Sample viewer

vx.netlux.org/Virus.DOS.HLLC.Eagle.8001

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:03:53.089936773Z 53 PC: 136f2 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:53.091975217Z 53 PC: 136f2 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:53.093389668Z 53 PC: 136f2 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:53.094723026Z 53 PC: 136f2 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:53.096241673Z 53 PC: 136f2 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:53.098017494Z 53 PC: 136f2 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:53.0994883Z 53 PC: 136f2 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:53.101064866Z 53 PC: 136f2 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:53.103366847Z 53 PC: 136f2 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:53.104908807Z 53 PC: 136f2 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:53.10651059Z 53 PC: 136f2 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:53.108686995Z 53 PC: 136f2 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:53.11044396Z 53 PC: 136f2 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:53.11220877Z 53 PC: 136f2 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:53.114611319Z 53 PC: 136f2 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:53.116219895Z 53 PC: 136f2 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:53.118385649Z 53 PC: 136f2 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:53.121298518Z 53 PC: 136f2 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:53.124135675Z 53 PC: 136f2 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:53.125244882Z 37 PC: 13707 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:53.127323141Z 37 PC: 1370f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:53.1306184Z 37 PC: 13717 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:53.132389722Z 37 PC: 1371f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:53.135203836Z 68 PC: 13abb | I/O control for devices (Set for = '')
2018-12-17T23:03:53.194552768Z 37 PC: 12f15 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:53.195814261Z 44 PC: 149d1 | Get time 0x149d1: mov word ptr [0x3e], cx
0x149d5: mov word ptr [0x40], dx
0x149d9: retf
0x149da: mov bx, sp
0x149dc: push ds
0x149dd: les di, ptr ss:[bx + 8]
0x149e1: lds si, ptr ss:[bx + 4]
0x149e5: cld
0x149e6: xor ax, ax
0x149e8: stosw word ptr es:[di], ax
0x149e9: mov ax, 0xd7b0
0x149ec: stosw word ptr es:[di], ax
0x149ed: xor ax, ax
0x149ef: mov cx, 0x16
0x149f2: rep stosd dword ptr es:[di], eax
0x149f4: lodsb al, byte ptr [si]
0x149f5: mov cl, 0x4f
0x149f7: cmp al, cl
0x149f9: ja 0x149fd
0x149fb: mov cl, al
2018-12-17T23:03:53.19778567Z 48 PC: 14b9b | Get DOS version
2018-12-17T23:03:53.199372946Z 61 PC: 14a4f | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:53.205208724Z 63 PC: 14b22 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:53.212246753Z 62 PC: 14a9f | Close file
2018-12-17T23:03:53.214767415Z 26 PC: 13507 | Set disk transfer address
2018-12-17T23:03:53.215797854Z 78 PC: 13513 | Find first file
2018-12-17T23:03:53.221221206Z 26 PC: 13507 | Set disk transfer address
2018-12-17T23:03:53.223279147Z 78 PC: 13513 | Find first file
2018-12-17T23:03:53.228572704Z 60 PC: 14a4f | Create or truncate file
2018-12-17T23:03:53.246208881Z 64 PC: 14b22 | Write file or device (Write 8001 bytes on handle 5)
2018-12-17T23:03:53.25815383Z 62 PC: 14a9f | Close file
2018-12-17T23:03:53.267989202Z 67 PC: 134d6 | Get or set file attributes
2018-12-17T23:03:53.279833923Z 26 PC: 1352b | Set disk transfer address
2018-12-17T23:03:53.282412785Z 79 PC: 13530 | Find next file
2018-12-17T23:03:53.2911502Z 48 PC: 14b9b | Get DOS version
2018-12-17T23:03:53.29320723Z 53 PC: 1356e | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:53.295939459Z 37 PC: 13577 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:53.297927589Z 53 PC: 1356e | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:53.299651472Z 37 PC: 13577 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:53.301959143Z 53 PC: 1356e | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:53.30417938Z 37 PC: 13577 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:53.305978615Z 53 PC: 1356e | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:53.307793869Z 37 PC: 13577 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:53.310073087Z 53 PC: 1356e | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:53.311762675Z 37 PC: 13577 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:53.314148183Z 53 PC: 1356e | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:53.316260176Z 37 PC: 13577 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:53.317938643Z 53 PC: 1356e | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:53.319223711Z 37 PC: 13577 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:53.321365079Z 53 PC: 1356e | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:53.323081778Z 37 PC: 13577 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:53.325521597Z 53 PC: 1356e | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:53.328050655Z 37 PC: 13577 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:53.32958961Z 53 PC: 1356e | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:53.331071808Z 37 PC: 13577 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:53.333681818Z 53 PC: 1356e | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:53.335514225Z 37 PC: 13577 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:53.337065964Z 53 PC: 1356e | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:53.339686644Z 37 PC: 13577 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:53.341031223Z 53 PC: 1356e | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:53.342706044Z 37 PC: 13577 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:53.344132627Z 53 PC: 1356e | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:53.346312598Z 37 PC: 13577 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:53.34792953Z 53 PC: 1356e | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:53.349377965Z 37 PC: 13577 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:53.352812886Z 53 PC: 1356e | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:53.354923216Z 37 PC: 13577 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:53.357138332Z 53 PC: 1356e | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:53.360184462Z 37 PC: 13577 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:53.361419265Z 53 PC: 1356e | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:53.362713199Z 37 PC: 13577 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:53.364280217Z 53 PC: 1356e | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:53.36598805Z 37 PC: 13577 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:53.367671857Z 41 PC: 135f7 | Parse filename
2018-12-17T23:03:53.369715011Z 41 PC: 13605 | Parse filename
2018-12-17T23:03:53.371731374Z 75 PC: 13610 | Execute program
2018-12-17T23:03:53.388295914Z 53 PC: 19842 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:53.390343917Z 53 PC: 19842 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:53.392840903Z 53 PC: 19842 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:53.394103268Z 53 PC: 19842 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:53.395548587Z 53 PC: 19842 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:53.397689584Z 53 PC: 19842 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:53.399230042Z 53 PC: 19842 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:53.400795256Z 53 PC: 19842 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:53.403417599Z 53 PC: 19842 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:53.404753883Z 53 PC: 19842 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:53.406072263Z 53 PC: 19842 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:53.408692833Z 53 PC: 19842 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:53.410382982Z 53 PC: 19842 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:53.412055849Z 53 PC: 19842 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:53.421355734Z 53 PC: 19842 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:53.423068636Z 53 PC: 19842 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:53.424621597Z 53 PC: 19842 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:53.427027763Z 53 PC: 19842 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:53.428978763Z 53 PC: 19842 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:53.430573643Z 37 PC: 19857 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:53.432088082Z 37 PC: 1985f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:53.434397987Z 37 PC: 19867 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:53.435617822Z 37 PC: 1986f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:53.437322829Z 68 PC: 19c0b | I/O control for devices (Set for = '')
2018-12-17T23:03:53.507288303Z 37 PC: 19065 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:53.509213765Z 44 PC: 1ab21 | Get time 0x1ab21: mov word ptr [0x3e], cx
0x1ab25: mov word ptr [0x40], dx
0x1ab29: retf
0x1ab2a: mov bx, sp
0x1ab2c: push ds
0x1ab2d: les di, ptr ss:[bx + 8]
0x1ab31: lds si, ptr ss:[bx + 4]
0x1ab35: cld
0x1ab36: xor ax, ax
0x1ab38: stosw word ptr es:[di], ax
0x1ab39: mov ax, 0xd7b0
0x1ab3c: stosw word ptr es:[di], ax
0x1ab3d: xor ax, ax
0x1ab3f: mov cx, 0x16
0x1ab42: rep stosd dword ptr es:[di], eax
0x1ab44: lodsb al, byte ptr [si]
0x1ab45: mov cl, 0x4f
0x1ab47: cmp al, cl
0x1ab49: ja 0x1ab4d
0x1ab4b: mov cl, al
2018-12-17T23:03:53.511867387Z 48 PC: 1aceb | Get DOS version
2018-12-17T23:03:53.514575131Z 61 PC: 1ab9f | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:53.522672804Z 63 PC: 1ac72 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:53.531316573Z 62 PC: 1abef | Close file
2018-12-17T23:03:53.534555747Z 26 PC: 19657 | Set disk transfer address
2018-12-17T23:03:53.539002862Z 78 PC: 19663 | Find first file
2018-12-17T23:03:53.547430206Z 26 PC: 19657 | Set disk transfer address
2018-12-17T23:03:53.54895317Z 78 PC: 19663 | Find first file
2018-12-17T23:03:53.556925828Z 26 PC: 1967b | Set disk transfer address
2018-12-17T23:03:53.558137507Z 79 PC: 19680 | Find next file
2018-12-17T23:03:53.563696073Z 48 PC: 1aceb | Get DOS version
2018-12-17T23:03:53.566764365Z 53 PC: 196be | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:53.56806947Z 37 PC: 196c7 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:53.569314402Z 53 PC: 196be | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:53.571424341Z 37 PC: 196c7 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:53.572710681Z 53 PC: 196be | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:53.573990729Z 37 PC: 196c7 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:53.576123872Z 53 PC: 196be | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:53.577391406Z 37 PC: 196c7 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:53.578626219Z 53 PC: 196be | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:53.580794348Z 37 PC: 196c7 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:53.582017298Z 53 PC: 196be | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:53.583266799Z 37 PC: 196c7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:53.585252775Z 53 PC: 196be | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:53.586815254Z 37 PC: 196c7 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:53.587976919Z 53 PC: 196be | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:53.589310378Z 37 PC: 196c7 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:53.590731801Z 53 PC: 196be | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:53.591987724Z 37 PC: 196c7 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:53.593664878Z 53 PC: 196be | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:53.595250341Z 37 PC: 196c7 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:53.596366069Z 53 PC: 196be | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:53.598077349Z 37 PC: 196c7 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:53.599536844Z 53 PC: 196be | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:53.601062815Z 37 PC: 196c7 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:53.602747654Z 53 PC: 196be | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:53.606036521Z 37 PC: 196c7 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:53.607749143Z 53 PC: 196be | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:53.609710933Z 37 PC: 196c7 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:53.613647258Z 53 PC: 196be | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:53.614980155Z 37 PC: 196c7 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:53.616454479Z 53 PC: 196be | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:53.622733721Z 37 PC: 196c7 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:53.624157008Z 53 PC: 196be | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:53.625623377Z 37 PC: 196c7 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:53.629315221Z 53 PC: 196be | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:53.630698603Z 37 PC: 196c7 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:53.631987408Z 53 PC: 196be | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:53.633964527Z 37 PC: 196c7 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:53.635409355Z 41 PC: 19747 | Parse filename
2018-12-17T23:03:53.6370496Z 41 PC: 19755 | Parse filename
2018-12-17T23:03:53.639730403Z 75 PC: 19760 | Execute program
2018-12-17T23:03:53.658585803Z 53 PC: 1f992 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:53.659980777Z 53 PC: 1f992 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:53.662093781Z 53 PC: 1f992 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:53.663819107Z 53 PC: 1f992 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:53.665547038Z 53 PC: 1f992 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:53.667978762Z 53 PC: 1f992 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:53.669612796Z 53 PC: 1f992 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:53.671213247Z 53 PC: 1f992 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:53.673703241Z 53 PC: 1f992 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:53.675126618Z 53 PC: 1f992 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:53.676409852Z 53 PC: 1f992 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:53.678936946Z 53 PC: 1f992 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:53.680648015Z 53 PC: 1f992 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:53.682339096Z 53 PC: 1f992 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:53.687866654Z 53 PC: 1f992 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:53.689604864Z 53 PC: 1f992 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:53.691097662Z 53 PC: 1f992 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:53.6930845Z 53 PC: 1f992 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:53.694478983Z 53 PC: 1f992 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:53.695844521Z 37 PC: 1f9a7 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:53.697740958Z 37 PC: 1f9af | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:53.699479749Z 37 PC: 1f9b7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:53.70083053Z 37 PC: 1f9bf | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:53.70290911Z 68 PC: 1fd5b | I/O control for devices (Set for = '')
2018-12-17T23:03:53.736486864Z 37 PC: 1f1b5 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:53.738713202Z 44 PC: 20c71 | Get time 0x20c71: mov word ptr [0x3e], cx
0x20c75: mov word ptr [0x40], dx
0x20c79: retf
0x20c7a: mov bx, sp
0x20c7c: push ds
0x20c7d: les di, ptr ss:[bx + 8]
0x20c81: lds si, ptr ss:[bx + 4]
0x20c85: cld
0x20c86: xor ax, ax
0x20c88: stosw word ptr es:[di], ax
0x20c89: mov ax, 0xd7b0
0x20c8c: stosw word ptr es:[di], ax
0x20c8d: xor ax, ax
0x20c8f: mov cx, 0x16
0x20c92: rep stosd dword ptr es:[di], eax
0x20c94: lodsb al, byte ptr [si]
0x20c95: mov cl, 0x4f
0x20c97: cmp al, cl
0x20c99: ja 0x20c9d
0x20c9b: mov cl, al
2018-12-17T23:03:53.741727884Z 48 PC: 20e3b | Get DOS version
2018-12-17T23:03:53.745269436Z 61 PC: 20cef | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:53.756319092Z 63 PC: 20dc2 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:53.766919853Z 62 PC: 20d3f | Close file
2018-12-17T23:03:53.770472185Z 26 PC: 1f7a7 | Set disk transfer address
2018-12-17T23:03:53.772560884Z 78 PC: 1f7b3 | Find first file
2018-12-17T23:03:53.78091533Z 26 PC: 1f7a7 | Set disk transfer address
2018-12-17T23:03:53.78346675Z 78 PC: 1f7b3 | Find first file
2018-12-17T23:03:53.790747426Z 26 PC: 1f7cb | Set disk transfer address
2018-12-17T23:03:53.792239613Z 79 PC: 1f7d0 | Find next file
2018-12-17T23:03:53.797190656Z 48 PC: 20e3b | Get DOS version
2018-12-17T23:03:53.799721757Z 53 PC: 1f80e | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:53.801303793Z 37 PC: 1f817 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:53.804783258Z 53 PC: 1f80e | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:53.806276798Z 37 PC: 1f817 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:53.808751864Z 53 PC: 1f80e | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:53.811464958Z 37 PC: 1f817 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:53.813039139Z 53 PC: 1f80e | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:53.81504374Z 37 PC: 1f817 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:53.817744911Z 53 PC: 1f80e | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:53.819899775Z 37 PC: 1f817 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:53.821577772Z 53 PC: 1f80e | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:53.824286748Z 37 PC: 1f817 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:53.826219764Z 53 PC: 1f80e | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:53.827547631Z 37 PC: 1f817 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:53.830006647Z 53 PC: 1f80e | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:53.831517599Z 37 PC: 1f817 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:53.832621926Z 53 PC: 1f80e | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:53.834685438Z 37 PC: 1f817 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:53.835919309Z 53 PC: 1f80e | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:53.837618826Z 37 PC: 1f817 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:53.840450483Z 53 PC: 1f80e | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:53.842831081Z 37 PC: 1f817 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:53.845851313Z 53 PC: 1f80e | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:53.847341135Z 37 PC: 1f817 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:53.849423192Z 53 PC: 1f80e | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:53.850592311Z 37 PC: 1f817 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:53.851690978Z 53 PC: 1f80e | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:53.854899835Z 37 PC: 1f817 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:53.856489134Z 53 PC: 1f80e | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:53.857912261Z 37 PC: 1f817 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:53.860118872Z 53 PC: 1f80e | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:53.862155443Z 37 PC: 1f817 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:53.863550066Z 53 PC: 1f80e | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:53.865703086Z 37 PC: 1f817 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:53.867252371Z 53 PC: 1f80e | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:53.868844145Z 37 PC: 1f817 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:53.871174008Z 53 PC: 1f80e | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:53.872626941Z 37 PC: 1f817 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:53.874303815Z 41 PC: 1f897 | Parse filename
2018-12-17T23:03:53.876461635Z 41 PC: 1f8a5 | Parse filename
2018-12-17T23:03:53.878178424Z 75 PC: 1f8b0 | Execute program
2018-12-17T23:03:53.894674375Z 53 PC: 25ae2 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:53.896677864Z 53 PC: 25ae2 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:53.898793293Z 53 PC: 25ae2 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:53.90015244Z 53 PC: 25ae2 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:53.902595766Z 53 PC: 25ae2 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:53.904024804Z 53 PC: 25ae2 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:53.905385835Z 53 PC: 25ae2 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:53.907452813Z 53 PC: 25ae2 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:53.908767235Z 53 PC: 25ae2 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:53.910042715Z 53 PC: 25ae2 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:53.912026557Z 53 PC: 25ae2 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:53.913363742Z 53 PC: 25ae2 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:53.914686811Z 53 PC: 25ae2 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:53.916742288Z 53 PC: 25ae2 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:53.918035991Z 53 PC: 25ae2 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:53.919258311Z 53 PC: 25ae2 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:53.921203119Z 53 PC: 25ae2 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:53.922704494Z 53 PC: 25ae2 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:53.924000111Z 53 PC: 25ae2 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:53.926031322Z 37 PC: 25af7 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:53.927356625Z 37 PC: 25aff | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:53.928640751Z 37 PC: 25b07 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:53.931345388Z 37 PC: 25b0f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:53.933073108Z 68 PC: 25eab | I/O control for devices (Set for = '')
2018-12-17T23:03:54.021253436Z 37 PC: 25305 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:54.02382321Z 44 PC: 26dc1 | Get time 0x26dc1: mov word ptr [0x3e], cx
0x26dc5: mov word ptr [0x40], dx
0x26dc9: retf
0x26dca: mov bx, sp
0x26dcc: push ds
0x26dcd: les di, ptr ss:[bx + 8]
0x26dd1: lds si, ptr ss:[bx + 4]
0x26dd5: cld
0x26dd6: xor ax, ax
0x26dd8: stosw word ptr es:[di], ax
0x26dd9: mov ax, 0xd7b0
0x26ddc: stosw word ptr es:[di], ax
0x26ddd: xor ax, ax
0x26ddf: mov cx, 0x16
0x26de2: rep stosd dword ptr es:[di], eax
0x26de4: lodsb al, byte ptr [si]
0x26de5: mov cl, 0x4f
0x26de7: cmp al, cl
0x26de9: ja 0x26ded
0x26deb: mov cl, al
2018-12-17T23:03:54.026282997Z 48 PC: 26f8b | Get DOS version
2018-12-17T23:03:54.02858626Z 61 PC: 26e3f | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:54.036737022Z 63 PC: 26f12 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:54.04507609Z 62 PC: 26e8f | Close file
2018-12-17T23:03:54.047468901Z 26 PC: 258f7 | Set disk transfer address
2018-12-17T23:03:54.049773476Z 78 PC: 25903 | Find first file
2018-12-17T23:03:54.057523133Z 26 PC: 258f7 | Set disk transfer address
2018-12-17T23:03:54.059025159Z 78 PC: 25903 | Find first file
2018-12-17T23:03:54.066629935Z 26 PC: 2591b | Set disk transfer address
2018-12-17T23:03:54.068373625Z 79 PC: 25920 | Find next file
2018-12-17T23:03:54.071742252Z 48 PC: 26f8b | Get DOS version
2018-12-17T23:03:54.074754298Z 53 PC: 2595e | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:54.076328799Z 37 PC: 25967 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:54.077869838Z 53 PC: 2595e | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:54.079896851Z 37 PC: 25967 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:54.08150697Z 53 PC: 2595e | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:54.082731092Z 37 PC: 25967 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:54.084590621Z 53 PC: 2595e | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:54.086106101Z 37 PC: 25967 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:54.087638704Z 53 PC: 2595e | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:54.0900604Z 37 PC: 25967 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:54.091616828Z 53 PC: 2595e | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:54.092689706Z 37 PC: 25967 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:54.09455223Z 53 PC: 2595e | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:54.095765612Z 37 PC: 25967 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:54.096985237Z 53 PC: 2595e | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:54.099121034Z 37 PC: 25967 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:54.100413846Z 53 PC: 2595e | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:54.10176085Z 37 PC: 25967 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:54.104399473Z 53 PC: 2595e | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:54.105943478Z 37 PC: 25967 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:54.108020445Z 53 PC: 2595e | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:54.110695527Z 37 PC: 25967 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:54.112312679Z 53 PC: 2595e | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:54.11366328Z 37 PC: 25967 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:54.116602268Z 53 PC: 2595e | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:54.117778882Z 37 PC: 25967 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:54.118989108Z 53 PC: 2595e | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:54.120814242Z 37 PC: 25967 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:54.122263939Z 53 PC: 2595e | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:54.123574504Z 37 PC: 25967 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:54.125409055Z 53 PC: 2595e | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:54.126668063Z 37 PC: 25967 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:54.128094316Z 53 PC: 2595e | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:54.130069421Z 37 PC: 25967 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:54.131309524Z 53 PC: 2595e | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:54.133110953Z 37 PC: 25967 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:54.135057865Z 53 PC: 2595e | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:54.136350136Z 37 PC: 25967 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:54.137939446Z 41 PC: 259e7 | Parse filename
2018-12-17T23:03:54.140271092Z 41 PC: 259f5 | Parse filename
2018-12-17T23:03:54.141672829Z 75 PC: 25a00 | Execute program
2018-12-17T23:03:54.156762494Z 53 PC: 2bc32 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:54.15830718Z 53 PC: 2bc32 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:54.159672007Z 53 PC: 2bc32 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:54.162212286Z 53 PC: 2bc32 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:54.164064871Z 53 PC: 2bc32 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:54.165305004Z 53 PC: 2bc32 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:54.167499131Z 53 PC: 2bc32 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:54.169791423Z 53 PC: 2bc32 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:54.171622518Z 53 PC: 2bc32 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:54.17346299Z 53 PC: 2bc32 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:54.176397551Z 53 PC: 2bc32 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:54.178219828Z 53 PC: 2bc32 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:54.180488015Z 53 PC: 2bc32 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:54.18253743Z 53 PC: 2bc32 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:54.184258998Z 53 PC: 2bc32 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:54.187019231Z 53 PC: 2bc32 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:54.18865596Z 53 PC: 2bc32 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:54.190311985Z 53 PC: 2bc32 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:54.193143421Z 53 PC: 2bc32 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:54.194798074Z 37 PC: 2bc47 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:54.197679895Z 37 PC: 2bc4f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:54.200636787Z 37 PC: 2bc57 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:54.204523889Z 37 PC: 2bc5f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:54.206743714Z 68 PC: 2bffb | I/O control for devices (Set for = '')
2018-12-17T23:03:54.319166255Z 37 PC: 2b455 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:54.321391831Z 44 PC: 2cf11 | Get time 0x2cf11: mov word ptr [0x3e], cx
0x2cf15: mov word ptr [0x40], dx
0x2cf19: retf
0x2cf1a: mov bx, sp
0x2cf1c: push ds
0x2cf1d: les di, ptr ss:[bx + 8]
0x2cf21: lds si, ptr ss:[bx + 4]
0x2cf25: cld
0x2cf26: xor ax, ax
0x2cf28: stosw word ptr es:[di], ax
0x2cf29: mov ax, 0xd7b0
0x2cf2c: stosw word ptr es:[di], ax
0x2cf2d: xor ax, ax
0x2cf2f: mov cx, 0x16
0x2cf32: rep stosd dword ptr es:[di], eax
0x2cf34: lodsb al, byte ptr [si]
0x2cf35: mov cl, 0x4f
0x2cf37: cmp al, cl
0x2cf39: ja 0x2cf3d
0x2cf3b: mov cl, al
2018-12-17T23:03:54.324145181Z 48 PC: 2d0db | Get DOS version
2018-12-17T23:03:54.326965156Z 61 PC: 2cf8f | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:54.334923997Z 63 PC: 2d062 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:54.343566484Z 62 PC: 2cfdf | Close file
2018-12-17T23:03:54.346963735Z 26 PC: 2ba47 | Set disk transfer address
2018-12-17T23:03:54.348839804Z 78 PC: 2ba53 | Find first file
2018-12-17T23:03:54.356330435Z 26 PC: 2ba47 | Set disk transfer address
2018-12-17T23:03:54.358654266Z 78 PC: 2ba53 | Find first file
2018-12-17T23:03:54.364300838Z 26 PC: 2ba6b | Set disk transfer address
2018-12-17T23:03:54.365325726Z 79 PC: 2ba70 | Find next file
2018-12-17T23:03:54.368265857Z 48 PC: 2d0db | Get DOS version
2018-12-17T23:03:54.369834798Z 53 PC: 2baae | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:54.370944536Z 37 PC: 2bab7 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:54.373152008Z 53 PC: 2baae | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:54.374230687Z 37 PC: 2bab7 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:54.37521028Z 53 PC: 2baae | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:54.377230911Z 37 PC: 2bab7 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:54.37839946Z 53 PC: 2baae | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:54.379618914Z 37 PC: 2bab7 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:54.381908891Z 53 PC: 2baae | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:54.383036212Z 37 PC: 2bab7 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:54.384367005Z 53 PC: 2baae | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:54.386442308Z 37 PC: 2bab7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:54.388119213Z 53 PC: 2baae | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:54.389413868Z 37 PC: 2bab7 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:54.39398104Z 53 PC: 2baae | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:54.396380764Z 37 PC: 2bab7 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:54.399837517Z 53 PC: 2baae | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:54.401716912Z 37 PC: 2bab7 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:54.403365714Z 53 PC: 2baae | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:54.405816424Z 37 PC: 2bab7 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:54.407445729Z 53 PC: 2baae | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:54.40901491Z 37 PC: 2bab7 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:54.411366534Z 53 PC: 2baae | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:54.412662983Z 37 PC: 2bab7 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:54.414435307Z 53 PC: 2baae | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:54.417381309Z 37 PC: 2bab7 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:54.419046782Z 53 PC: 2baae | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:54.420742742Z 37 PC: 2bab7 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:54.42989058Z 53 PC: 2baae | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:54.431606458Z 37 PC: 2bab7 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:54.433293842Z 53 PC: 2baae | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:54.436105Z 37 PC: 2bab7 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:54.43773188Z 53 PC: 2baae | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:54.439361836Z 37 PC: 2bab7 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:54.442100188Z 53 PC: 2baae | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:54.443722509Z 37 PC: 2bab7 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:54.445316558Z 53 PC: 2baae | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:54.447940574Z 37 PC: 2bab7 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:54.455013149Z 41 PC: 2bb37 | Parse filename
2018-12-17T23:03:54.458509736Z 41 PC: 2bb45 | Parse filename
2018-12-17T23:03:54.462830744Z 75 PC: 2bb50 | Execute program
2018-12-17T23:03:54.489215266Z 53 PC: 31d82 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:54.491172879Z 53 PC: 31d82 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:54.495997395Z 53 PC: 31d82 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:54.498160474Z 53 PC: 31d82 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:54.500346356Z 53 PC: 31d82 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:54.503192319Z 53 PC: 31d82 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:54.505325863Z 53 PC: 31d82 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:54.507689829Z 53 PC: 31d82 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:54.510905368Z 53 PC: 31d82 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:54.512896203Z 53 PC: 31d82 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:54.515314552Z 53 PC: 31d82 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:54.518497249Z 53 PC: 31d82 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:54.521085198Z 53 PC: 31d82 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:54.523120266Z 53 PC: 31d82 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:54.526045459Z 53 PC: 31d82 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:54.528185304Z 53 PC: 31d82 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:54.531293361Z 53 PC: 31d82 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:54.533534036Z 53 PC: 31d82 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:54.535244884Z 53 PC: 31d82 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:54.53774681Z 37 PC: 31d97 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:54.53944272Z 37 PC: 31d9f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:54.540983649Z 37 PC: 31da7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:54.543409833Z 37 PC: 31daf | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:54.545759513Z 68 PC: 3214b | I/O control for devices (Set for = '')
2018-12-17T23:03:54.603970996Z 37 PC: 315a5 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:54.607174252Z 44 PC: 33061 | Get time 0x33061: mov word ptr [0x3e], cx
0x33065: mov word ptr [0x40], dx
0x33069: retf
0x3306a: mov bx, sp
0x3306c: push ds
0x3306d: les di, ptr ss:[bx + 8]
0x33071: lds si, ptr ss:[bx + 4]
0x33075: cld
0x33076: xor ax, ax
0x33078: stosw word ptr es:[di], ax
0x33079: mov ax, 0xd7b0
0x3307c: stosw word ptr es:[di], ax
0x3307d: xor ax, ax
0x3307f: mov cx, 0x16
0x33082: rep stosd dword ptr es:[di], eax
0x33084: lodsb al, byte ptr [si]
0x33085: mov cl, 0x4f
0x33087: cmp al, cl
0x33089: ja 0x3308d
0x3308b: mov cl, al
2018-12-17T23:03:54.609643346Z 48 PC: 3322b | Get DOS version
2018-12-17T23:03:54.612458311Z 61 PC: 330df | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:54.620481494Z 63 PC: 331b2 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:54.630923567Z 62 PC: 3312f | Close file
2018-12-17T23:03:54.633499262Z 26 PC: 31b97 | Set disk transfer address
2018-12-17T23:03:54.636335046Z 78 PC: 31ba3 | Find first file
2018-12-17T23:03:54.642440751Z 26 PC: 31b97 | Set disk transfer address
2018-12-17T23:03:54.643961482Z 78 PC: 31ba3 | Find first file
2018-12-17T23:03:54.65148215Z 26 PC: 31bbb | Set disk transfer address
2018-12-17T23:03:54.652800049Z 79 PC: 31bc0 | Find next file
2018-12-17T23:03:54.656829719Z 48 PC: 3322b | Get DOS version
2018-12-17T23:03:54.660172608Z 53 PC: 31bfe | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:54.662161589Z 37 PC: 31c07 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:54.663837762Z 53 PC: 31bfe | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:54.665767822Z 37 PC: 31c07 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:54.667227759Z 53 PC: 31bfe | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:54.669260162Z 37 PC: 31c07 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:54.670906118Z 53 PC: 31bfe | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:54.672458719Z 37 PC: 31c07 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:54.674953602Z 53 PC: 31bfe | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:54.677093628Z 37 PC: 31c07 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:54.678814455Z 53 PC: 31bfe | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:54.681277318Z 37 PC: 31c07 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:54.683458721Z 53 PC: 31bfe | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:54.684980414Z 37 PC: 31c07 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:54.687428328Z 53 PC: 31bfe | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:54.689419464Z 37 PC: 31c07 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:54.690951345Z 53 PC: 31bfe | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:54.693458922Z 37 PC: 31c07 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:54.695351903Z 53 PC: 31bfe | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:54.697085996Z 37 PC: 31c07 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:54.700278241Z 53 PC: 31bfe | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:54.701965414Z 37 PC: 31c07 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:54.703516282Z 53 PC: 31bfe | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:54.705905296Z 37 PC: 31c07 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:54.708226663Z 53 PC: 31bfe | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:54.709898257Z 37 PC: 31c07 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:54.718264324Z 53 PC: 31bfe | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:54.719905942Z 37 PC: 31c07 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:54.722241566Z 53 PC: 31bfe | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:54.724451784Z 37 PC: 31c07 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:54.726129009Z 53 PC: 31bfe | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:54.728623431Z 37 PC: 31c07 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:54.730370187Z 53 PC: 31bfe | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:54.732084983Z 37 PC: 31c07 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:54.734509634Z 53 PC: 31bfe | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:54.73597968Z 37 PC: 31c07 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:54.737449555Z 53 PC: 31bfe | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:54.741689209Z 37 PC: 31c07 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:54.74328962Z 41 PC: 31c87 | Parse filename
2018-12-17T23:03:54.745236392Z 41 PC: 31c95 | Parse filename
2018-12-17T23:03:54.747602543Z 75 PC: 31ca0 | Execute program
2018-12-17T23:03:54.764052728Z 53 PC: 37ed2 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:54.766171683Z 53 PC: 37ed2 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:54.768017155Z 53 PC: 37ed2 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:54.769748272Z 53 PC: 37ed2 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:54.772415279Z 53 PC: 37ed2 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:54.774030026Z 53 PC: 37ed2 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:54.775448214Z 53 PC: 37ed2 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:54.777826308Z 53 PC: 37ed2 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:54.779217364Z 53 PC: 37ed2 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:54.780415468Z 53 PC: 37ed2 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:54.782820382Z 53 PC: 37ed2 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:54.784230375Z 53 PC: 37ed2 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:54.785460098Z 53 PC: 37ed2 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:54.786928681Z 53 PC: 37ed2 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:54.788169645Z 53 PC: 37ed2 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:54.790515918Z 53 PC: 37ed2 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:54.79187793Z 53 PC: 37ed2 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:54.793093557Z 53 PC: 37ed2 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:54.795372965Z 53 PC: 37ed2 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:54.796709218Z 37 PC: 37ee7 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:54.798013191Z 37 PC: 37eef | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:54.801236855Z 37 PC: 37ef7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:54.802672246Z 37 PC: 37eff | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:54.805459389Z 68 PC: 3829b | I/O control for devices (Set for = '')
2018-12-17T23:03:54.900422235Z 37 PC: 376f5 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:54.902232069Z 44 PC: 391b1 | Get time 0x391b1: mov word ptr [0x3e], cx
0x391b5: mov word ptr [0x40], dx
0x391b9: retf
0x391ba: mov bx, sp
0x391bc: push ds
0x391bd: les di, ptr ss:[bx + 8]
0x391c1: lds si, ptr ss:[bx + 4]
0x391c5: cld
0x391c6: xor ax, ax
0x391c8: stosw word ptr es:[di], ax
0x391c9: mov ax, 0xd7b0
0x391cc: stosw word ptr es:[di], ax
0x391cd: xor ax, ax
0x391cf: mov cx, 0x16
0x391d2: rep stosd dword ptr es:[di], eax
0x391d4: lodsb al, byte ptr [si]
0x391d5: mov cl, 0x4f
0x391d7: cmp al, cl
0x391d9: ja 0x391dd
0x391db: mov cl, al
2018-12-17T23:03:54.904707346Z 48 PC: 3937b | Get DOS version
2018-12-17T23:03:54.90738888Z 61 PC: 3922f | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:54.91473586Z 63 PC: 39302 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:54.92363487Z 62 PC: 3927f | Close file
2018-12-17T23:03:54.926664149Z 26 PC: 37ce7 | Set disk transfer address
2018-12-17T23:03:54.927948274Z 78 PC: 37cf3 | Find first file
2018-12-17T23:03:54.935325502Z 26 PC: 37ce7 | Set disk transfer address
2018-12-17T23:03:54.937807731Z 78 PC: 37cf3 | Find first file
2018-12-17T23:03:54.944414309Z 26 PC: 37d0b | Set disk transfer address
2018-12-17T23:03:54.947194188Z 79 PC: 37d10 | Find next file
2018-12-17T23:03:54.950349804Z 48 PC: 3937b | Get DOS version
2018-12-17T23:03:54.953462369Z 53 PC: 37d4e | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:54.957254653Z 37 PC: 37d57 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:54.958951676Z 53 PC: 37d4e | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:54.960618812Z 37 PC: 37d57 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:54.963341894Z 53 PC: 37d4e | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:54.965006656Z 37 PC: 37d57 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:54.966620271Z 53 PC: 37d4e | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:54.969584527Z 37 PC: 37d57 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:54.97123415Z 53 PC: 37d4e | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:54.9728983Z 37 PC: 37d57 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:54.975244875Z 53 PC: 37d4e | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:54.976615042Z 37 PC: 37d57 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:54.977924285Z 53 PC: 37d4e | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:54.980185368Z 37 PC: 37d57 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:54.981454506Z 53 PC: 37d4e | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:54.982997569Z 37 PC: 37d57 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:54.985372506Z 53 PC: 37d4e | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:54.987026728Z 37 PC: 37d57 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:54.98960087Z 53 PC: 37d4e | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:54.99083919Z 37 PC: 37d57 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:54.992118025Z 53 PC: 37d4e | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:54.994564577Z 37 PC: 37d57 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:54.995907143Z 53 PC: 37d4e | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:54.997237064Z 37 PC: 37d57 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:54.99974361Z 53 PC: 37d4e | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:55.001623205Z 37 PC: 37d57 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:55.003417891Z 53 PC: 37d4e | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:55.018531441Z 37 PC: 37d57 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:55.020222793Z 53 PC: 37d4e | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:55.021982844Z 37 PC: 37d57 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:55.024923165Z 53 PC: 37d4e | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:55.026771051Z 37 PC: 37d57 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:55.028569184Z 53 PC: 37d4e | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:55.031298107Z 37 PC: 37d57 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:55.033109525Z 53 PC: 37d4e | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:55.035767284Z 37 PC: 37d57 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:55.037873626Z 53 PC: 37d4e | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:55.039530773Z 37 PC: 37d57 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:55.042972818Z 41 PC: 37dd7 | Parse filename
2018-12-17T23:03:55.045320936Z 41 PC: 37de5 | Parse filename
2018-12-17T23:03:55.047308434Z 75 PC: 37df0 | Execute program
2018-12-17T23:03:55.065266125Z 53 PC: 3e022 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:55.067298217Z 53 PC: 3e022 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:55.068975583Z 53 PC: 3e022 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:55.071748098Z 53 PC: 3e022 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:55.073403632Z 53 PC: 3e022 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:55.075266457Z 53 PC: 3e022 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:55.077894781Z 53 PC: 3e022 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:55.07940959Z 53 PC: 3e022 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:55.081850241Z 53 PC: 3e022 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:55.083459418Z 53 PC: 3e022 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:55.084866475Z 53 PC: 3e022 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:55.087420339Z 53 PC: 3e022 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:55.08880814Z 53 PC: 3e022 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:55.090352174Z 53 PC: 3e022 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:55.093958759Z 53 PC: 3e022 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:55.096396014Z 53 PC: 3e022 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:55.098123042Z 53 PC: 3e022 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:55.100521484Z 53 PC: 3e022 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:55.101941625Z 53 PC: 3e022 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:55.104577694Z 37 PC: 3e037 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:55.105960395Z 37 PC: 3e03f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:55.107469273Z 37 PC: 3e047 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:55.110155707Z 37 PC: 3e04f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:55.112128258Z 68 PC: 3e3eb | I/O control for devices (Set for = '')
2018-12-17T23:03:55.185500047Z 37 PC: 3d845 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:55.18805292Z 44 PC: 3f301 | Get time 0x3f301: mov word ptr [0x3e], cx
0x3f305: mov word ptr [0x40], dx
0x3f309: retf
0x3f30a: mov bx, sp
0x3f30c: push ds
0x3f30d: les di, ptr ss:[bx + 8]
0x3f311: lds si, ptr ss:[bx + 4]
0x3f315: cld
0x3f316: xor ax, ax
0x3f318: stosw word ptr es:[di], ax
0x3f319: mov ax, 0xd7b0
0x3f31c: stosw word ptr es:[di], ax
0x3f31d: xor ax, ax
0x3f31f: mov cx, 0x16
0x3f322: rep stosd dword ptr es:[di], eax
0x3f324: lodsb al, byte ptr [si]
0x3f325: mov cl, 0x4f
0x3f327: cmp al, cl
0x3f329: ja 0x3f32d
0x3f32b: mov cl, al
2018-12-17T23:03:55.19183288Z 48 PC: 3f4cb | Get DOS version
2018-12-17T23:03:55.194523502Z 61 PC: 3f37f | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:55.202453028Z 63 PC: 3f452 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:55.212458089Z 62 PC: 3f3cf | Close file
2018-12-17T23:03:55.215709275Z 26 PC: 3de37 | Set disk transfer address
2018-12-17T23:03:55.217129667Z 78 PC: 3de43 | Find first file
2018-12-17T23:03:55.225294665Z 26 PC: 3de37 | Set disk transfer address
2018-12-17T23:03:55.22740769Z 78 PC: 3de43 | Find first file
2018-12-17T23:03:55.234444397Z 26 PC: 3de5b | Set disk transfer address
2018-12-17T23:03:55.236918031Z 79 PC: 3de60 | Find next file
2018-12-17T23:03:55.240436069Z 48 PC: 3f4cb | Get DOS version
2018-12-17T23:03:55.242971919Z 53 PC: 3de9e | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:55.245491017Z 37 PC: 3dea7 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:55.247152312Z 53 PC: 3de9e | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:55.248746491Z 37 PC: 3dea7 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:55.25235545Z 53 PC: 3de9e | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:55.254322941Z 37 PC: 3dea7 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:55.256184843Z 53 PC: 3de9e | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:55.260423006Z 37 PC: 3dea7 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:55.262358296Z 53 PC: 3de9e | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:55.265244325Z 37 PC: 3dea7 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:55.267551285Z 53 PC: 3de9e | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:55.269981787Z 37 PC: 3dea7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:55.272746678Z 53 PC: 3de9e | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:55.274834726Z 37 PC: 3dea7 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:55.276543971Z 53 PC: 3de9e | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:55.279330683Z 37 PC: 3dea7 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:55.28092365Z 53 PC: 3de9e | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:55.282810199Z 37 PC: 3dea7 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:55.288643301Z 53 PC: 3de9e | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:55.290222522Z 37 PC: 3dea7 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:55.292525925Z 53 PC: 3de9e | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:55.294342873Z 37 PC: 3dea7 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:55.295937963Z 53 PC: 3de9e | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:55.298558242Z 37 PC: 3dea7 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:55.300645489Z 53 PC: 3de9e | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:55.302332622Z 37 PC: 3dea7 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:55.305301917Z 53 PC: 3de9e | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:55.306974945Z 37 PC: 3dea7 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:55.308799827Z 53 PC: 3de9e | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:55.311588804Z 37 PC: 3dea7 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:55.31315504Z 53 PC: 3de9e | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:55.315725556Z 37 PC: 3dea7 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:55.317718605Z 53 PC: 3de9e | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:55.319332762Z 37 PC: 3dea7 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:55.321903167Z 53 PC: 3de9e | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:55.324477749Z 37 PC: 3dea7 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:55.32612634Z 53 PC: 3de9e | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:55.329042676Z 37 PC: 3dea7 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:55.33083088Z 41 PC: 3df27 | Parse filename
2018-12-17T23:03:55.332896045Z 41 PC: 3df35 | Parse filename
2018-12-17T23:03:55.335808023Z 75 PC: 3df40 | Execute program
2018-12-17T23:03:55.361715017Z 53 PC: 44172 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:55.366888849Z 53 PC: 44172 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:55.370014659Z 53 PC: 44172 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:55.371639916Z 53 PC: 44172 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:55.374636864Z 53 PC: 44172 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:55.37622383Z 53 PC: 44172 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:55.378089699Z 53 PC: 44172 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:55.381221952Z 53 PC: 44172 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:55.38286921Z 53 PC: 44172 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:55.385402595Z 53 PC: 44172 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:55.386940669Z 53 PC: 44172 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:55.388425301Z 53 PC: 44172 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:55.390760174Z 53 PC: 44172 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:55.392005226Z 53 PC: 44172 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:55.39388424Z 53 PC: 44172 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:55.39577093Z 53 PC: 44172 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:55.396961569Z 53 PC: 44172 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:55.399900318Z 53 PC: 44172 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:55.401407333Z 53 PC: 44172 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:55.40350054Z 37 PC: 44187 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:55.40595177Z 37 PC: 4418f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:55.407192354Z 37 PC: 44197 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:55.408441304Z 37 PC: 4419f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:55.411445285Z 68 PC: 4453b | I/O control for devices (Set for = '')
2018-12-17T23:03:55.490744104Z 37 PC: 43995 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:55.493555893Z 44 PC: 45451 | Get time 0x45451: mov word ptr [0x3e], cx
0x45455: mov word ptr [0x40], dx
0x45459: retf
0x4545a: mov bx, sp
0x4545c: push ds
0x4545d: les di, ptr ss:[bx + 8]
0x45461: lds si, ptr ss:[bx + 4]
0x45465: cld
0x45466: xor ax, ax
0x45468: stosw word ptr es:[di], ax
0x45469: mov ax, 0xd7b0
0x4546c: stosw word ptr es:[di], ax
0x4546d: xor ax, ax
0x4546f: mov cx, 0x16
0x45472: rep stosd dword ptr es:[di], eax
0x45474: lodsb al, byte ptr [si]
0x45475: mov cl, 0x4f
0x45477: cmp al, cl
0x45479: ja 0x4547d
0x4547b: mov cl, al
2018-12-17T23:03:55.496197242Z 48 PC: 4561b | Get DOS version
2018-12-17T23:03:55.497921295Z 61 PC: 454cf | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:55.506255453Z 63 PC: 455a2 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:55.515070254Z 62 PC: 4551f | Close file
2018-12-17T23:03:55.518210992Z 26 PC: 43f87 | Set disk transfer address
2018-12-17T23:03:55.520068136Z 78 PC: 43f93 | Find first file
2018-12-17T23:03:55.527391071Z 26 PC: 43f87 | Set disk transfer address
2018-12-17T23:03:55.530066123Z 78 PC: 43f93 | Find first file
2018-12-17T23:03:55.537572794Z 26 PC: 43fab | Set disk transfer address
2018-12-17T23:03:55.539189415Z 79 PC: 43fb0 | Find next file
2018-12-17T23:03:55.543106153Z 48 PC: 4561b | Get DOS version
2018-12-17T23:03:55.545807795Z 53 PC: 43fee | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:55.54878738Z 37 PC: 43ff7 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:55.550872191Z 53 PC: 43fee | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:55.552698617Z 37 PC: 43ff7 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:55.55561321Z 53 PC: 43fee | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:55.557731525Z 37 PC: 43ff7 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:55.559584591Z 53 PC: 43fee | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:55.562260605Z 37 PC: 43ff7 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:55.563998053Z 53 PC: 43fee | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:55.566845409Z 37 PC: 43ff7 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:55.56973277Z 53 PC: 43fee | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:55.571262327Z 37 PC: 43ff7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:55.575663727Z 53 PC: 43fee | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:55.576992226Z 37 PC: 43ff7 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:55.578507376Z 53 PC: 43fee | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:55.580788367Z 37 PC: 43ff7 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:55.582056172Z 53 PC: 43fee | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:55.584387007Z 37 PC: 43ff7 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:55.585815935Z 53 PC: 43fee | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:55.587254441Z 37 PC: 43ff7 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:55.589631523Z 53 PC: 43fee | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:55.591147494Z 37 PC: 43ff7 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:55.593434957Z 53 PC: 43fee | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:55.594884032Z 37 PC: 43ff7 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:55.596213694Z 53 PC: 43fee | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:55.598960822Z 37 PC: 43ff7 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:55.600715392Z 53 PC: 43fee | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:55.60314342Z 37 PC: 43ff7 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:55.605709457Z 53 PC: 43fee | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:55.60738023Z 37 PC: 43ff7 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:55.611299953Z 53 PC: 43fee | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:55.617216192Z 37 PC: 43ff7 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:55.619470392Z 53 PC: 43fee | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:55.62170697Z 37 PC: 43ff7 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:55.623396257Z 53 PC: 43fee | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:55.626317833Z 37 PC: 43ff7 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:55.627864182Z 53 PC: 43fee | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:55.629201308Z 37 PC: 43ff7 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:55.63178648Z 41 PC: 44077 | Parse filename
2018-12-17T23:03:55.633413901Z 41 PC: 44085 | Parse filename
2018-12-17T23:03:55.636173522Z 75 PC: 44090 | Execute program
2018-12-17T23:03:55.653621724Z 53 PC: 4a2c2 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:55.654938672Z 53 PC: 4a2c2 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:55.657303851Z 53 PC: 4a2c2 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:55.65897816Z 53 PC: 4a2c2 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:55.660788386Z 53 PC: 4a2c2 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:55.662732964Z 53 PC: 4a2c2 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:55.664905841Z 53 PC: 4a2c2 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:55.667238509Z 53 PC: 4a2c2 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:55.668656848Z 53 PC: 4a2c2 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:55.669915044Z 53 PC: 4a2c2 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:55.672162432Z 53 PC: 4a2c2 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:55.673604344Z 53 PC: 4a2c2 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:55.675836893Z 53 PC: 4a2c2 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:55.677444437Z 53 PC: 4a2c2 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:55.679038476Z 53 PC: 4a2c2 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:55.681505757Z 53 PC: 4a2c2 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:55.682785615Z 53 PC: 4a2c2 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:55.685136157Z 53 PC: 4a2c2 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:55.686549756Z 53 PC: 4a2c2 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:55.688134798Z 37 PC: 4a2d7 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:55.690525635Z 37 PC: 4a2df | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:55.691839646Z 37 PC: 4a2e7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:55.694306887Z 37 PC: 4a2ef | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:55.696617073Z 68 PC: 4a68b | I/O control for devices (Set for = '')
2018-12-17T23:03:55.791550664Z 37 PC: 49ae5 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:55.794249601Z 44 PC: 4b5a1 | Get time 0x4b5a1: mov word ptr [0x3e], cx
0x4b5a5: mov word ptr [0x40], dx
0x4b5a9: retf
0x4b5aa: mov bx, sp
0x4b5ac: push ds
0x4b5ad: les di, ptr ss:[bx + 8]
0x4b5b1: lds si, ptr ss:[bx + 4]
0x4b5b5: cld
0x4b5b6: xor ax, ax
0x4b5b8: stosw word ptr es:[di], ax
0x4b5b9: mov ax, 0xd7b0
0x4b5bc: stosw word ptr es:[di], ax
0x4b5bd: xor ax, ax
0x4b5bf: mov cx, 0x16
0x4b5c2: rep stosd dword ptr es:[di], eax
0x4b5c4: lodsb al, byte ptr [si]
0x4b5c5: mov cl, 0x4f
0x4b5c7: cmp al, cl
0x4b5c9: ja 0x4b5cd
0x4b5cb: mov cl, al
2018-12-17T23:03:55.796666347Z 48 PC: 4b76b | Get DOS version
2018-12-17T23:03:55.798585507Z 61 PC: 4b61f | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:55.806406309Z 63 PC: 4b6f2 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:55.814555759Z 62 PC: 4b66f | Close file
2018-12-17T23:03:55.817641894Z 26 PC: 4a0d7 | Set disk transfer address
2018-12-17T23:03:55.819241583Z 78 PC: 4a0e3 | Find first file
2018-12-17T23:03:55.826687149Z 26 PC: 4a0d7 | Set disk transfer address
2018-12-17T23:03:55.828897277Z 78 PC: 4a0e3 | Find first file
2018-12-17T23:03:55.835615524Z 26 PC: 4a0fb | Set disk transfer address
2018-12-17T23:03:55.838094597Z 79 PC: 4a100 | Find next file
2018-12-17T23:03:55.841776784Z 48 PC: 4b76b | Get DOS version
2018-12-17T23:03:55.844056543Z 53 PC: 4a13e | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:55.846682132Z 37 PC: 4a147 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:55.848132009Z 53 PC: 4a13e | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:55.851091847Z 37 PC: 4a147 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:55.852469258Z 53 PC: 4a13e | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:55.853861948Z 37 PC: 4a147 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:55.856569902Z 53 PC: 4a13e | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:55.857995223Z 37 PC: 4a147 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:55.859357565Z 53 PC: 4a13e | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:55.861816922Z 37 PC: 4a147 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:55.863145942Z 53 PC: 4a13e | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:55.865724342Z 37 PC: 4a147 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:55.867547181Z 53 PC: 4a13e | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:55.869179362Z 37 PC: 4a147 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:55.871465342Z 53 PC: 4a13e | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:55.873147076Z 37 PC: 4a147 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:55.87518555Z 53 PC: 4a13e | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:55.876879456Z 37 PC: 4a147 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:55.878495556Z 53 PC: 4a13e | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:55.881663255Z 37 PC: 4a147 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:55.883337675Z 53 PC: 4a13e | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:55.885900075Z 37 PC: 4a147 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:55.887287234Z 53 PC: 4a13e | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:55.888558596Z 37 PC: 4a147 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:55.890871467Z 53 PC: 4a13e | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:55.892195387Z 37 PC: 4a147 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:55.893406546Z 53 PC: 4a13e | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:55.895943387Z 37 PC: 4a147 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:55.897321139Z 53 PC: 4a13e | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:55.900999689Z 37 PC: 4a147 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:55.902492186Z 53 PC: 4a13e | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:55.904140918Z 37 PC: 4a147 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:55.906707726Z 53 PC: 4a13e | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:55.908473027Z 37 PC: 4a147 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:55.911582717Z 53 PC: 4a13e | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:55.913405496Z 37 PC: 4a147 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:55.915016727Z 53 PC: 4a13e | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:55.91774076Z 37 PC: 4a147 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:55.919464353Z 41 PC: 4a1c7 | Parse filename
2018-12-17T23:03:55.922351113Z 41 PC: 4a1d5 | Parse filename
2018-12-17T23:03:55.924095334Z 75 PC: 4a1e0 | Execute program
2018-12-17T23:03:55.9414976Z 53 PC: 50412 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:55.943950153Z 53 PC: 50412 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:55.945493466Z 53 PC: 50412 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:55.947126188Z 53 PC: 50412 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:55.948630728Z 53 PC: 50412 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:55.950695352Z 53 PC: 50412 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:55.953086109Z 53 PC: 50412 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:55.954800565Z 53 PC: 50412 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:55.957452072Z 53 PC: 50412 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:55.958869579Z 53 PC: 50412 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:55.960222854Z 53 PC: 50412 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:55.962712808Z 53 PC: 50412 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:55.964152085Z 53 PC: 50412 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:55.965571796Z 53 PC: 50412 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:55.967212432Z 53 PC: 50412 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:55.968625581Z 53 PC: 50412 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:55.971241802Z 53 PC: 50412 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:55.973022061Z 53 PC: 50412 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:55.974819612Z 53 PC: 50412 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:55.977304968Z 37 PC: 50427 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:55.978675796Z 37 PC: 5042f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:55.981101719Z 37 PC: 50437 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:55.982546417Z 37 PC: 5043f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:55.984411586Z 68 PC: 507db | I/O control for devices (Set for = '')
2018-12-17T23:03:56.099990862Z 37 PC: 4fc35 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:56.102153991Z 44 PC: 516f1 | Get time 0x516f1: mov word ptr [0x3e], cx
0x516f5: mov word ptr [0x40], dx
0x516f9: retf
0x516fa: mov bx, sp
0x516fc: push ds
0x516fd: les di, ptr ss:[bx + 8]
0x51701: lds si, ptr ss:[bx + 4]
0x51705: cld
0x51706: xor ax, ax
0x51708: stosw word ptr es:[di], ax
0x51709: mov ax, 0xd7b0
0x5170c: stosw word ptr es:[di], ax
0x5170d: xor ax, ax
0x5170f: mov cx, 0x16
0x51712: rep stosd dword ptr es:[di], eax
0x51714: lodsb al, byte ptr [si]
0x51715: mov cl, 0x4f
0x51717: cmp al, cl
0x51719: ja 0x5171d
0x5171b: mov cl, al
2018-12-17T23:03:56.106300901Z 48 PC: 518bb | Get DOS version
2018-12-17T23:03:56.110182313Z 61 PC: 5176f | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:56.117708481Z 63 PC: 51842 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:56.130400445Z 62 PC: 517bf | Close file
2018-12-17T23:03:56.132680825Z 26 PC: 50227 | Set disk transfer address
2018-12-17T23:03:56.134823225Z 78 PC: 50233 | Find first file
2018-12-17T23:03:56.142618979Z 26 PC: 50227 | Set disk transfer address
2018-12-17T23:03:56.144157463Z 78 PC: 50233 | Find first file
2018-12-17T23:03:56.15154495Z 26 PC: 5024b | Set disk transfer address
2018-12-17T23:03:56.154512483Z 79 PC: 50250 | Find next file
2018-12-17T23:03:56.160069946Z 48 PC: 518bb | Get DOS version
2018-12-17T23:03:56.165374375Z 53 PC: 5028e | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:56.166954547Z 37 PC: 50297 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:56.169937869Z 53 PC: 5028e | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:56.171999527Z 37 PC: 50297 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:56.173582615Z 53 PC: 5028e | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:56.177858358Z 37 PC: 50297 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:56.179416068Z 53 PC: 5028e | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:56.182111529Z 37 PC: 50297 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:56.183675481Z 53 PC: 5028e | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:56.185160064Z 37 PC: 50297 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:56.188453639Z 53 PC: 5028e | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:56.189839766Z 37 PC: 50297 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:56.193987609Z 53 PC: 5028e | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:56.196025001Z 37 PC: 50297 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:56.19785811Z 53 PC: 5028e | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:56.200991544Z 37 PC: 50297 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:56.20256792Z 53 PC: 5028e | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:56.206548477Z 37 PC: 50297 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:56.208313658Z 53 PC: 5028e | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:56.210529516Z 37 PC: 50297 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:56.212716289Z 53 PC: 5028e | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:56.215639719Z 37 PC: 50297 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:56.218781569Z 53 PC: 5028e | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:56.221014069Z 37 PC: 50297 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:56.223235888Z 53 PC: 5028e | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:56.235318957Z 37 PC: 50297 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:56.237250491Z 53 PC: 5028e | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:56.240565697Z 37 PC: 50297 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:56.242798607Z 53 PC: 5028e | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:56.246372811Z 37 PC: 50297 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:56.248509861Z 53 PC: 5028e | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:56.250538878Z 37 PC: 50297 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:56.252867598Z 53 PC: 5028e | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:56.25468118Z 37 PC: 50297 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:56.257870438Z 53 PC: 5028e | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:56.259725999Z 37 PC: 50297 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:56.261907342Z 53 PC: 5028e | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:56.264127429Z 37 PC: 50297 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:56.266087646Z 41 PC: 50317 | Parse filename
2018-12-17T23:03:56.269451194Z 41 PC: 50325 | Parse filename
2018-12-17T23:03:56.271748665Z 75 PC: 50330 | Execute program
2018-12-17T23:03:56.289418424Z 53 PC: 56562 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:56.293438425Z 53 PC: 56562 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:56.295262687Z 53 PC: 56562 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:56.298183902Z 53 PC: 56562 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:56.299649319Z 53 PC: 56562 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:56.30204178Z 53 PC: 56562 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:56.303739052Z 53 PC: 56562 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:56.305172289Z 53 PC: 56562 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:56.307914527Z 53 PC: 56562 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:56.309817316Z 53 PC: 56562 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:56.312927747Z 53 PC: 56562 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:56.314403413Z 53 PC: 56562 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:56.31599132Z 53 PC: 56562 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:56.319881478Z 53 PC: 56562 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:56.322640548Z 53 PC: 56562 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:56.326554651Z 53 PC: 56562 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:56.328400222Z 53 PC: 56562 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:56.330926254Z 53 PC: 56562 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:56.334272799Z 53 PC: 56562 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:56.336043009Z 37 PC: 56577 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:56.338510411Z 37 PC: 5657f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:56.339817459Z 37 PC: 56587 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:56.341100433Z 37 PC: 5658f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:56.343033218Z 68 PC: 5692b | I/O control for devices (Set for = '')
2018-12-17T23:03:56.388963187Z 37 PC: 55d85 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:56.394807351Z 44 PC: 57841 | Get time 0x57841: mov word ptr [0x3e], cx
0x57845: mov word ptr [0x40], dx
0x57849: retf
0x5784a: mov bx, sp
0x5784c: push ds
0x5784d: les di, ptr ss:[bx + 8]
0x57851: lds si, ptr ss:[bx + 4]
0x57855: cld
0x57856: xor ax, ax
0x57858: stosw word ptr es:[di], ax
0x57859: mov ax, 0xd7b0
0x5785c: stosw word ptr es:[di], ax
0x5785d: xor ax, ax
0x5785f: mov cx, 0x16
0x57862: rep stosd dword ptr es:[di], eax
0x57864: lodsb al, byte ptr [si]
0x57865: mov cl, 0x4f
0x57867: cmp al, cl
0x57869: ja 0x5786d
0x5786b: mov cl, al
2018-12-17T23:03:56.398149076Z 48 PC: 57a0b | Get DOS version
2018-12-17T23:03:56.403432776Z 61 PC: 578bf | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:56.411332376Z 63 PC: 57992 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:56.419940348Z 62 PC: 5790f | Close file
2018-12-17T23:03:56.423367746Z 26 PC: 56377 | Set disk transfer address
2018-12-17T23:03:56.42468302Z 78 PC: 56383 | Find first file
2018-12-17T23:03:56.433714799Z 26 PC: 56377 | Set disk transfer address
2018-12-17T23:03:56.435242944Z 78 PC: 56383 | Find first file
2018-12-17T23:03:56.442140098Z 26 PC: 5639b | Set disk transfer address
2018-12-17T23:03:56.44594204Z 79 PC: 563a0 | Find next file
2018-12-17T23:03:56.449130377Z 48 PC: 57a0b | Get DOS version
2018-12-17T23:03:56.452529892Z 53 PC: 563de | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:56.454079177Z 37 PC: 563e7 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:56.455576734Z 53 PC: 563de | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:56.458313733Z 37 PC: 563e7 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:56.459830826Z 53 PC: 563de | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:56.46266602Z 37 PC: 563e7 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:56.464177002Z 53 PC: 563de | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:56.46564906Z 37 PC: 563e7 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:56.468188357Z 53 PC: 563de | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:56.469761436Z 37 PC: 563e7 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:56.472098563Z 53 PC: 563de | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:56.473634472Z 37 PC: 563e7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:56.475086614Z 53 PC: 563de | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:56.477933329Z 37 PC: 563e7 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:56.479367827Z 53 PC: 563de | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:56.482387437Z 37 PC: 563e7 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:56.484479753Z 53 PC: 563de | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:56.485957413Z 37 PC: 563e7 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:56.488500046Z 53 PC: 563de | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:56.490117849Z 37 PC: 563e7 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:56.493061036Z 53 PC: 563de | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:56.495156527Z 37 PC: 563e7 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:56.497290641Z 53 PC: 563de | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:56.499720222Z 37 PC: 563e7 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:56.501421191Z 53 PC: 563de | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:56.504711531Z 37 PC: 563e7 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:56.506687498Z 53 PC: 563de | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:56.508308928Z 37 PC: 563e7 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:56.513264541Z 53 PC: 563de | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:56.518213179Z 37 PC: 563e7 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:56.521675542Z 53 PC: 563de | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:56.523552603Z 37 PC: 563e7 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:56.525316211Z 53 PC: 563de | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:56.528490241Z 37 PC: 563e7 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:56.530174971Z 53 PC: 563de | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:56.532983012Z 37 PC: 563e7 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:56.536098443Z 53 PC: 563de | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:56.538305995Z 37 PC: 563e7 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:56.543302615Z 41 PC: 56467 | Parse filename
2018-12-17T23:03:56.546133961Z 41 PC: 56475 | Parse filename
2018-12-17T23:03:56.548896297Z 75 PC: 56480 | Execute program
2018-12-17T23:03:56.56628114Z 53 PC: 5c6b2 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:56.569290911Z 53 PC: 5c6b2 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:56.570934052Z 53 PC: 5c6b2 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:56.57254878Z 53 PC: 5c6b2 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:56.575224854Z 53 PC: 5c6b2 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:56.576845933Z 53 PC: 5c6b2 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:56.579369721Z 53 PC: 5c6b2 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:56.580835488Z 53 PC: 5c6b2 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:56.582253596Z 53 PC: 5c6b2 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:56.584705908Z 53 PC: 5c6b2 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:56.586159072Z 53 PC: 5c6b2 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:56.588579605Z 53 PC: 5c6b2 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:56.596222052Z 53 PC: 5c6b2 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:56.597903194Z 53 PC: 5c6b2 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:56.600350597Z 53 PC: 5c6b2 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:56.602192242Z 53 PC: 5c6b2 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:56.605953417Z 53 PC: 5c6b2 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:56.607964149Z 53 PC: 5c6b2 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:56.611041639Z 53 PC: 5c6b2 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:56.612827688Z 37 PC: 5c6c7 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:56.614416838Z 37 PC: 5c6cf | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:56.617161831Z 37 PC: 5c6d7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:56.618743716Z 37 PC: 5c6df | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:56.621960989Z 68 PC: 5ca7b | I/O control for devices (Set for = '')
2018-12-17T23:03:56.700249498Z 37 PC: 5bed5 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:56.70222293Z 44 PC: 5d991 | Get time 0x5d991: mov word ptr [0x3e], cx
0x5d995: mov word ptr [0x40], dx
0x5d999: retf
0x5d99a: mov bx, sp
0x5d99c: push ds
0x5d99d: les di, ptr ss:[bx + 8]
0x5d9a1: lds si, ptr ss:[bx + 4]
0x5d9a5: cld
0x5d9a6: xor ax, ax
0x5d9a8: stosw word ptr es:[di], ax
0x5d9a9: mov ax, 0xd7b0
0x5d9ac: stosw word ptr es:[di], ax
0x5d9ad: xor ax, ax
0x5d9af: mov cx, 0x16
0x5d9b2: rep stosd dword ptr es:[di], eax
0x5d9b4: lodsb al, byte ptr [si]
0x5d9b5: mov cl, 0x4f
0x5d9b7: cmp al, cl
0x5d9b9: ja 0x5d9bd
0x5d9bb: mov cl, al
2018-12-17T23:03:56.705751096Z 48 PC: 5db5b | Get DOS version
2018-12-17T23:03:56.70807125Z 61 PC: 5da0f | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:56.717066221Z 63 PC: 5dae2 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:56.726462326Z 62 PC: 5da5f | Close file
2018-12-17T23:03:56.728976556Z 26 PC: 5c4c7 | Set disk transfer address
2018-12-17T23:03:56.731941563Z 78 PC: 5c4d3 | Find first file
2018-12-17T23:03:56.739577727Z 26 PC: 5c4c7 | Set disk transfer address
2018-12-17T23:03:56.742074865Z 78 PC: 5c4d3 | Find first file
2018-12-17T23:03:56.749115229Z 26 PC: 5c4eb | Set disk transfer address
2018-12-17T23:03:56.750499122Z 79 PC: 5c4f0 | Find next file
2018-12-17T23:03:56.754892356Z 48 PC: 5db5b | Get DOS version
2018-12-17T23:03:56.75709568Z 53 PC: 5c52e | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:56.759607736Z 37 PC: 5c537 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:56.761187087Z 53 PC: 5c52e | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:56.762501469Z 37 PC: 5c537 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:56.764132467Z 53 PC: 5c52e | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:56.765623071Z 37 PC: 5c537 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:56.767683137Z 53 PC: 5c52e | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:56.769106424Z 37 PC: 5c537 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:56.771037366Z 53 PC: 5c52e | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:56.772612048Z 37 PC: 5c537 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:56.774194164Z 53 PC: 5c52e | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:56.776965588Z 37 PC: 5c537 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:56.779356305Z 53 PC: 5c52e | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:56.781232925Z 37 PC: 5c537 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:56.782856539Z 53 PC: 5c52e | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:56.784235463Z 37 PC: 5c537 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:56.786284177Z 53 PC: 5c52e | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:56.787876953Z 37 PC: 5c537 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:56.790255838Z 53 PC: 5c52e | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:56.791723118Z 37 PC: 5c537 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:56.793982047Z 53 PC: 5c52e | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:56.795687295Z 37 PC: 5c537 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:56.797010344Z 53 PC: 5c52e | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:56.798758562Z 37 PC: 5c537 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:56.799980651Z 53 PC: 5c52e | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:56.801784805Z 37 PC: 5c537 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:56.802943755Z 53 PC: 5c52e | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:56.804507958Z 37 PC: 5c537 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:56.80596569Z 53 PC: 5c52e | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:56.807214068Z 37 PC: 5c537 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:56.809254286Z 53 PC: 5c52e | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:56.8105591Z 37 PC: 5c537 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:56.812519548Z 53 PC: 5c52e | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:56.813800508Z 37 PC: 5c537 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:56.815939732Z 53 PC: 5c52e | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:56.817987103Z 37 PC: 5c537 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:56.819146725Z 53 PC: 5c52e | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:56.820681412Z 37 PC: 5c537 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:56.822129015Z 41 PC: 5c5b7 | Parse filename
2018-12-17T23:03:56.824197626Z 41 PC: 5c5c5 | Parse filename
2018-12-17T23:03:56.825738213Z 75 PC: 5c5d0 | Execute program
2018-12-17T23:03:56.843982212Z 53 PC: 62802 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:56.845652414Z 53 PC: 62802 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:56.84728761Z 53 PC: 62802 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:56.849512506Z 53 PC: 62802 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:56.850743852Z 53 PC: 62802 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:56.852535162Z 53 PC: 62802 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:56.853791665Z 53 PC: 62802 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:56.855535505Z 53 PC: 62802 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:56.856812928Z 53 PC: 62802 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:56.8584885Z 53 PC: 62802 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:56.859807401Z 53 PC: 62802 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:56.861188619Z 53 PC: 62802 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:56.862889499Z 53 PC: 62802 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:56.864162954Z 53 PC: 62802 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:56.866046027Z 53 PC: 62802 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:56.867413439Z 53 PC: 62802 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:56.869321709Z 53 PC: 62802 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:56.870577732Z 53 PC: 62802 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:56.871837501Z 53 PC: 62802 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:56.874183414Z 37 PC: 62817 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:56.875247556Z 37 PC: 6281f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:56.876740694Z 37 PC: 62827 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:56.877725086Z 37 PC: 6282f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:56.880107097Z 68 PC: 62bcb | I/O control for devices (Set for = '')
2018-12-17T23:03:56.935530794Z 37 PC: 62025 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:56.938086713Z 44 PC: 63ae1 | Get time 0x63ae1: mov word ptr [0x3e], cx
0x63ae5: mov word ptr [0x40], dx
0x63ae9: retf
0x63aea: mov bx, sp
0x63aec: push ds
0x63aed: les di, ptr ss:[bx + 8]
0x63af1: lds si, ptr ss:[bx + 4]
0x63af5: cld
0x63af6: xor ax, ax
0x63af8: stosw word ptr es:[di], ax
0x63af9: mov ax, 0xd7b0
0x63afc: stosw word ptr es:[di], ax
0x63afd: xor ax, ax
0x63aff: mov cx, 0x16
0x63b02: rep stosd dword ptr es:[di], eax
0x63b04: lodsb al, byte ptr [si]
0x63b05: mov cl, 0x4f
0x63b07: cmp al, cl
0x63b09: ja 0x63b0d
0x63b0b: mov cl, al
2018-12-17T23:03:56.940561438Z 48 PC: 63cab | Get DOS version
2018-12-17T23:03:56.942363918Z 61 PC: 63b5f | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:56.950880899Z 63 PC: 63c32 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:56.959049876Z 62 PC: 63baf | Close file
2018-12-17T23:03:56.962641001Z 26 PC: 62617 | Set disk transfer address
2018-12-17T23:03:56.964119993Z 78 PC: 62623 | Find first file
2018-12-17T23:03:56.97212928Z 26 PC: 62617 | Set disk transfer address
2018-12-17T23:03:56.973557707Z 78 PC: 62623 | Find first file
2018-12-17T23:03:56.980006016Z 26 PC: 6263b | Set disk transfer address
2018-12-17T23:03:56.98267679Z 79 PC: 62640 | Find next file
2018-12-17T23:03:56.985793173Z 48 PC: 63cab | Get DOS version
2018-12-17T23:03:56.989012228Z 53 PC: 6267e | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:56.99039523Z 37 PC: 62687 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:56.99181459Z 53 PC: 6267e | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:56.993703924Z 37 PC: 62687 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:56.994877351Z 53 PC: 6267e | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:56.997127944Z 37 PC: 62687 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:56.998543447Z 53 PC: 6267e | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:57.000700445Z 37 PC: 62687 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:57.002125365Z 53 PC: 6267e | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:57.003710197Z 37 PC: 62687 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:57.005368426Z 53 PC: 6267e | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:57.00664099Z 37 PC: 62687 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:57.009112209Z 53 PC: 6267e | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:57.010476334Z 37 PC: 62687 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:57.019460745Z 53 PC: 6267e | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:57.02325412Z 37 PC: 62687 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:57.035506088Z 53 PC: 6267e | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:57.037280445Z 37 PC: 62687 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:57.038930279Z 53 PC: 6267e | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:57.041428227Z 37 PC: 62687 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:57.043250004Z 53 PC: 6267e | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:57.055090508Z 37 PC: 62687 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:57.056524695Z 53 PC: 6267e | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:57.059819804Z 37 PC: 62687 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:57.061234735Z 53 PC: 6267e | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:57.063306402Z 37 PC: 62687 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:57.066809532Z 53 PC: 6267e | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:57.070419262Z 37 PC: 62687 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:57.073701987Z 53 PC: 6267e | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:57.075453492Z 37 PC: 62687 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:57.07887046Z 53 PC: 6267e | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:57.080360122Z 37 PC: 62687 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:57.082099945Z 53 PC: 6267e | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:57.092150501Z 37 PC: 62687 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:57.093444615Z 53 PC: 6267e | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:57.096198486Z 37 PC: 62687 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:57.098089803Z 53 PC: 6267e | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:57.100889058Z 37 PC: 62687 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:57.102700456Z 41 PC: 62707 | Parse filename
2018-12-17T23:03:57.104879685Z 41 PC: 62715 | Parse filename
2018-12-17T23:03:57.108504434Z 75 PC: 62720 | Execute program
2018-12-17T23:03:57.130304972Z 53 PC: 68952 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:57.132146727Z 53 PC: 68952 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:57.133517886Z 53 PC: 68952 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:57.134818763Z 53 PC: 68952 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:57.136510626Z 53 PC: 68952 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:57.137764164Z 53 PC: 68952 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:57.139986194Z 53 PC: 68952 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:57.141598898Z 53 PC: 68952 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:57.144132143Z 53 PC: 68952 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:57.146059819Z 53 PC: 68952 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:57.147643999Z 53 PC: 68952 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:57.150351021Z 53 PC: 68952 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:57.151995995Z 53 PC: 68952 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:57.154765285Z 53 PC: 68952 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:57.156401593Z 53 PC: 68952 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:57.158947752Z 53 PC: 68952 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:57.160895115Z 53 PC: 68952 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:57.162789178Z 53 PC: 68952 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:57.165286656Z 53 PC: 68952 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:57.166826914Z 37 PC: 68967 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:57.168760812Z 37 PC: 6896f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:57.170038996Z 37 PC: 68977 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:57.172420385Z 37 PC: 6897f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:57.174205603Z 68 PC: 68d1b | I/O control for devices (Set for = '')
2018-12-17T23:03:57.25503986Z 37 PC: 68175 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:57.256842822Z 44 PC: 69c31 | Get time 0x69c31: mov word ptr [0x3e], cx
0x69c35: mov word ptr [0x40], dx
0x69c39: retf
0x69c3a: mov bx, sp
0x69c3c: push ds
0x69c3d: les di, ptr ss:[bx + 8]
0x69c41: lds si, ptr ss:[bx + 4]
0x69c45: cld
0x69c46: xor ax, ax
0x69c48: stosw word ptr es:[di], ax
0x69c49: mov ax, 0xd7b0
0x69c4c: stosw word ptr es:[di], ax
0x69c4d: xor ax, ax
0x69c4f: mov cx, 0x16
0x69c52: rep stosd dword ptr es:[di], eax
0x69c54: lodsb al, byte ptr [si]
0x69c55: mov cl, 0x4f
0x69c57: cmp al, cl
0x69c59: ja 0x69c5d
0x69c5b: mov cl, al
2018-12-17T23:03:57.259275868Z 48 PC: 69dfb | Get DOS version
2018-12-17T23:03:57.261750072Z 61 PC: 69caf | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:57.269336974Z 63 PC: 69d82 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:57.278985023Z 62 PC: 69cff | Close file
2018-12-17T23:03:57.281857576Z 26 PC: 68767 | Set disk transfer address
2018-12-17T23:03:57.285664277Z 78 PC: 68773 | Find first file
2018-12-17T23:03:57.293518161Z 26 PC: 68767 | Set disk transfer address
2018-12-17T23:03:57.294981023Z 78 PC: 68773 | Find first file
2018-12-17T23:03:57.303680056Z 26 PC: 6878b | Set disk transfer address
2018-12-17T23:03:57.305477988Z 79 PC: 68790 | Find next file
2018-12-17T23:03:57.309824485Z 48 PC: 69dfb | Get DOS version
2018-12-17T23:03:57.312852531Z 53 PC: 687ce | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:57.315016191Z 37 PC: 687d7 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:57.316830434Z 53 PC: 687ce | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:57.31836467Z 37 PC: 687d7 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:57.320270955Z 53 PC: 687ce | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:57.322333395Z 37 PC: 687d7 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:57.324996484Z 53 PC: 687ce | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:57.326884626Z 37 PC: 687d7 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:57.330250989Z 53 PC: 687ce | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:57.332257433Z 37 PC: 687d7 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:57.335289928Z 53 PC: 687ce | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:57.337175384Z 37 PC: 687d7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:57.339845246Z 53 PC: 687ce | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:57.343553863Z 37 PC: 687d7 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:57.346043676Z 53 PC: 687ce | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:57.350142897Z 37 PC: 687d7 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:57.35186138Z 53 PC: 687ce | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:57.35539141Z 37 PC: 687d7 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:57.357321862Z 53 PC: 687ce | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:57.360806617Z 37 PC: 687d7 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:57.362527344Z 53 PC: 687ce | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:57.364228022Z 37 PC: 687d7 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:57.367093903Z 53 PC: 687ce | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:57.368494268Z 37 PC: 687d7 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:57.370557759Z 53 PC: 687ce | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:57.372175513Z 37 PC: 687d7 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:57.37478965Z 53 PC: 687ce | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:57.376062565Z 37 PC: 687d7 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:57.378805815Z 53 PC: 687ce | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:57.380214825Z 37 PC: 687d7 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:57.381827669Z 53 PC: 687ce | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:57.386546496Z 37 PC: 687d7 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:57.394461715Z 53 PC: 687ce | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:57.397023574Z 37 PC: 687d7 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:57.398580072Z 53 PC: 687ce | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:57.401706743Z 37 PC: 687d7 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:57.40320408Z 53 PC: 687ce | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:57.406222368Z 37 PC: 687d7 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:57.407793273Z 41 PC: 68857 | Parse filename
2018-12-17T23:03:57.410099651Z 41 PC: 68865 | Parse filename
2018-12-17T23:03:57.411806882Z 75 PC: 68870 | Execute program
2018-12-17T23:03:57.448708238Z 53 PC: 6eaa2 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:57.45054338Z 53 PC: 6eaa2 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:57.451774926Z 53 PC: 6eaa2 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:57.453705046Z 53 PC: 6eaa2 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:57.455072709Z 53 PC: 6eaa2 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:57.457625401Z 53 PC: 6eaa2 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:57.459016208Z 53 PC: 6eaa2 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:57.461684036Z 53 PC: 6eaa2 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:57.463043133Z 53 PC: 6eaa2 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:57.465798005Z 53 PC: 6eaa2 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:57.467207506Z 53 PC: 6eaa2 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:57.468814158Z 53 PC: 6eaa2 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:57.4709521Z 53 PC: 6eaa2 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:57.472305616Z 53 PC: 6eaa2 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:57.477249977Z 53 PC: 6eaa2 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:57.478579117Z 53 PC: 6eaa2 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:57.481387811Z 53 PC: 6eaa2 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:57.482630619Z 53 PC: 6eaa2 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:57.484814236Z 53 PC: 6eaa2 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:57.48665043Z 37 PC: 6eab7 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:57.488384342Z 37 PC: 6eabf | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:57.489993268Z 37 PC: 6eac7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:57.491669251Z 37 PC: 6eacf | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:57.49354513Z 68 PC: 6ee6b | I/O control for devices (Set for = '')
2018-12-17T23:03:57.571604987Z 37 PC: 6e2c5 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:57.573912488Z 44 PC: 6fd81 | Get time 0x6fd81: mov word ptr [0x3e], cx
0x6fd85: mov word ptr [0x40], dx
0x6fd89: retf
0x6fd8a: mov bx, sp
0x6fd8c: push ds
0x6fd8d: les di, ptr ss:[bx + 8]
0x6fd91: lds si, ptr ss:[bx + 4]
0x6fd95: cld
0x6fd96: xor ax, ax
0x6fd98: stosw word ptr es:[di], ax
0x6fd99: mov ax, 0xd7b0
0x6fd9c: stosw word ptr es:[di], ax
0x6fd9d: xor ax, ax
0x6fd9f: mov cx, 0x16
0x6fda2: rep stosd dword ptr es:[di], eax
0x6fda4: lodsb al, byte ptr [si]
0x6fda5: mov cl, 0x4f
0x6fda7: cmp al, cl
0x6fda9: ja 0x6fdad
0x6fdab: mov cl, al
2018-12-17T23:03:57.576685003Z 48 PC: 6ff4b | Get DOS version
2018-12-17T23:03:57.57996335Z 61 PC: 6fdff | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:57.587671509Z 63 PC: 6fed2 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:57.597928584Z 62 PC: 6fe4f | Close file
2018-12-17T23:03:57.600681873Z 26 PC: 6e8b7 | Set disk transfer address
2018-12-17T23:03:57.602831477Z 78 PC: 6e8c3 | Find first file
2018-12-17T23:03:57.612219938Z 26 PC: 6e8b7 | Set disk transfer address
2018-12-17T23:03:57.615171119Z 78 PC: 6e8c3 | Find first file
2018-12-17T23:03:57.6229546Z 26 PC: 6e8db | Set disk transfer address
2018-12-17T23:03:57.624238516Z 79 PC: 6e8e0 | Find next file
2018-12-17T23:03:57.628443836Z 48 PC: 6ff4b | Get DOS version
2018-12-17T23:03:57.630527355Z 53 PC: 6e91e | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:57.633795864Z 37 PC: 6e927 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:57.635570582Z 53 PC: 6e91e | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:57.638663971Z 37 PC: 6e927 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:57.640265344Z 53 PC: 6e91e | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:57.642462366Z 37 PC: 6e927 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:57.644576092Z 53 PC: 6e91e | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:57.647990335Z 37 PC: 6e927 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:57.65502616Z 53 PC: 6e91e | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:57.657672939Z 37 PC: 6e927 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:57.661057415Z 53 PC: 6e91e | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:57.662990802Z 37 PC: 6e927 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:57.665611321Z 53 PC: 6e91e | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:57.667138314Z 37 PC: 6e927 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:57.669031656Z 53 PC: 6e91e | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:57.67116589Z 37 PC: 6e927 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:57.675151648Z 53 PC: 6e91e | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:57.677866795Z 37 PC: 6e927 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:57.680325029Z 53 PC: 6e91e | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:57.683460457Z 37 PC: 6e927 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:57.687336669Z 53 PC: 6e91e | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:57.690924197Z 37 PC: 6e927 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:57.692617122Z 53 PC: 6e91e | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:57.697598993Z 37 PC: 6e927 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:57.699292639Z 53 PC: 6e91e | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:57.701800858Z 37 PC: 6e927 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:57.705706824Z 53 PC: 6e91e | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:57.707332643Z 37 PC: 6e927 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:57.7092875Z 53 PC: 6e91e | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:57.710958534Z 37 PC: 6e927 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:57.72246065Z 53 PC: 6e91e | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:57.723851286Z 37 PC: 6e927 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:57.725986222Z 53 PC: 6e91e | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:57.728119705Z 37 PC: 6e927 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:57.73133308Z 53 PC: 6e91e | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:57.732676958Z 37 PC: 6e927 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:57.738873544Z 53 PC: 6e91e | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:57.74072636Z 37 PC: 6e927 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:57.743923684Z 41 PC: 6e9a7 | Parse filename
2018-12-17T23:03:57.748771643Z 41 PC: 6e9b5 | Parse filename
2018-12-17T23:03:57.75125239Z 75 PC: 6e9c0 | Execute program
2018-12-17T23:03:57.775335993Z 53 PC: 74bf2 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:57.776927717Z 53 PC: 74bf2 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:57.779286534Z 53 PC: 74bf2 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:57.780943491Z 53 PC: 74bf2 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:57.783979152Z 53 PC: 74bf2 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:57.78704564Z 53 PC: 74bf2 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:57.789701496Z 53 PC: 74bf2 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:57.791216045Z 53 PC: 74bf2 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:57.79301551Z 53 PC: 74bf2 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:57.794966229Z 53 PC: 74bf2 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:57.796546612Z 53 PC: 74bf2 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:57.799042227Z 53 PC: 74bf2 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:57.800653819Z 53 PC: 74bf2 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:57.814415245Z 53 PC: 74bf2 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:57.815941997Z 53 PC: 74bf2 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:57.818711386Z 53 PC: 74bf2 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:57.820084058Z 53 PC: 74bf2 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:57.822388673Z 53 PC: 74bf2 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:57.823601545Z 53 PC: 74bf2 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:57.825933301Z 37 PC: 74c07 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:57.827118441Z 37 PC: 74c0f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:57.829238268Z 37 PC: 74c17 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:57.83092453Z 37 PC: 74c1f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:57.833306171Z 68 PC: 74fbb | I/O control for devices (Set for = '')
2018-12-17T23:03:57.912455798Z 37 PC: 74415 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:57.914080885Z 44 PC: 75ed1 | Get time 0x75ed1: mov word ptr [0x3e], cx
0x75ed5: mov word ptr [0x40], dx
0x75ed9: retf
0x75eda: mov bx, sp
0x75edc: push ds
0x75edd: les di, ptr ss:[bx + 8]
0x75ee1: lds si, ptr ss:[bx + 4]
0x75ee5: cld
0x75ee6: xor ax, ax
0x75ee8: stosw word ptr es:[di], ax
0x75ee9: mov ax, 0xd7b0
0x75eec: stosw word ptr es:[di], ax
0x75eed: xor ax, ax
0x75eef: mov cx, 0x16
0x75ef2: rep stosd dword ptr es:[di], eax
0x75ef4: lodsb al, byte ptr [si]
0x75ef5: mov cl, 0x4f
0x75ef7: cmp al, cl
0x75ef9: ja 0x75efd
0x75efb: mov cl, al
2018-12-17T23:03:57.917014784Z 48 PC: 7609b | Get DOS version
2018-12-17T23:03:57.91953786Z 61 PC: 75f4f | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:57.929630515Z 63 PC: 76022 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:57.938960496Z 62 PC: 75f9f | Close file
2018-12-17T23:03:57.941102585Z 26 PC: 74a07 | Set disk transfer address
2018-12-17T23:03:57.942899335Z 78 PC: 74a13 | Find first file
2018-12-17T23:03:57.9525137Z 26 PC: 74a07 | Set disk transfer address
2018-12-17T23:03:57.954559608Z 78 PC: 74a13 | Find first file
2018-12-17T23:03:57.962851537Z 26 PC: 74a2b | Set disk transfer address
2018-12-17T23:03:57.966165471Z 79 PC: 74a30 | Find next file
2018-12-17T23:03:57.97005159Z 48 PC: 7609b | Get DOS version
2018-12-17T23:03:57.973648958Z 53 PC: 74a6e | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:57.975359415Z 37 PC: 74a77 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:57.976636417Z 53 PC: 74a6e | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:57.978590363Z 37 PC: 74a77 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:57.980157451Z 53 PC: 74a6e | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:57.982331701Z 37 PC: 74a77 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:57.983569519Z 53 PC: 74a6e | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:57.985943905Z 37 PC: 74a77 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:57.987671756Z 53 PC: 74a6e | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:57.990267819Z 37 PC: 74a77 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:57.99177816Z 53 PC: 74a6e | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:57.993778714Z 37 PC: 74a77 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:57.995044936Z 53 PC: 74a6e | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:58.00155451Z 37 PC: 74a77 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:58.003066164Z 53 PC: 74a6e | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:58.004392659Z 37 PC: 74a77 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:58.005813442Z 53 PC: 74a6e | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:58.007629859Z 37 PC: 74a77 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:58.011109885Z 53 PC: 74a6e | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:58.013417245Z 37 PC: 74a77 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:58.021034684Z 53 PC: 74a6e | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:58.022444987Z 37 PC: 74a77 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:58.025077409Z 53 PC: 74a6e | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:58.028629861Z 37 PC: 74a77 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:58.031051156Z 53 PC: 74a6e | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:58.032406626Z 37 PC: 74a77 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:58.034722322Z 53 PC: 74a6e | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:58.038211054Z 37 PC: 74a77 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:58.039599165Z 53 PC: 74a6e | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:58.041551187Z 37 PC: 74a77 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:58.043150175Z 53 PC: 74a6e | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:58.046000848Z 37 PC: 74a77 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:58.047893729Z 53 PC: 74a6e | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:58.050691712Z 37 PC: 74a77 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:58.052442765Z 53 PC: 74a6e | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:58.054511647Z 37 PC: 74a77 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:58.056263372Z 53 PC: 74a6e | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:58.058347984Z 37 PC: 74a77 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:58.060561087Z 41 PC: 74af7 | Parse filename
2018-12-17T23:03:58.062985918Z 41 PC: 74b05 | Parse filename
2018-12-17T23:03:58.064595596Z 75 PC: 74b10 | Execute program
2018-12-17T23:03:58.08478269Z 53 PC: 7ad42 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:58.08792483Z 53 PC: 7ad42 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:58.091959329Z 53 PC: 7ad42 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:58.093867128Z 53 PC: 7ad42 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:58.095925129Z 53 PC: 7ad42 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:58.098391018Z 53 PC: 7ad42 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:58.100372916Z 53 PC: 7ad42 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:58.103438302Z 53 PC: 7ad42 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:58.105242786Z 53 PC: 7ad42 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:58.110102919Z 53 PC: 7ad42 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:58.111382015Z 53 PC: 7ad42 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:58.113480282Z 53 PC: 7ad42 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:58.116747498Z 53 PC: 7ad42 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:58.11911995Z 53 PC: 7ad42 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:58.120810951Z 53 PC: 7ad42 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:58.123169468Z 53 PC: 7ad42 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:58.125412598Z 53 PC: 7ad42 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:58.127564034Z 53 PC: 7ad42 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:58.131156893Z 53 PC: 7ad42 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:58.132623181Z 37 PC: 7ad57 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:58.134418608Z 37 PC: 7ad5f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:58.136677869Z 37 PC: 7ad67 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:58.138222795Z 37 PC: 7ad6f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:58.139689994Z 68 PC: 7b10b | I/O control for devices (Set for = '')
2018-12-17T23:03:58.209603968Z 37 PC: 7a565 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:58.211578953Z 44 PC: 7c021 | Get time 0x7c021: mov word ptr [0x3e], cx
0x7c025: mov word ptr [0x40], dx
0x7c029: retf
0x7c02a: mov bx, sp
0x7c02c: push ds
0x7c02d: les di, ptr ss:[bx + 8]
0x7c031: lds si, ptr ss:[bx + 4]
0x7c035: cld
0x7c036: xor ax, ax
0x7c038: stosw word ptr es:[di], ax
0x7c039: mov ax, 0xd7b0
0x7c03c: stosw word ptr es:[di], ax
0x7c03d: xor ax, ax
0x7c03f: mov cx, 0x16
0x7c042: rep stosd dword ptr es:[di], eax
0x7c044: lodsb al, byte ptr [si]
0x7c045: mov cl, 0x4f
0x7c047: cmp al, cl
0x7c049: ja 0x7c04d
0x7c04b: mov cl, al
2018-12-17T23:03:58.215559511Z 48 PC: 7c1eb | Get DOS version
2018-12-17T23:03:58.217511032Z 61 PC: 7c09f | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:58.226486556Z 63 PC: 7c172 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:58.236295798Z 62 PC: 7c0ef | Close file
2018-12-17T23:03:58.239723736Z 26 PC: 7ab57 | Set disk transfer address
2018-12-17T23:03:58.242389881Z 78 PC: 7ab63 | Find first file
2018-12-17T23:03:58.254843678Z 26 PC: 7ab57 | Set disk transfer address
2018-12-17T23:03:58.25799222Z 78 PC: 7ab63 | Find first file
2018-12-17T23:03:58.268388166Z 26 PC: 7ab7b | Set disk transfer address
2018-12-17T23:03:58.269649168Z 79 PC: 7ab80 | Find next file
2018-12-17T23:03:58.273553161Z 48 PC: 7c1eb | Get DOS version
2018-12-17T23:03:58.27559377Z 53 PC: 7abbe | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:58.279189574Z 37 PC: 7abc7 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:58.280515308Z 53 PC: 7abbe | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:58.283175322Z 37 PC: 7abc7 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:58.284514861Z 53 PC: 7abbe | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:58.286929524Z 37 PC: 7abc7 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:58.288289913Z 53 PC: 7abbe | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:58.289801216Z 37 PC: 7abc7 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:58.292496897Z 53 PC: 7abbe | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:58.293964978Z 37 PC: 7abc7 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:58.296467796Z 53 PC: 7abbe | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:58.297945746Z 37 PC: 7abc7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:58.300857884Z 53 PC: 7abbe | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:58.303381672Z 37 PC: 7abc7 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:58.306877307Z 53 PC: 7abbe | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:58.311542613Z 37 PC: 7abc7 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:58.314834866Z 53 PC: 7abbe | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:58.316294371Z 37 PC: 7abc7 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:58.318948414Z 53 PC: 7abbe | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:58.320492379Z 37 PC: 7abc7 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:58.323432829Z 53 PC: 7abbe | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:58.324862829Z 37 PC: 7abc7 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:58.327714854Z 53 PC: 7abbe | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:58.331169854Z 37 PC: 7abc7 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:58.33397483Z 53 PC: 7abbe | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:58.335448772Z 37 PC: 7abc7 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:58.339362134Z 53 PC: 7abbe | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:58.341607157Z 37 PC: 7abc7 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:58.345436721Z 53 PC: 7abbe | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:58.349479595Z 37 PC: 7abc7 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:58.356156235Z 53 PC: 7abbe | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:58.358012266Z 37 PC: 7abc7 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:58.359578612Z 53 PC: 7abbe | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:58.362259886Z 37 PC: 7abc7 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:58.363826733Z 53 PC: 7abbe | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:58.365915362Z 37 PC: 7abc7 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:58.367188267Z 53 PC: 7abbe | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:58.369718366Z 37 PC: 7abc7 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:58.372407826Z 41 PC: 7ac47 | Parse filename
2018-12-17T23:03:58.375103997Z 41 PC: 7ac55 | Parse filename
2018-12-17T23:03:58.376642341Z 75 PC: 7ac60 | Execute program
2018-12-17T23:03:58.394832127Z 53 PC: 80e92 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:58.397670567Z 53 PC: 80e92 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:58.399269544Z 53 PC: 80e92 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:58.400847703Z 53 PC: 80e92 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:58.40461538Z 53 PC: 80e92 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:58.406260665Z 53 PC: 80e92 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:58.408322814Z 53 PC: 80e92 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:58.40983533Z 53 PC: 80e92 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:58.411979873Z 53 PC: 80e92 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:58.414749333Z 53 PC: 80e92 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:58.416671408Z 53 PC: 80e92 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:58.41931941Z 53 PC: 80e92 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:58.421405684Z 53 PC: 80e92 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:58.423407059Z 53 PC: 80e92 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:58.425464459Z 53 PC: 80e92 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:58.429558971Z 53 PC: 80e92 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:58.432193878Z 53 PC: 80e92 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:58.434812584Z 53 PC: 80e92 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:58.436837082Z 53 PC: 80e92 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:58.438358925Z 37 PC: 80ea7 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:58.439973341Z 37 PC: 80eaf | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:58.441789167Z 37 PC: 80eb7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:58.443525002Z 37 PC: 80ebf | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:58.44525671Z 68 PC: 8125b | I/O control for devices (Set for = '')
2018-12-17T23:03:58.524568211Z 37 PC: 806b5 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:58.526513901Z 44 PC: 82171 | Get time 0x82171: mov word ptr [0x3e], cx
0x82175: mov word ptr [0x40], dx
0x82179: retf
0x8217a: mov bx, sp
0x8217c: push ds
0x8217d: les di, ptr ss:[bx + 8]
0x82181: lds si, ptr ss:[bx + 4]
0x82185: cld
0x82186: xor ax, ax
0x82188: stosw word ptr es:[di], ax
0x82189: mov ax, 0xd7b0
0x8218c: stosw word ptr es:[di], ax
0x8218d: xor ax, ax
0x8218f: mov cx, 0x16
0x82192: rep stosd dword ptr es:[di], eax
0x82194: lodsb al, byte ptr [si]
0x82195: mov cl, 0x4f
0x82197: cmp al, cl
0x82199: ja 0x8219d
0x8219b: mov cl, al
2018-12-17T23:03:58.529913085Z 48 PC: 8233b | Get DOS version
2018-12-17T23:03:58.53269612Z 61 PC: 821ef | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:58.540501213Z 63 PC: 822c2 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:58.549955607Z 62 PC: 8223f | Close file
2018-12-17T23:03:58.552206271Z 26 PC: 80ca7 | Set disk transfer address
2018-12-17T23:03:58.554318063Z 78 PC: 80cb3 | Find first file
2018-12-17T23:03:58.56650071Z 26 PC: 80ca7 | Set disk transfer address
2018-12-17T23:03:58.572157751Z 78 PC: 80cb3 | Find first file
2018-12-17T23:03:58.578588307Z 26 PC: 80ccb | Set disk transfer address
2018-12-17T23:03:58.581249924Z 79 PC: 80cd0 | Find next file
2018-12-17T23:03:58.584709451Z 48 PC: 8233b | Get DOS version
2018-12-17T23:03:58.587566827Z 53 PC: 80d0e | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:58.589178078Z 37 PC: 80d17 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:58.590857076Z 53 PC: 80d0e | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:58.593248203Z 37 PC: 80d17 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:58.594768102Z 53 PC: 80d0e | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:58.597309132Z 37 PC: 80d17 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:58.599099029Z 53 PC: 80d0e | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:58.60139594Z 37 PC: 80d17 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:58.603345357Z 53 PC: 80d0e | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:58.605733259Z 37 PC: 80d17 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:58.60769541Z 53 PC: 80d0e | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:58.6093647Z 37 PC: 80d17 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:58.610641161Z 53 PC: 80d0e | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:58.612821442Z 37 PC: 80d17 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:58.614102773Z 53 PC: 80d0e | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:58.61629663Z 37 PC: 80d17 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:58.617563844Z 53 PC: 80d0e | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:58.620950924Z 37 PC: 80d17 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:58.622231533Z 53 PC: 80d0e | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:58.624367722Z 37 PC: 80d17 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:58.625636789Z 53 PC: 80d0e | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:58.627691935Z 37 PC: 80d17 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:58.628765214Z 53 PC: 80d0e | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:58.630257962Z 37 PC: 80d17 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:58.631384852Z 53 PC: 80d0e | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:58.63311712Z 37 PC: 80d17 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:58.634434608Z 53 PC: 80d0e | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:58.636570015Z 37 PC: 80d17 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:58.637767247Z 53 PC: 80d0e | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:58.640011429Z 37 PC: 80d17 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:58.641199183Z 53 PC: 80d0e | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:58.643121078Z 37 PC: 80d17 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:58.645011544Z 53 PC: 80d0e | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:58.646769221Z 37 PC: 80d17 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:58.64800205Z 53 PC: 80d0e | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:58.64929403Z 37 PC: 80d17 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:58.650849987Z 53 PC: 80d0e | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:58.65216474Z 37 PC: 80d17 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:58.653989433Z 41 PC: 80d97 | Parse filename
2018-12-17T23:03:58.655578372Z 41 PC: 80da5 | Parse filename
2018-12-17T23:03:58.657919406Z 75 PC: 80db0 | Execute program
2018-12-17T23:03:58.67423688Z 53 PC: 86fe2 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:58.676423263Z 53 PC: 86fe2 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:58.678051956Z 53 PC: 86fe2 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:58.680561808Z 53 PC: 86fe2 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:58.68216862Z 53 PC: 86fe2 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:58.685059027Z 53 PC: 86fe2 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:58.686569498Z 53 PC: 86fe2 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:58.689984703Z 53 PC: 86fe2 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:58.691378384Z 53 PC: 86fe2 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:58.694435134Z 53 PC: 86fe2 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:58.695676069Z 53 PC: 86fe2 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:58.697727066Z 53 PC: 86fe2 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:58.699050446Z 53 PC: 86fe2 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:58.701045849Z 53 PC: 86fe2 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:58.702304277Z 53 PC: 86fe2 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:58.70359792Z 53 PC: 86fe2 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:58.705358122Z 53 PC: 86fe2 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:58.70659606Z 53 PC: 86fe2 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:58.708827338Z 53 PC: 86fe2 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:58.709999462Z 37 PC: 86ff7 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:58.71270939Z 37 PC: 86fff | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:58.713955003Z 37 PC: 87007 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:58.716808511Z 37 PC: 8700f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:58.719963385Z 68 PC: 873ab | I/O control for devices (Set for = '&�}�9��]^_ZY[Xr<&�6}IO&�G&�>I&�D&�E����&�&K&�|&�>v�u&�v')
2018-12-17T23:03:58.773891138Z 37 PC: 86805 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:58.77571048Z 44 PC: 882c1 | Get time 0x882c1: mov word ptr [0x3e], cx
0x882c5: mov word ptr [0x40], dx
0x882c9: retf
0x882ca: mov bx, sp
0x882cc: push ds
0x882cd: les di, ptr ss:[bx + 8]
0x882d1: lds si, ptr ss:[bx + 4]
0x882d5: cld
0x882d6: xor ax, ax
0x882d8: stosw word ptr es:[di], ax
0x882d9: mov ax, 0xd7b0
0x882dc: stosw word ptr es:[di], ax
0x882dd: xor ax, ax
0x882df: mov cx, 0x16
0x882e2: rep stosd dword ptr es:[di], eax
0x882e4: lodsb al, byte ptr [si]
0x882e5: mov cl, 0x4f
0x882e7: cmp al, cl
0x882e9: ja 0x882ed
0x882eb: mov cl, al
2018-12-17T23:03:58.779008724Z 48 PC: 8848b | Get DOS version
2018-12-17T23:03:58.782008277Z 61 PC: 8833f | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:58.790227477Z 63 PC: 88412 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:58.800855299Z 62 PC: 8838f | Close file
2018-12-17T23:03:58.803466641Z 26 PC: 86df7 | Set disk transfer address
2018-12-17T23:03:58.806443371Z 78 PC: 86e03 | Find first file
2018-12-17T23:03:58.834148807Z 26 PC: 86df7 | Set disk transfer address
2018-12-17T23:03:58.836700617Z 78 PC: 86e03 | Find first file
2018-12-17T23:03:58.843146051Z 26 PC: 86e1b | Set disk transfer address
2018-12-17T23:03:58.844591591Z 79 PC: 86e20 | Find next file
2018-12-17T23:03:58.847642871Z 48 PC: 8848b | Get DOS version
2018-12-17T23:03:58.849582058Z 53 PC: 86e5e | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:58.851671408Z 37 PC: 86e67 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:58.853598553Z 53 PC: 86e5e | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:58.855046056Z 37 PC: 86e67 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:58.857046619Z 53 PC: 86e5e | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:58.85837581Z 37 PC: 86e67 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:58.860009814Z 53 PC: 86e5e | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:58.861717486Z 37 PC: 86e67 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:58.863025246Z 53 PC: 86e5e | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:58.864296697Z 37 PC: 86e67 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:58.866309624Z 53 PC: 86e5e | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:58.867928259Z 37 PC: 86e67 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:58.886150767Z 53 PC: 86e5e | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:58.887339543Z 37 PC: 86e67 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:58.889449072Z 53 PC: 86e5e | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:58.89066597Z 37 PC: 86e67 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:58.89261666Z 53 PC: 86e5e | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:58.893806518Z 37 PC: 86e67 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:58.895435572Z 53 PC: 86e5e | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:58.896721782Z 37 PC: 86e67 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:58.898445254Z 53 PC: 86e5e | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:58.899664107Z 37 PC: 86e67 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:58.902146106Z 53 PC: 86e5e | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:58.903607524Z 37 PC: 86e67 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:58.906477623Z 53 PC: 86e5e | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:58.908159978Z 37 PC: 86e67 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:58.91064901Z 53 PC: 86e5e | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:58.912155334Z 37 PC: 86e67 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:58.914929983Z 53 PC: 86e5e | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:58.916568094Z 37 PC: 86e67 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:58.919461887Z 53 PC: 86e5e | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:58.920883652Z 37 PC: 86e67 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:58.923277235Z 53 PC: 86e5e | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:58.924493012Z 37 PC: 86e67 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:58.926915328Z 53 PC: 86e5e | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:58.92867589Z 37 PC: 86e67 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:58.930597084Z 53 PC: 86e5e | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:58.932015702Z 37 PC: 86e67 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:58.933470649Z 41 PC: 86ee7 | Parse filename
2018-12-17T23:03:58.935467936Z 41 PC: 86ef5 | Parse filename
2018-12-17T23:03:58.937076412Z 75 PC: 86f00 | Execute program
2018-12-17T23:03:58.959765171Z 53 PC: 8d132 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:58.962983646Z 53 PC: 8d132 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:58.9650961Z 53 PC: 8d132 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:58.96674423Z 53 PC: 8d132 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:58.96835551Z 53 PC: 8d132 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:58.970424061Z 53 PC: 8d132 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:58.972516608Z 53 PC: 8d132 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:58.976165682Z 53 PC: 8d132 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:58.979164944Z 53 PC: 8d132 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:58.98243236Z 53 PC: 8d132 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:58.984168656Z 53 PC: 8d132 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:58.986905444Z 53 PC: 8d132 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:58.988478864Z 53 PC: 8d132 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:58.991184113Z 53 PC: 8d132 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:58.993315893Z 53 PC: 8d132 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:58.994950849Z 53 PC: 8d132 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:58.997883545Z 53 PC: 8d132 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:58.999302564Z 53 PC: 8d132 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:59.002328847Z 53 PC: 8d132 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:59.004241114Z 37 PC: 8d147 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:59.006889386Z 37 PC: 8d14f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:59.008496599Z 37 PC: 8d157 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:59.013430751Z 37 PC: 8d15f | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:59.015144094Z 68 PC: 8d4fb | I/O control for devices
2018-12-17T23:03:59.099472271Z 37 PC: 8c955 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:59.10129527Z 44 PC: 8e411 | Get time 0x8e411: mov word ptr [0x3e], cx
0x8e415: mov word ptr [0x40], dx
0x8e419: retf
0x8e41a: mov bx, sp
0x8e41c: push ds
0x8e41d: les di, ptr ss:[bx + 8]
0x8e421: lds si, ptr ss:[bx + 4]
0x8e425: cld
0x8e426: xor ax, ax
0x8e428: stosw word ptr es:[di], ax
0x8e429: mov ax, 0xd7b0
0x8e42c: stosw word ptr es:[di], ax
0x8e42d: xor ax, ax
0x8e42f: mov cx, 0x16
0x8e432: rep stosd dword ptr es:[di], eax
0x8e434: lodsb al, byte ptr [si]
0x8e435: mov cl, 0x4f
0x8e437: cmp al, cl
0x8e439: ja 0x8e43d
0x8e43b: mov cl, al
2018-12-17T23:03:59.105232977Z 48 PC: 8e5db | Get DOS version
2018-12-17T23:03:59.10711659Z 61 PC: 8e48f | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:59.115481856Z 63 PC: 8e562 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:59.126235264Z 62 PC: 8e4df | Close file
2018-12-17T23:03:59.128661468Z 26 PC: 8cf47 | Set disk transfer address
2018-12-17T23:03:59.131280555Z 78 PC: 8cf53 | Find first file
2018-12-17T23:03:59.139006537Z 26 PC: 8cf47 | Set disk transfer address
2018-12-17T23:03:59.140888969Z 78 PC: 8cf53 | Find first file
2018-12-17T23:03:59.147350593Z 26 PC: 8cf6b | Set disk transfer address
2018-12-17T23:03:59.149477354Z 79 PC: 8cf70 | Find next file
2018-12-17T23:03:59.152457911Z 48 PC: 8e5db | Get DOS version
2018-12-17T23:03:59.155314714Z 53 PC: 8cfae | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:59.1568064Z 37 PC: 8cfb7 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:59.158764523Z 53 PC: 8cfae | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:59.160914227Z 37 PC: 8cfb7 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:59.162092183Z 53 PC: 8cfae | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:59.16326551Z 37 PC: 8cfb7 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:59.165477361Z 53 PC: 8cfae | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:59.167018771Z 37 PC: 8cfb7 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:59.169468629Z 53 PC: 8cfae | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:59.170759417Z 37 PC: 8cfb7 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:59.173460648Z 53 PC: 8cfae | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:59.174823472Z 37 PC: 8cfb7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:59.181016802Z 53 PC: 8cfae | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:59.192857795Z 37 PC: 8cfb7 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:59.195864121Z 53 PC: 8cfae | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:59.197465313Z 37 PC: 8cfb7 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:59.199773505Z 53 PC: 8cfae | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:59.201507597Z 37 PC: 8cfb7 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:59.204065248Z 53 PC: 8cfae | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:59.206693672Z 37 PC: 8cfb7 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:59.208139642Z 53 PC: 8cfae | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:59.209953524Z 37 PC: 8cfb7 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:59.21152484Z 53 PC: 8cfae | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:59.212916969Z 37 PC: 8cfb7 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:59.215250909Z 53 PC: 8cfae | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:59.216554601Z 37 PC: 8cfb7 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:59.219181372Z 53 PC: 8cfae | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:59.220447333Z 37 PC: 8cfb7 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:59.223157201Z 53 PC: 8cfae | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:59.224455183Z 37 PC: 8cfb7 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:59.226200746Z 53 PC: 8cfae | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:59.227848065Z 37 PC: 8cfb7 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:59.229143291Z 53 PC: 8cfae | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:59.232249614Z 37 PC: 8cfb7 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:59.233639379Z 53 PC: 8cfae | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:59.235412675Z 37 PC: 8cfb7 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:59.236654942Z 53 PC: 8cfae | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:59.238510181Z 37 PC: 8cfb7 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:59.239940562Z 41 PC: 8d037 | Parse filename
2018-12-17T23:03:59.250559697Z 41 PC: 8d045 | Parse filename
2018-12-17T23:03:59.253860075Z 75 PC: 8d050 | Execute program
2018-12-17T23:03:59.270960823Z 53 PC: 93282 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:59.273417764Z 53 PC: 93282 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:59.274762804Z 53 PC: 93282 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:59.27601489Z 53 PC: 93282 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:59.280400259Z 53 PC: 93282 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:59.281675949Z 53 PC: 93282 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:59.284230083Z 53 PC: 93282 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:59.285621921Z 53 PC: 93282 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:59.287983995Z 53 PC: 93282 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:59.289368148Z 53 PC: 93282 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:59.291094336Z 53 PC: 93282 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:59.292425901Z 53 PC: 93282 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:59.293772584Z 53 PC: 93282 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:59.295791261Z 53 PC: 93282 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:59.297689852Z 53 PC: 93282 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:59.298915097Z 53 PC: 93282 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:59.303113745Z 53 PC: 93282 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:59.305906418Z 53 PC: 93282 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:59.307336639Z 53 PC: 93282 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:59.310086731Z 37 PC: 93297 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:59.311312948Z 37 PC: 9329f | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:59.312749751Z 37 PC: 932a7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:59.313885217Z 37 PC: 932af | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:59.317228366Z 68 PC: 9364b | I/O control for devices
2018-12-17T23:03:59.410141572Z 37 PC: 92aa5 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:59.413026318Z 44 PC: 94561 | Get time 0x94561: mov word ptr [0x3e], cx
0x94565: mov word ptr [0x40], dx
0x94569: retf
0x9456a: mov bx, sp
0x9456c: push ds
0x9456d: les di, ptr ss:[bx + 8]
0x94571: lds si, ptr ss:[bx + 4]
0x94575: cld
0x94576: xor ax, ax
0x94578: stosw word ptr es:[di], ax
0x94579: mov ax, 0xd7b0
0x9457c: stosw word ptr es:[di], ax
0x9457d: xor ax, ax
0x9457f: mov cx, 0x16
0x94582: rep stosd dword ptr es:[di], eax
0x94584: lodsb al, byte ptr [si]
0x94585: mov cl, 0x4f
0x94587: cmp al, cl
0x94589: ja 0x9458d
0x9458b: mov cl, al
2018-12-17T23:03:59.415192994Z 48 PC: 9472b | Get DOS version
2018-12-17T23:03:59.418124759Z 61 PC: 945df | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:59.425724574Z 63 PC: 946b2 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:59.436902441Z 62 PC: 9462f | Close file
2018-12-17T23:03:59.439282187Z 26 PC: 93097 | Set disk transfer address
2018-12-17T23:03:59.441996042Z 78 PC: 930a3 | Find first file
2018-12-17T23:03:59.447975931Z 26 PC: 93097 | Set disk transfer address
2018-12-17T23:03:59.450151303Z 78 PC: 930a3 | Find first file
2018-12-17T23:03:59.456943609Z 26 PC: 930bb | Set disk transfer address
2018-12-17T23:03:59.45833691Z 79 PC: 930c0 | Find next file
2018-12-17T23:03:59.462797381Z 48 PC: 9472b | Get DOS version
2018-12-17T23:03:59.464874839Z 53 PC: 930fe | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:59.467051824Z 37 PC: 93107 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:59.468328205Z 53 PC: 930fe | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:59.470464944Z 37 PC: 93107 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:59.471999741Z 53 PC: 930fe | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:59.473249783Z 37 PC: 93107 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:59.474998803Z 53 PC: 930fe | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:59.476250387Z 37 PC: 93107 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:59.477990691Z 53 PC: 930fe | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:59.479222648Z 37 PC: 93107 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:59.481891188Z 53 PC: 930fe | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:59.48313625Z 37 PC: 93107 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:59.485564668Z 53 PC: 930fe | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:59.48679879Z 37 PC: 93107 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:59.488687893Z 53 PC: 930fe | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:59.49000473Z 37 PC: 93107 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:59.492032144Z 53 PC: 930fe | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:59.494442267Z 37 PC: 93107 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:59.495651823Z 53 PC: 930fe | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:59.498027441Z 37 PC: 93107 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:59.499241656Z 53 PC: 930fe | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:59.501677828Z 37 PC: 93107 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:59.502889387Z 53 PC: 930fe | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:59.504575088Z 37 PC: 93107 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:59.521730689Z 53 PC: 930fe | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:59.528110079Z 37 PC: 93107 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:59.530336176Z 53 PC: 930fe | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:59.531641061Z 37 PC: 93107 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:59.534178705Z 53 PC: 930fe | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:59.53542563Z 37 PC: 93107 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:59.53755224Z 53 PC: 930fe | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:59.538836125Z 37 PC: 93107 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:59.540819807Z 53 PC: 930fe | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:59.546861141Z 37 PC: 93107 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:59.548127904Z 53 PC: 930fe | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:59.550451434Z 37 PC: 93107 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:59.551665428Z 53 PC: 930fe | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:59.554901045Z 37 PC: 93107 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:59.556501085Z 41 PC: 93187 | Parse filename
2018-12-17T23:03:59.558553305Z 41 PC: 93195 | Parse filename
2018-12-17T23:03:59.560755457Z 75 PC: 931a0 | Execute program
2018-12-17T23:03:59.576936765Z 53 PC: 993d2 | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:59.578933682Z 53 PC: 993d2 | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:59.580186489Z 53 PC: 993d2 | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:59.582338777Z 53 PC: 993d2 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:59.583605179Z 53 PC: 993d2 | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:59.585505113Z 53 PC: 993d2 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:59.58685909Z 53 PC: 993d2 | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:59.589400751Z 53 PC: 993d2 | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:59.590691399Z 53 PC: 993d2 | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:59.593033074Z 53 PC: 993d2 | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:59.59456223Z 53 PC: 993d2 | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:59.596559427Z 53 PC: 993d2 | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:59.598281166Z 53 PC: 993d2 | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:59.59966556Z 53 PC: 993d2 | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:59.601593386Z 53 PC: 993d2 | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:59.603310777Z 53 PC: 993d2 | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:59.607023451Z 53 PC: 993d2 | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:59.608204071Z 53 PC: 993d2 | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:59.610425911Z 53 PC: 993d2 | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:59.612097014Z 37 PC: 993e7 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:59.614434752Z 37 PC: 993ef | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:59.615751148Z 37 PC: 993f7 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:59.617778803Z 37 PC: 993ff | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:59.620062448Z 68 PC: 9979b | I/O control for devices
2018-12-17T23:03:59.67476626Z 37 PC: 98bf5 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:59.677170853Z 44 PC: 9a6b1 | Get time 0x9a6b1: mov word ptr [0x3e], cx
0x9a6b5: mov word ptr [0x40], dx
0x9a6b9: retf
0x9a6ba: mov bx, sp
0x9a6bc: push ds
0x9a6bd: les di, ptr ss:[bx + 8]
0x9a6c1: lds si, ptr ss:[bx + 4]
0x9a6c5: cld
0x9a6c6: xor ax, ax
0x9a6c8: stosw word ptr es:[di], ax
0x9a6c9: mov ax, 0xd7b0
0x9a6cc: stosw word ptr es:[di], ax
0x9a6cd: xor ax, ax
0x9a6cf: mov cx, 0x16
0x9a6d2: rep stosd dword ptr es:[di], eax
0x9a6d4: lodsb al, byte ptr [si]
0x9a6d5: mov cl, 0x4f
0x9a6d7: cmp al, cl
0x9a6d9: ja 0x9a6dd
0x9a6db: mov cl, al
2018-12-17T23:03:59.679816059Z 48 PC: 9a87b | Get DOS version
2018-12-17T23:03:59.682318827Z 61 PC: 9a72f | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:03:59.689745146Z 63 PC: 9a802 | Read file or device (Read 8001 bytes on handle 5)
2018-12-17T23:03:59.69898654Z 62 PC: 9a77f | Close file
2018-12-17T23:03:59.701280655Z 26 PC: 991e7 | Set disk transfer address
2018-12-17T23:03:59.703675861Z 78 PC: 991f3 | Find first file
2018-12-17T23:03:59.711281888Z 26 PC: 991e7 | Set disk transfer address
2018-12-17T23:03:59.713719603Z 78 PC: 991f3 | Find first file
2018-12-17T23:03:59.720154639Z 26 PC: 9920b | Set disk transfer address
2018-12-17T23:03:59.72131431Z 79 PC: 99210 | Find next file
2018-12-17T23:03:59.732661975Z 48 PC: 9a87b | Get DOS version
2018-12-17T23:03:59.734746196Z 53 PC: 9924e | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:59.737096878Z 37 PC: 99257 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:59.738519805Z 53 PC: 9924e | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:59.740869405Z 37 PC: 99257 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:59.74287108Z 53 PC: 9924e | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:59.748935337Z 37 PC: 99257 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:59.750366118Z 53 PC: 9924e | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:59.753179521Z 37 PC: 99257 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:59.754797745Z 53 PC: 9924e | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:59.757974009Z 37 PC: 99257 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:59.759371698Z 53 PC: 9924e | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:59.762420894Z 37 PC: 99257 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:59.763908092Z 53 PC: 9924e | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:59.765329315Z 37 PC: 99257 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:59.767461596Z 53 PC: 9924e | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:59.768736564Z 37 PC: 99257 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:59.770797952Z 53 PC: 9924e | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:59.772027184Z 37 PC: 99257 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:59.774283759Z 53 PC: 9924e | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:59.786133139Z 37 PC: 99257 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:59.78857381Z 53 PC: 9924e | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:59.789778426Z 37 PC: 99257 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:59.79083869Z 53 PC: 9924e | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:59.792599763Z 37 PC: 99257 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:59.793703389Z 53 PC: 9924e | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:59.795338454Z 37 PC: 99257 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:59.796617851Z 53 PC: 9924e | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:59.798176173Z 37 PC: 99257 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:59.800679291Z 53 PC: 9924e | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:59.80247016Z 37 PC: 99257 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:59.804815682Z 53 PC: 9924e | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:59.805988217Z 37 PC: 99257 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:59.807233931Z 53 PC: 9924e | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:59.809165394Z 37 PC: 99257 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:59.814117459Z 53 PC: 9924e | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:59.817309163Z 37 PC: 99257 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:59.818824333Z 53 PC: 9924e | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:59.821187629Z 37 PC: 99257 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:59.822530845Z 41 PC: 992d7 | Parse filename
2018-12-17T23:03:59.824884953Z 41 PC: 992e5 | Parse filename
2018-12-17T23:03:59.82637177Z 75 PC: 992f0 | Execute program
2018-12-17T23:03:59.836475386Z 53 PC: 9924e | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:59.838490737Z 37 PC: 99257 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:03:59.839813595Z 53 PC: 9924e | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:59.84182013Z 37 PC: 99257 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:03:59.84430265Z 53 PC: 9924e | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:59.845481698Z 37 PC: 99257 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:03:59.847793927Z 53 PC: 9924e | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:59.848953227Z 37 PC: 99257 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:03:59.850447318Z 53 PC: 9924e | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:59.851616447Z 37 PC: 99257 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:03:59.852664669Z 53 PC: 9924e | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:59.855279508Z 37 PC: 99257 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:03:59.856395678Z 53 PC: 9924e | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:59.858689733Z 37 PC: 99257 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:03:59.859818997Z 53 PC: 9924e | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:59.860887667Z 37 PC: 99257 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:03:59.862969303Z 53 PC: 9924e | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:59.864021562Z 37 PC: 99257 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:03:59.866325616Z 53 PC: 9924e | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:59.867508231Z 37 PC: 99257 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:03:59.86939489Z 53 PC: 9924e | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:59.870895272Z 37 PC: 99257 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:03:59.872506563Z 53 PC: 9924e | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:59.874694609Z 37 PC: 99257 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:03:59.876029851Z 53 PC: 9924e | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:59.882332086Z 37 PC: 99257 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:03:59.883548544Z 53 PC: 9924e | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:59.885769141Z 37 PC: 99257 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:03:59.886839214Z 53 PC: 9924e | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:59.889084157Z 37 PC: 99257 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:03:59.890203332Z 53 PC: 9924e | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:59.89132899Z 37 PC: 99257 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:03:59.893137852Z 53 PC: 9924e | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:59.894286804Z 37 PC: 99257 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:03:59.896757531Z 53 PC: 9924e | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:59.901712872Z 37 PC: 99257 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:03:59.90813906Z 53 PC: 9924e | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:59.918077325Z 37 PC: 99257 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:03:59.926882999Z 44 PC: 9a6b1 | Get time 0x9a6b1: mov word ptr [0x3e], cx
0x9a6b5: mov word ptr [0x40], dx
0x9a6b9: retf
0x9a6ba: mov bx, sp
0x9a6bc: push ds
0x9a6bd: les di, ptr ss:[bx + 8]
0x9a6c1: lds si, ptr ss:[bx + 4]
0x9a6c5: cld
0x9a6c6: xor ax, ax
0x9a6c8: stosw word ptr es:[di], ax
0x9a6c9: mov ax, 0xd7b0
0x9a6cc: stosw word ptr es:[di], ax
0x9a6cd: xor ax, ax
0x9a6cf: mov cx, 0x16
0x9a6d2: rep stosd dword ptr es:[di], eax
0x9a6d4: lodsb al, byte ptr [si]
0x9a6d5: mov cl, 0x4f
0x9a6d7: cmp al, cl
0x9a6d9: ja 0x9a6dd
0x9a6db: mov cl, al
2018-12-17T23:04:00.042168028Z 8 PC: 98aa7 | Console input without echo