17T22:59:46.036541907Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:46.040517259Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:46.043945702Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:46.047089416Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:46.051609021Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:46.054222907Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:46.063051893Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:46.07231579Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:46.075520155Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:46.086398814Z 66 PC: 14167 | Move file pointer
2018-12-17T22:59:46.090202649Z 64 PC: 14108 | Write file or device (Write 6256 bytes on handle 5)
2018-12-17T22:59:46.100846162Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:46.104411461Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:46.108416535Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:46.111837194Z 66 PC: 14167 | Move file pointer
2018-12-17T22:59:46.114981754Z 64 PC: 14108 | Write file or device (Write 6256 bytes on handle 5)
2018-12-17T22:59:46.128517151Z 62 PC: 14085 | Close file
2018-12-17T22:59:46.140975871Z 61 PC: 14035 | Open file (Filename = 'DEBUG.EXE')
2018-12-17T22:59:46.150375965Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:46.154116188Z 62 PC: 14085 | Close file
2018-12-17T22:59:46.163229319Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:46.176189669Z 14 PC: 142dd | Set default drive (Drive = 'C')
2018-12-17T22:59:46.179820165Z 25 PC: 142e1 | Get default drive
2018-12-17T22:59:46.181404128Z 59 PC: 1434b | Change current directory
2018-12-17T22:59:46.190443667Z 26 PC: 136ad | Set disk transfer address
2018-12-17T22:59:46.194147204Z 78 PC: 136b9 | Find first file
2018-12-17T22:59:46.20262112Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:46.210873965Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:46.224904817Z 61 PC: 14035 | Open file (Filename = 'ATTRIB.EXE')
2018-12-17T22:59:46.234873663Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:46.237430597Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:46.241528765Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:46.244513714Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:46.247631604Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:46.251295885Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:46.254426213Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:46.25787299Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:46.2618023Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:46.272403746Z 62 PC: 14085 | Close file
2018-12-17T22:59:46.275710721Z 61 PC: 14035 | Open file (Filename = 'ATTRIB.EXE')
2018-12-17T22:59:46.286823779Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:46.290080018Z 62 PC: 14085 | Close file
2018-12-17T22:59:46.298772343Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:46.313048393Z 26 PC: 136d1 | Set disk transfer address
2018-12-17T22:59:46.315685543Z 79 PC: 136d6 | Find next file
2018-12-17T22:59:46.321617087Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:46.331461388Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:46.344482319Z 61 PC: 14035 | Open file (Filename = 'CHKDSK.EXE')
2018-12-17T22:59:46.354254544Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:46.358175236Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:46.360668497Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:46.364118974Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:46.367670991Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:46.370516456Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:46.373413364Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:46.37587165Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:46.377846727Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:46.38679602Z 62 PC: 14085 | Close file
2018-12-17T22:59:46.390573602Z 61 PC: 14035 | Open file (Filename = 'CHKDSK.EXE')
2018-12-17T22:59:46.399514379Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:46.402465873Z 62 PC: 14085 | Close file
2018-12-17T22:59:46.411007872Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:46.440088869Z 26 PC: 136d1 | Set disk transfer address
2018-12-17T22:59:46.442705922Z 79 PC: 136d6 | Find next file
2018-12-17T22:59:46.448331991Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:46.457192543Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:46.471046549Z 61 PC: 14035 | Open file (Filename = 'DEBUG.EXE')
2018-12-17T22:59:46.481162281Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:46.484755201Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:46.488281502Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:46.491456293Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:46.494525033Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:46.498107922Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:46.501127125Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:46.505049705Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:46.508598978Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:46.519682263Z 62 PC: 14085 | Close file
2018-12-17T22:59:46.523181012Z 61 PC: 14035 | Open file (Filename = 'DEBUG.EXE')
2018-12-17T22:59:46.533862873Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:46.536657916Z 62 PC: 14085 | Close file
2018-12-17T22:59:46.545106624Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:46.558369091Z 26 PC: 136d1 | Set disk transfer address
2018-12-17T22:59:46.560996915Z 79 PC: 136d6 | Find next file
2018-12-17T22:59:46.56754302Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:46.576093591Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:46.589056851Z 61 PC: 14035 | Open file (Filename = 'EXPAND.EXE')
2018-12-17T22:59:46.600359392Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:46.602828291Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:46.605294913Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:46.609482946Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:46.612013923Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:46.614658994Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:46.61821725Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:46.621211153Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:46.623965684Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:46.635765903Z 66 PC: 14167 | Move file pointer
2018-12-17T22:59:46.638533052Z 64 PC: 14108 | Write file or device (Write 6256 bytes on handle 5)
2018-12-17T22:59:46.648693852Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:46.652387903Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:46.655348784Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:46.658685933Z 66 PC: 14167 | Move file pointer
2018-12-17T22:59:46.663883175Z 64 PC: 14108 | Write file or device (Write 6256 bytes on handle 5)
2018-12-17T22:59:46.676147107Z 62 PC: 14085 | Close file
2018-12-17T22:59:46.686465211Z 61 PC: 14035 | Open file (Filename = 'EXPAND.EXE')
2018-12-17T22:59:46.696967837Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:46.700137905Z 62 PC: 14085 | Close file
2018-12-17T22:59:46.709271257Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:46.722196025Z 14 PC: 142dd | Set default drive (Drive = 'C')
2018-12-17T22:59:46.724738904Z 25 PC: 142e1 | Get default drive
2018-12-17T22:59:46.727068184Z 59 PC: 1434b | Change current directory
2018-12-17T22:59:46.736015713Z 26 PC: 136ad | Set disk transfer address
2018-12-17T22:59:46.738685774Z 78 PC: 136b9 | Find first file
2018-12-17T22:59:46.748174363Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:46.756419309Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:46.769090573Z 61 PC: 14035 | Open file (Filename = 'ATTRIB.EXE')
2018-12-17T22:59:46.779078732Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:46.781508203Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:46.783965711Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:46.787511525Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:46.790148512Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:46.793002084Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:46.797009016Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:46.800276717Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:46.803328021Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:46.815448764Z 62 PC: 14085 | Close file
2018-12-17T22:59:46.818935667Z 61 PC: 14035 | Open file (Filename = 'ATTRIB.EXE')
2018-12-17T22:59:46.828727593Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:46.832572947Z 62 PC: 14085 | Close file
2018-12-17T22:59:46.841912414Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:46.85570013Z 26 PC: 136d1 | Set disk transfer address
2018-12-17T22:59:46.857726901Z 79 PC: 136d6 | Find next file
2018-12-17T22:59:46.862824752Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:46.872692487Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:46.885565724Z 61 PC: 14035 | Open file (Filename = 'CHKDSK.EXE')
2018-12-17T22:59:46.895449606Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:46.899527132Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:46.902951967Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:46.906425198Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:46.910585177Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:46.91327165Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:46.915961057Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:46.920454331Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:46.924062388Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:46.936987956Z 62 PC: 14085 | Close file
2018-12-17T22:59:46.941289271Z 61 PC: 14035 | Open file (Filename = 'CHKDSK.EXE')
2018-12-17T22:59:46.950557947Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:46.953308023Z 62 PC: 14085 | Close file
2018-12-17T22:59:46.962130876Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:46.97471253Z 26 PC: 136d1 | Set disk transfer address
2018-12-17T22:59:46.976848063Z 79 PC: 136d6 | Find next file
2018-12-17T22:59:46.982446661Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:46.99043639Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:47.002938098Z 61 PC: 14035 | Open file (Filename = 'DEBUG.EXE')
2018-12-17T22:59:47.013261026Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:47.016070225Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:47.020028363Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:47.022524999Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:47.025041029Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:47.029046833Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:47.032022912Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:47.035391869Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:47.040231976Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:47.059187666Z 62 PC: 14085 | Close file
2018-12-17T22:59:47.062473106Z 61 PC: 14035 | Open file (Filename = 'DEBUG.EXE')
2018-12-17T22:59:47.079391028Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:47.082296226Z 62 PC: 14085 | Close file
2018-12-17T22:59:47.090334474Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:47.103861436Z 26 PC: 136d1 | Set disk transfer address
2018-12-17T22:59:47.106419855Z 79 PC: 136d6 | Find next file
2018-12-17T22:59:47.111790589Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:47.121444452Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:47.134670365Z 61 PC: 14035 | Open file (Filename = 'EXPAND.EXE')
2018-12-17T22:59:47.144662301Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:47.149073831Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:47.152134058Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:47.155518962Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:47.159743151Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:47.162924076Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:47.167559966Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:47.171013709Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:47.17405243Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:47.189215024Z 62 PC: 14085 | Close file
2018-12-17T22:59:47.192791139Z 61 PC: 14035 | Open file (Filename = 'EXPAND.EXE')
2018-12-17T22:59:47.203976574Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:47.209122831Z 62 PC: 14085 | Close file
2018-12-17T22:59:47.214382433Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:47.2263175Z 26 PC: 136d1 | Set disk transfer address
2018-12-17T22:59:47.229777193Z 79 PC: 136d6 | Find next file
2018-12-17T22:59:47.235296835Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:47.244068323Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:47.257045543Z 61 PC: 14035 | Open file (Filename = 'FDISK.EXE')
2018-12-17T22:59:47.262891439Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:47.265099133Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:47.267275599Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:47.269090297Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:47.271398866Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:47.273148296Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:47.274929998Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:47.277330237Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:47.279067188Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:47.285412443Z 66 PC: 14167 | Move file pointer
2018-12-17T22:59:47.28780067Z 64 PC: 14108 | Write file or device (Write 6256 bytes on handle 5)
2018-12-17T22:59:47.294098906Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:47.296745714Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:47.299466097Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:47.302254388Z 66 PC: 14167 | Move file pointer
2018-12-17T22:59:47.305671391Z 64 PC: 14108 | Write file or device (Write 6256 bytes on handle 5)
2018-12-17T22:59:47.31771917Z 62 PC: 14085 | Close file
2018-12-17T22:59:47.32522303Z 61 PC: 14035 | Open file (Filename = 'FDISK.EXE')
2018-12-17T22:59:47.334981536Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:47.337694325Z 62 PC: 14085 | Close file
2018-12-17T22:59:47.345677374Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:47.362278916Z 14 PC: 142dd | Set default drive (Drive = 'C')
2018-12-17T22:59:47.365499967Z 25 PC: 142e1 | Get default drive
2018-12-17T22:59:47.367722201Z 59 PC: 1434b | Change current directory
2018-12-17T22:59:47.377161986Z 26 PC: 136ad | Set disk transfer address
2018-12-17T22:59:47.379338666Z 78 PC: 136b9 | Find first file
2018-12-17T22:59:47.388533258Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:47.397964714Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:47.410827013Z 61 PC: 14035 | Open file (Filename = 'ATTRIB.EXE')
2018-12-17T22:59:47.421153777Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:47.424100798Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:47.427004143Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:47.4308153Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:47.433806866Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:47.436876843Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:47.440480944Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:47.443424268Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:47.446967371Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:47.458608733Z 62 PC: 14085 | Close file
2018-12-17T22:59:47.462022136Z 61 PC: 14035 | Open file (Filename = 'ATTRIB.EXE')
2018-12-17T22:59:47.471745018Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:47.475266853Z 62 PC: 14085 | Close file
2018-12-17T22:59:47.483371662Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:47.496868497Z 26 PC: 136d1 | Set disk transfer address
2018-12-17T22:59:47.499043341Z 79 PC: 136d6 | Find next file
2018-12-17T22:59:47.504524021Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:47.514129502Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:47.527548515Z 61 PC: 14035 | Open file (Filename = 'CHKDSK.EXE')
2018-12-17T22:59:47.536698567Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:47.540385493Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:47.543649022Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:47.547268283Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:47.55133705Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:47.554312778Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:47.55734406Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:47.561813262Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:47.564909233Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:47.575213159Z 62 PC: 14085 | Close file
2018-12-17T22:59:47.578984146Z 61 PC: 14035 | Open file (Filename = 'CHKDSK.EXE')
2018-12-17T22:59:47.587712431Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:47.590540122Z 62 PC: 14085 | Close file
2018-12-17T22:59:47.598626442Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:47.611442506Z 26 PC: 136d1 | Set disk transfer address
2018-12-17T22:59:47.614416575Z 79 PC: 136d6 | Find next file
2018-12-17T22:59:47.619542377Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:47.627692486Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:47.640451843Z 61 PC: 14035 | Open file (Filename = 'DEBUG.EXE')
2018-12-17T22:59:47.649824028Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:47.652471704Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:47.656369796Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:47.659219819Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:47.662337033Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:47.666224975Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:47.669222Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:47.673379942Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:47.676898964Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:47.687272914Z 62 PC: 14085 | Close file
2018-12-17T22:59:47.691635804Z 61 PC: 14035 | Open file (Filename = 'DEBUG.EXE')
2018-12-17T22:59:47.700976424Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:47.704056207Z 62 PC: 14085 | Close file
2018-12-17T22:59:47.71296725Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:47.726237583Z 26 PC: 136d1 | Set disk transfer address
2018-12-17T22:59:47.729705539Z 79 PC: 136d6 | Find next file
2018-12-17T22:59:47.734799073Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:47.743642706Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:47.758895381Z 61 PC: 14035 | Open file (Filename = 'EXPAND.EXE')
2018-12-17T22:59:47.768472165Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:47.771110412Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:47.774946645Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:47.777949787Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:47.782565285Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:47.785538229Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:47.788173299Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:47.791957566Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:47.794489447Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:47.804043983Z 62 PC: 14085 | Close file
2018-12-17T22:59:47.809996113Z 61 PC: 14035 | Open file (Filename = 'EXPAND.EXE')
2018-12-17T22:59:47.820325261Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:47.824887987Z 62 PC: 14085 | Close file
2018-12-17T22:59:47.833779954Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:47.846102349Z 26 PC: 136d1 | Set disk transfer address
2018-12-17T22:59:47.849182501Z 79 PC: 136d6 | Find next file
2018-12-17T22:59:47.854330562Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:47.862627966Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:47.875144713Z 61 PC: 14035 | Open file (Filename = 'FDISK.EXE')
2018-12-17T22:59:47.883722142Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:47.886572379Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:47.889106308Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:47.892001651Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:47.896053774Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:47.898827974Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:47.901579549Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:47.904470151Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:47.907248375Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:47.918625111Z 62 PC: 14085 | Close file
2018-12-17T22:59:47.922321746Z 61 PC: 14035 | Open file (Filename = 'FDISK.EXE')
2018-12-17T22:59:47.931750505Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:47.935833626Z 62 PC: 14085 | Close file
2018-12-17T22:59:47.944204115Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:47.956694551Z 26 PC: 136d1 | Set disk transfer address
2018-12-17T22:59:47.959697652Z 79 PC: 136d6 | Find next file
2018-12-17T22:59:47.964692533Z 67 PC: 1360f | Get or set file attributes
2018-12-17T22:59:47.973639933Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:47.986252472Z 61 PC: 14035 | Open file (Filename = 'MEM.EXE')
2018-12-17T22:59:47.994638079Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:47.997211614Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:48.006447309Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:48.009223446Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:48.012478417Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:48.015181658Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:48.01859643Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:48.020599664Z 87 PC: 13650 | Get or set file date and time
2018-12-17T22:59:48.022347531Z 63 PC: 14108 | Read file or device (Read 6256 bytes on handle 5)
2018-12-17T22:59:48.031637659Z 66 PC: 14167 | Move file pointer
2018-12-17T22:59:48.033304003Z 64 PC: 14108 | Write file or device (Write 6256 bytes on handle 5)
2018-12-17T22:59:48.039946934Z 66 PC: 14880 | Move file pointer
2018-12-17T22:59:48.042241857Z 66 PC: 1488e | Move file pointer
2018-12-17T22:59:48.043862358Z 66 PC: 1489c | Move file pointer
2018-12-17T22:59:48.046628182Z 66 PC: 14167 | Move file pointer
2018-12-17T22:59:48.04847009Z 64 PC: 14108 | Write file or device (Write 6256 bytes on handle 5)
2018-12-17T22:59:48.055651134Z 62 PC: 14085 | Close file
2018-12-17T22:59:48.062619504Z 61 PC: 14035 | Open file (Filename = 'MEM.EXE')
2018-12-17T22:59:48.068088532Z 87 PC: 1367d | Get or set file date and time
2018-12-17T22:59:48.069923055Z 62 PC: 14085 | Close file
2018-12-17T22:59:48.075432801Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:48.088845761Z 48 PC: 141f7 | Get DOS version
2018-12-17T22:59:48.092718699Z 67 PC: 13636 | Get or set file attributes
2018-12-17T22:59:48.109144239Z 14 PC: 142dd | Set default drive (Drive = 'A')
2018-12-17T22:59:48.111733467Z 25 PC: 142e1 | Get default drive
2018-12-17T22:59:48.113563643Z 59 PC: 1434b | Change current directory
2018-12-17T22:59:48.119144447Z 64 PC: 13d8d | Write file or device (Write 0 bytes on handle 1)
2018-12-17T22:59:48.121930464Z 37 PC: 13b21 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:59:48.124028492Z 37 PC: 13b21 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T22:59:48.126129254Z 37 PC: 13b21 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T22:59:48.129169298Z 37 PC: 13b21 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T22:59:48.131007088Z 37 PC: 13b21 | Set interrupt vector (Interrupt = '244' AKA 'UNKNOWN!')
2018-12-17T22:59:48.132521028Z 37 PC: 13b21 | Set interrupt vector (Interrupt = '187' AKA 'UNKNOWN!')
2018-12-17T22:59:48.134709867Z 37 PC: 13b21 | Set interrupt vector (Interrupt = '160' AKA 'UNKNOWN!')
2018-12-17T22:59:48.136289955Z 37 PC: 13b21 | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:59:48.138016674Z 37 PC: 13b21 | Set interrupt vector (Interrupt = '112' AKA 'UNKNOWN!')
2018-12-17T22:59:48.14023393Z 37 PC: 13b21 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T22:59:48.141238482Z 37 PC: 13b21 | Set interrupt vector (Interrupt = '38' AKA 'Create PSP')
2018-12-17T22:59:48.143426795Z 37 PC: 13b21 | Set interrupt vector (Interrupt = '198' AKA 'UNKNOWN!')
2018-12-17T22:59:48.144936752Z 37 PC: 13b21 | Set interrupt vector (Interrupt = '7' AKA 'Direct console input without echo')
2018-12-17T22:59:48.146073436Z 37 PC: 13b21 | Set interrupt vector (Interrupt = '1' AKA 'Character input')
2018-12-17T22:59:48.148234315Z 37 PC: 13b21 | Set interrupt vector (Interrupt = '51' AKA 'Get or set Ctrl-Break')
2018-12-17T22:59:48.149291188Z 37 PC: 13b21 | Set interrupt vector (Interrupt = '237' AKA 'UNKNOWN!')
2018-12-17T22:59:48.151577034Z 37 PC: 13b21 | Set interrupt vector (Interrupt = '124' AKA 'UNKNOWN!')
2018-12-17T22:59:48.152687993Z 37 PC: 13b21 | Set interrupt vector (Interrupt = '190' AKA 'UNKNOWN!')
2018-12-17T22:59:48.154270443Z 37 PC: 13b21 | Set interrupt vector (Interrupt = '190' AKA 'UNKNOWN!')
2018-12-17T22:59:48.156593894Z 76 PC: 13b60 | Terminate with return code (Return code = '0')