Sample viewer

vx.netlux.org/Virus.DOS.HLLO.14610

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T23:09:15.826820534Z 53 PC: 14d9a | Get interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:09:15.82925835Z 53 PC: 14d9a | Get interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:09:15.831833795Z 53 PC: 14d9a | Get interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:09:15.833513452Z 53 PC: 14d9a | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:09:15.836242255Z 53 PC: 14d9a | Get interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:09:15.837936822Z 53 PC: 14d9a | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:09:15.839597022Z 53 PC: 14d9a | Get interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:09:15.841738184Z 53 PC: 14d9a | Get interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:09:15.84319819Z 53 PC: 14d9a | Get interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:09:15.858588332Z 53 PC: 14d9a | Get interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:09:15.860811574Z 53 PC: 14d9a | Get interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:09:15.862468301Z 53 PC: 14d9a | Get interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:09:15.864192243Z 53 PC: 14d9a | Get interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:09:15.865899645Z 53 PC: 14d9a | Get interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:09:15.868709489Z 53 PC: 14d9a | Get interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:09:15.870145413Z 53 PC: 14d9a | Get interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:09:15.871529918Z 53 PC: 14d9a | Get interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:09:15.874445954Z 53 PC: 14d9a | Get interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:09:15.876295831Z 53 PC: 14d9a | Get interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:09:15.878079803Z 37 PC: 14daf | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:09:15.880835257Z 37 PC: 14db7 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:09:15.882530569Z 37 PC: 14dbf | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:09:15.884176736Z 37 PC: 14dc7 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:09:15.88705672Z 68 PC: 15a71 | I/O control for devices (Set for = '')
2018-12-17T23:09:15.914739013Z 37 PC: 147c1 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:09:15.916604757Z 48 PC: 15682 | Get DOS version
2018-12-17T23:09:15.918318176Z 42 PC: 144d7 | Get date 0x144d7: xor ah, ah
0x144d9: les di, ptr [bp + 6]
0x144dc: stosw word ptr es:[di], ax
0x144dd: mov al, dl
0x144df: les di, ptr [bp + 0xa]
0x144e2: stosw word ptr es:[di], ax
0x144e3: mov al, dh
0x144e5: les di, ptr [bp + 0xe]
0x144e8: stosw word ptr es:[di], ax
0x144e9: xchg ax, cx
0x144ea: les di, ptr [bp + 0x12]
0x144ed: stosw word ptr es:[di], ax
0x144ee: pop bp
0x144ef: retf 0x10
0x144f2: push bp
0x144f3: mov bp, sp
0x144f5: mov cx, word ptr [bp + 0xa]
0x144f8: mov dh, byte ptr [bp + 8]
0x144fb: mov dl, byte ptr [bp + 6]
0x144fe: mov ah, 0x2b
2018-12-17T23:09:15.921965863Z 67 PC: 145ac | Get or set file attributes
2018-12-17T23:09:15.942595234Z 61 PC: 154c0 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T23:09:15.950411118Z 87 PC: 145c6 | Get or set file date and time
2018-12-17T23:09:15.952708531Z 63 PC: 15593 | Read file or device (Read 14610 bytes on handle 5)
2018-12-17T23:09:15.965042997Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:15.966491507Z 78 PC: 1462f | Find first file
2018-12-17T23:09:15.973914205Z 62 PC: 15510 | Close file
2018-12-17T23:09:15.978787813Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:15.980879456Z 78 PC: 1462f | Find first file
2018-12-17T23:09:15.989003812Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:15.990172148Z 79 PC: 1464c | Find next file
2018-12-17T23:09:15.992393615Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:15.994606722Z 78 PC: 1462f | Find first file
2018-12-17T23:09:15.999247433Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:16.000239562Z 78 PC: 1462f | Find first file
2018-12-17T23:09:16.004373584Z 60 PC: 154c0 | Create or truncate file
2018-12-17T23:09:16.356172178Z 62 PC: 15510 | Close file
2018-12-17T23:09:16.358912237Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:16.36058127Z 78 PC: 1462f | Find first file
2018-12-17T23:09:16.367046954Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:16.368401327Z 78 PC: 1462f | Find first file
2018-12-17T23:09:16.3750013Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:16.377099325Z 78 PC: 1462f | Find first file
2018-12-17T23:09:16.383485909Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:16.385314956Z 78 PC: 1462f | Find first file
2018-12-17T23:09:16.392053125Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.395069957Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.398681398Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:16.400746376Z 78 PC: 1462f | Find first file
2018-12-17T23:09:16.412201508Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.413825786Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.419795301Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.421623995Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.426793504Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.428775202Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.434023792Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.435640726Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.440731027Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.442939153Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.44802416Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.449636871Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.458583467Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.460134386Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.466094029Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.469302721Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.474416816Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.475989027Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.481384451Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.483024276Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.487997556Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.4907245Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.495252309Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.49640141Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.514319565Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.515919235Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.51891827Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.519972091Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.525462926Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.526465903Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.529322241Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.53091668Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.533056373Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:16.533925588Z 78 PC: 1462f | Find first file
2018-12-17T23:09:16.541318577Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.542394761Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.544777446Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.546313753Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.550011494Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.551916871Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.557185194Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:16.558613631Z 78 PC: 1462f | Find first file
2018-12-17T23:09:16.569903653Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.572215496Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.577455222Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.579148771Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.584982151Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.586363806Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.591148982Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.593608694Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.598402171Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.599649461Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.609559991Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.611276338Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.616398518Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.61914721Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.624299152Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.626094624Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.633659487Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.635227022Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.6400226Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.641351125Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.647153879Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.648420277Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.653225708Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.654844648Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.659634711Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.660937347Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.66691549Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.669171835Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.674575114Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.677500865Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.685866846Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.687102166Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.692855605Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.694053041Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.699036045Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.70158909Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.707268802Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.709005514Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.714432472Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.716303477Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.721129116Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.723572685Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.728449568Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.729732519Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.735416099Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.736793936Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.745361424Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.747429808Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.752703231Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.753725168Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.756662753Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.75812733Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.76089636Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.761770893Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.765212871Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.766395675Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.771047652Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.772906646Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.782098855Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.783252098Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.791795352Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.792976038Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.801064467Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.802787727Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.809629759Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:16.810605916Z 78 PC: 1462f | Find first file
2018-12-17T23:09:16.81813797Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.819207976Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.822765972Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.825286083Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.830050295Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:16.831929256Z 78 PC: 1462f | Find first file
2018-12-17T23:09:16.843939252Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.846140994Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.850957181Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.852965068Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.857981361Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.859317375Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.864714467Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.865953432Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.871059778Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.873233989Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.881627751Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.882954041Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.888249954Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.889641654Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.898382019Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.90073818Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.905527167Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.906827239Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.916606325Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:16.918194966Z 78 PC: 1462f | Find first file
2018-12-17T23:09:16.925723873Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.927942285Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.931574756Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.932823408Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.937477804Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.938722931Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.94299099Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:16.945268576Z 78 PC: 1462f | Find first file
2018-12-17T23:09:16.956431904Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:16.957777474Z 78 PC: 1462f | Find first file
2018-12-17T23:09:16.96638184Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.967688861Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.971306092Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.972776098Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.97685089Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.97856722Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.981905087Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:16.983143134Z 79 PC: 1464c | Find next file
2018-12-17T23:09:16.98604454Z 44 PC: 15ba8 | Get time 0x15ba8: mov word ptr [0x3e], cx
0x15bac: mov word ptr [0x40], dx
0x15bb0: retf
0x15bb1: mov cx, di
0x15bb3: mov si, 0xa
0x15bb6: mov bx, dx
0x15bb8: or bx, bx
0x15bba: jns 0x15bcd
0x15bbc: neg bx
0x15bbe: neg ax
0x15bc0: sbb bx, 0
0x15bc3: call 0x15bcd
0x15bc6: dec di
0x15bc7: mov byte ptr es:[di], 0x2d
0x15bcb: inc cx
0x15bcc: ret
0x15bcd: xor dx, dx
0x15bcf: xchg ax, bx
0x15bd0: div si
0x15bd2: xchg ax, bx
2018-12-17T23:09:16.991241328Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:16.993151259Z 78 PC: 1462f | Find first file
2018-12-17T23:09:17.000210342Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:17.002312388Z 79 PC: 1464c | Find next file
2018-12-17T23:09:17.005063049Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:17.006543929Z 78 PC: 1462f | Find first file
2018-12-17T23:09:17.013960076Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:17.015274857Z 78 PC: 1462f | Find first file
2018-12-17T23:09:17.021450776Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:17.022761194Z 78 PC: 1462f | Find first file
2018-12-17T23:09:17.028867629Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:17.029932677Z 79 PC: 1464c | Find next file
2018-12-17T23:09:17.034556622Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:17.035666113Z 78 PC: 1462f | Find first file
2018-12-17T23:09:17.043913388Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:17.045284479Z 79 PC: 1464c | Find next file
2018-12-17T23:09:17.050737374Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:17.051949209Z 79 PC: 1464c | Find next file
2018-12-17T23:09:17.056717428Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:17.058636774Z 79 PC: 1464c | Find next file
2018-12-17T23:09:17.063092007Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:17.065207699Z 78 PC: 1462f | Find first file
2018-12-17T23:09:17.072539239Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:17.073677924Z 79 PC: 1464c | Find next file
2018-12-17T23:09:17.078026127Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:17.079472513Z 79 PC: 1464c | Find next file
2018-12-17T23:09:17.08281672Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:17.084540762Z 79 PC: 1464c | Find next file
2018-12-17T23:09:17.088451757Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:17.089400996Z 78 PC: 1462f | Find first file
2018-12-17T23:09:17.098370507Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:17.09974258Z 79 PC: 1464c | Find next file
2018-12-17T23:09:17.104738145Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:17.106858917Z 79 PC: 1464c | Find next file
2018-12-17T23:09:17.110779523Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:17.11206611Z 78 PC: 1462f | Find first file
2018-12-17T23:09:17.119731333Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:17.121494977Z 79 PC: 1464c | Find next file
2018-12-17T23:09:17.125271319Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:17.127033767Z 79 PC: 1464c | Find next file
2018-12-17T23:09:17.131099067Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:17.1331408Z 78 PC: 1462f | Find first file
2018-12-17T23:09:17.141242104Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:17.142542575Z 78 PC: 1462f | Find first file
2018-12-17T23:09:17.149688725Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:17.15197864Z 79 PC: 1464c | Find next file
2018-12-17T23:09:17.155645551Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:17.15688086Z 79 PC: 1464c | Find next file
2018-12-17T23:09:17.161384364Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:17.162588042Z 79 PC: 1464c | Find next file
2018-12-17T23:09:17.166744578Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:17.168591189Z 78 PC: 1462f | Find first file
2018-12-17T23:09:17.176076394Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:17.177135466Z 78 PC: 1462f | Find first file
2018-12-17T23:09:17.185026912Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:17.18630118Z 79 PC: 1464c | Find next file
2018-12-17T23:09:17.189847664Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:17.191301328Z 79 PC: 1464c | Find next file
2018-12-17T23:09:17.194255011Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:17.195564975Z 79 PC: 1464c | Find next file
2018-12-17T23:09:17.19936962Z 26 PC: 14647 | Set disk transfer address
2018-12-17T23:09:17.200699382Z 79 PC: 1464c | Find next file
2018-12-17T23:09:17.207080039Z 67 PC: 145ac | Get or set file attributes
2018-12-17T23:09:17.21794187Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\PIFEDIT.EXE')
2018-12-17T23:09:17.225713692Z 63 PC: 15593 | Read file or device (Read 33 bytes on handle 5)
2018-12-17T23:09:17.23233713Z 54 PC: 1454c | Get free disk space
2018-12-17T23:09:17.24248576Z 66 PC: 15d71 | Move file pointer
2018-12-17T23:09:17.244362116Z 66 PC: 15d7f | Move file pointer
2018-12-17T23:09:17.247352033Z 66 PC: 15d8d | Move file pointer
2018-12-17T23:09:17.249521983Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.252350562Z 67 PC: 145ac | Get or set file attributes
2018-12-17T23:09:17.264551545Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\PIFEDIT.EXE')
2018-12-17T23:09:17.273162018Z 87 PC: 145c6 | Get or set file date and time
2018-12-17T23:09:17.27495331Z 63 PC: 15593 | Read file or device (Read 14610 bytes on handle 5)
2018-12-17T23:09:17.287034365Z 67 PC: 145ac | Get or set file attributes
2018-12-17T23:09:17.29838192Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\SETUP.TXT')
2018-12-17T23:09:17.307003289Z 87 PC: 145c6 | Get or set file date and time
2018-12-17T23:09:17.309569947Z 66 PC: 15d71 | Move file pointer
2018-12-17T23:09:17.311250654Z 66 PC: 15d7f | Move file pointer
2018-12-17T23:09:17.312946149Z 66 PC: 15d8d | Move file pointer
2018-12-17T23:09:17.316216259Z 44 PC: 15ba8 | Get time 0x15ba8: mov word ptr [0x3e], cx
0x15bac: mov word ptr [0x40], dx
0x15bb0: retf
0x15bb1: mov cx, di
0x15bb3: mov si, 0xa
0x15bb6: mov bx, dx
0x15bb8: or bx, bx
0x15bba: jns 0x15bcd
0x15bbc: neg bx
0x15bbe: neg ax
0x15bc0: sbb bx, 0
0x15bc3: call 0x15bcd
0x15bc6: dec di
0x15bc7: mov byte ptr es:[di], 0x2d
0x15bcb: inc cx
0x15bcc: ret
0x15bcd: xor dx, dx
0x15bcf: xchg ax, bx
0x15bd0: div si
0x15bd2: xchg ax, bx
2018-12-17T23:09:17.318988645Z 44 PC: 15ba8 | Get time 0x15ba8: mov word ptr [0x3e], cx
0x15bac: mov word ptr [0x40], dx
0x15bb0: retf
0x15bb1: mov cx, di
0x15bb3: mov si, 0xa
0x15bb6: mov bx, dx
0x15bb8: or bx, bx
0x15bba: jns 0x15bcd
0x15bbc: neg bx
0x15bbe: neg ax
0x15bc0: sbb bx, 0
0x15bc3: call 0x15bcd
0x15bc6: dec di
0x15bc7: mov byte ptr es:[di], 0x2d
0x15bcb: inc cx
0x15bcc: ret
0x15bcd: xor dx, dx
0x15bcf: xchg ax, bx
0x15bd0: div si
0x15bd2: xchg ax, bx
2018-12-17T23:09:17.322755322Z 66 PC: 15d71 | Move file pointer
2018-12-17T23:09:17.325574125Z 66 PC: 15d7f | Move file pointer
2018-12-17T23:09:17.327492553Z 66 PC: 15d8d | Move file pointer
2018-12-17T23:09:17.329369998Z 66 PC: 155f2 | Move file pointer
2018-12-17T23:09:17.33200192Z 64 PC: 15593 | Write file or device (Write 14610 bytes on handle 6)
2018-12-17T23:09:17.350768821Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.352667876Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.361498298Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\PIFEDIT.EXE')
2018-12-17T23:09:17.369615791Z 64 PC: 15593 | Write file or device (Write 14610 bytes on handle 5)
2018-12-17T23:09:17.379605395Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.400145392Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\PIFEDIT.EXE')
2018-12-17T23:09:17.407996436Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\SETUP.TXT')
2018-12-17T23:09:17.416223293Z 87 PC: 145f3 | Get or set file date and time
2018-12-17T23:09:17.418081492Z 87 PC: 145f3 | Get or set file date and time
2018-12-17T23:09:17.419865951Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.437796452Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.444634418Z 67 PC: 145ac | Get or set file attributes
2018-12-17T23:09:17.455939257Z 61 PC: 154c0 | Open file (Filename = 'C:\DOS\EXPAND.EXE')
2018-12-17T23:09:17.464846664Z 63 PC: 15593 | Read file or device (Read 33 bytes on handle 5)
2018-12-17T23:09:17.471123387Z 54 PC: 1454c | Get free disk space
2018-12-17T23:09:17.47773601Z 66 PC: 15d71 | Move file pointer
2018-12-17T23:09:17.480144567Z 66 PC: 15d7f | Move file pointer
2018-12-17T23:09:17.481674495Z 66 PC: 15d8d | Move file pointer
2018-12-17T23:09:17.48334236Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.486689765Z 67 PC: 145ac | Get or set file attributes
2018-12-17T23:09:17.497507886Z 61 PC: 154c0 | Open file (Filename = 'C:\DOS\EXPAND.EXE')
2018-12-17T23:09:17.505847179Z 87 PC: 145c6 | Get or set file date and time
2018-12-17T23:09:17.507563832Z 63 PC: 15593 | Read file or device (Read 14610 bytes on handle 5)
2018-12-17T23:09:17.518127533Z 67 PC: 145ac | Get or set file attributes
2018-12-17T23:09:17.531735821Z 61 PC: 154c0 | Open file (Filename = 'C:\DOS\README.TXT')
2018-12-17T23:09:17.53982116Z 87 PC: 145c6 | Get or set file date and time
2018-12-17T23:09:17.542047405Z 66 PC: 15d71 | Move file pointer
2018-12-17T23:09:17.544199213Z 66 PC: 15d7f | Move file pointer
2018-12-17T23:09:17.545686815Z 66 PC: 15d8d | Move file pointer
2018-12-17T23:09:17.547753561Z 44 PC: 15ba8 | Get time 0x15ba8: mov word ptr [0x3e], cx
0x15bac: mov word ptr [0x40], dx
0x15bb0: retf
0x15bb1: mov cx, di
0x15bb3: mov si, 0xa
0x15bb6: mov bx, dx
0x15bb8: or bx, bx
0x15bba: jns 0x15bcd
0x15bbc: neg bx
0x15bbe: neg ax
0x15bc0: sbb bx, 0
0x15bc3: call 0x15bcd
0x15bc6: dec di
0x15bc7: mov byte ptr es:[di], 0x2d
0x15bcb: inc cx
0x15bcc: ret
0x15bcd: xor dx, dx
0x15bcf: xchg ax, bx
0x15bd0: div si
0x15bd2: xchg ax, bx
2018-12-17T23:09:17.552176872Z 44 PC: 15ba8 | Get time 0x15ba8: mov word ptr [0x3e], cx
0x15bac: mov word ptr [0x40], dx
0x15bb0: retf
0x15bb1: mov cx, di
0x15bb3: mov si, 0xa
0x15bb6: mov bx, dx
0x15bb8: or bx, bx
0x15bba: jns 0x15bcd
0x15bbc: neg bx
0x15bbe: neg ax
0x15bc0: sbb bx, 0
0x15bc3: call 0x15bcd
0x15bc6: dec di
0x15bc7: mov byte ptr es:[di], 0x2d
0x15bcb: inc cx
0x15bcc: ret
0x15bcd: xor dx, dx
0x15bcf: xchg ax, bx
0x15bd0: div si
0x15bd2: xchg ax, bx
2018-12-17T23:09:17.555091519Z 66 PC: 15d71 | Move file pointer
2018-12-17T23:09:17.556590719Z 66 PC: 15d7f | Move file pointer
2018-12-17T23:09:17.558975215Z 66 PC: 15d8d | Move file pointer
2018-12-17T23:09:17.560636944Z 66 PC: 155f2 | Move file pointer
2018-12-17T23:09:17.562925Z 64 PC: 15593 | Write file or device (Write 14610 bytes on handle 6)
2018-12-17T23:09:17.583938429Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.585920482Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.595506279Z 61 PC: 154c0 | Open file (Filename = 'C:\DOS\EXPAND.EXE')
2018-12-17T23:09:17.60329769Z 64 PC: 15593 | Write file or device (Write 14610 bytes on handle 5)
2018-12-17T23:09:17.614398777Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.628586316Z 61 PC: 154c0 | Open file (Filename = 'C:\DOS\EXPAND.EXE')
2018-12-17T23:09:17.636683432Z 61 PC: 154c0 | Open file (Filename = 'C:\DOS\README.TXT')
2018-12-17T23:09:17.644439272Z 87 PC: 145f3 | Get or set file date and time
2018-12-17T23:09:17.647099326Z 87 PC: 145f3 | Get or set file date and time
2018-12-17T23:09:17.649086257Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.656029589Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.664530406Z 67 PC: 145ac | Get or set file attributes
2018-12-17T23:09:17.669471492Z 61 PC: 154c0 | Open file (Filename = 'C:\DOS\FDISK.EX')
2018-12-17T23:09:17.676007439Z 67 PC: 145ac | Get or set file attributes
2018-12-17T23:09:17.688043575Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\SYSTEM\KRNL386.EXE')
2018-12-17T23:09:17.695643968Z 63 PC: 15593 | Read file or device (Read 33 bytes on handle 5)
2018-12-17T23:09:17.70211414Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.712472675Z 67 PC: 145ac | Get or set file attributes
2018-12-17T23:09:17.724088016Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\DRWATSON.EXE')
2018-12-17T23:09:17.733526733Z 63 PC: 15593 | Read file or device (Read 33 bytes on handle 5)
2018-12-17T23:09:17.739671394Z 54 PC: 1454c | Get free disk space
2018-12-17T23:09:17.743099873Z 66 PC: 15d71 | Move file pointer
2018-12-17T23:09:17.745529031Z 66 PC: 15d7f | Move file pointer
2018-12-17T23:09:17.747294039Z 66 PC: 15d8d | Move file pointer
2018-12-17T23:09:17.749268823Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.752318068Z 67 PC: 145ac | Get or set file attributes
2018-12-17T23:09:17.762659376Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\DRWATSON.EXE')
2018-12-17T23:09:17.771136074Z 87 PC: 145c6 | Get or set file date and time
2018-12-17T23:09:17.772973079Z 63 PC: 15593 | Read file or device (Read 14610 bytes on handle 5)
2018-12-17T23:09:17.785461895Z 67 PC: 145ac | Get or set file attributes
2018-12-17T23:09:17.796499714Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\BOOTLOG.TXT')
2018-12-17T23:09:17.804605893Z 87 PC: 145c6 | Get or set file date and time
2018-12-17T23:09:17.806408945Z 66 PC: 15d71 | Move file pointer
2018-12-17T23:09:17.809510536Z 66 PC: 15d7f | Move file pointer
2018-12-17T23:09:17.814372365Z 66 PC: 15d8d | Move file pointer
2018-12-17T23:09:17.816673867Z 44 PC: 15ba8 | Get time 0x15ba8: mov word ptr [0x3e], cx
0x15bac: mov word ptr [0x40], dx
0x15bb0: retf
0x15bb1: mov cx, di
0x15bb3: mov si, 0xa
0x15bb6: mov bx, dx
0x15bb8: or bx, bx
0x15bba: jns 0x15bcd
0x15bbc: neg bx
0x15bbe: neg ax
0x15bc0: sbb bx, 0
0x15bc3: call 0x15bcd
0x15bc6: dec di
0x15bc7: mov byte ptr es:[di], 0x2d
0x15bcb: inc cx
0x15bcc: ret
0x15bcd: xor dx, dx
0x15bcf: xchg ax, bx
0x15bd0: div si
0x15bd2: xchg ax, bx
2018-12-17T23:09:17.820806322Z 44 PC: 15ba8 | Get time 0x15ba8: mov word ptr [0x3e], cx
0x15bac: mov word ptr [0x40], dx
0x15bb0: retf
0x15bb1: mov cx, di
0x15bb3: mov si, 0xa
0x15bb6: mov bx, dx
0x15bb8: or bx, bx
0x15bba: jns 0x15bcd
0x15bbc: neg bx
0x15bbe: neg ax
0x15bc0: sbb bx, 0
0x15bc3: call 0x15bcd
0x15bc6: dec di
0x15bc7: mov byte ptr es:[di], 0x2d
0x15bcb: inc cx
0x15bcc: ret
0x15bcd: xor dx, dx
0x15bcf: xchg ax, bx
0x15bd0: div si
0x15bd2: xchg ax, bx
2018-12-17T23:09:17.823729567Z 66 PC: 15d71 | Move file pointer
2018-12-17T23:09:17.825130292Z 66 PC: 15d7f | Move file pointer
2018-12-17T23:09:17.827773375Z 66 PC: 15d8d | Move file pointer
2018-12-17T23:09:17.829839493Z 66 PC: 155f2 | Move file pointer
2018-12-17T23:09:17.83284321Z 64 PC: 15593 | Write file or device (Write 14610 bytes on handle 6)
2018-12-17T23:09:17.84434934Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.846552262Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.85675978Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\DRWATSON.EXE')
2018-12-17T23:09:17.865008126Z 64 PC: 15593 | Write file or device (Write 14610 bytes on handle 5)
2018-12-17T23:09:17.875734583Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.884452797Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\DRWATSON.EXE')
2018-12-17T23:09:17.889258783Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\BOOTLOG.TXT')
2018-12-17T23:09:17.893908514Z 87 PC: 145f3 | Get or set file date and time
2018-12-17T23:09:17.898720523Z 87 PC: 145f3 | Get or set file date and time
2018-12-17T23:09:17.905220039Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.91188967Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.919520905Z 67 PC: 145ac | Get or set file attributes
2018-12-17T23:09:17.929611103Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\CLIPBRD.EXE')
2018-12-17T23:09:17.938377964Z 63 PC: 15593 | Read file or device (Read 33 bytes on handle 5)
2018-12-17T23:09:17.945084984Z 54 PC: 1454c | Get free disk space
2018-12-17T23:09:17.948769525Z 66 PC: 15d71 | Move file pointer
2018-12-17T23:09:17.951572854Z 66 PC: 15d7f | Move file pointer
2018-12-17T23:09:17.953271857Z 66 PC: 15d8d | Move file pointer
2018-12-17T23:09:17.954987413Z 62 PC: 15510 | Close file
2018-12-17T23:09:17.958363046Z 67 PC: 145ac | Get or set file attributes
2018-12-17T23:09:17.969700846Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\CLIPBRD.EXE')
2018-12-17T23:09:17.978122774Z 87 PC: 145c6 | Get or set file date and time
2018-12-17T23:09:17.980848193Z 63 PC: 15593 | Read file or device (Read 14610 bytes on handle 5)
2018-12-17T23:09:17.992750534Z 67 PC: 145ac | Get or set file attributes
2018-12-17T23:09:18.178764238Z 61 PC: 154c0 | Open file (Filename = 'C:\DOS\COUNTRY.TXT')
2018-12-17T23:09:18.187622021Z 87 PC: 145c6 | Get or set file date and time
2018-12-17T23:09:18.189473905Z 66 PC: 15d71 | Move file pointer
2018-12-17T23:09:18.192480982Z 66 PC: 15d7f | Move file pointer
2018-12-17T23:09:18.194109155Z 66 PC: 15d8d | Move file pointer
2018-12-17T23:09:18.196173026Z 44 PC: 15ba8 | Get time 0x15ba8: mov word ptr [0x3e], cx
0x15bac: mov word ptr [0x40], dx
0x15bb0: retf
0x15bb1: mov cx, di
0x15bb3: mov si, 0xa
0x15bb6: mov bx, dx
0x15bb8: or bx, bx
0x15bba: jns 0x15bcd
0x15bbc: neg bx
0x15bbe: neg ax
0x15bc0: sbb bx, 0
0x15bc3: call 0x15bcd
0x15bc6: dec di
0x15bc7: mov byte ptr es:[di], 0x2d
0x15bcb: inc cx
0x15bcc: ret
0x15bcd: xor dx, dx
0x15bcf: xchg ax, bx
0x15bd0: div si
0x15bd2: xchg ax, bx
2018-12-17T23:09:18.20100061Z 44 PC: 15ba8 | Get time 0x15ba8: mov word ptr [0x3e], cx
0x15bac: mov word ptr [0x40], dx
0x15bb0: retf
0x15bb1: mov cx, di
0x15bb3: mov si, 0xa
0x15bb6: mov bx, dx
0x15bb8: or bx, bx
0x15bba: jns 0x15bcd
0x15bbc: neg bx
0x15bbe: neg ax
0x15bc0: sbb bx, 0
0x15bc3: call 0x15bcd
0x15bc6: dec di
0x15bc7: mov byte ptr es:[di], 0x2d
0x15bcb: inc cx
0x15bcc: ret
0x15bcd: xor dx, dx
0x15bcf: xchg ax, bx
0x15bd0: div si
0x15bd2: xchg ax, bx
2018-12-17T23:09:18.204401613Z 66 PC: 15d71 | Move file pointer
2018-12-17T23:09:18.206027087Z 66 PC: 15d7f | Move file pointer
2018-12-17T23:09:18.209027918Z 66 PC: 15d8d | Move file pointer
2018-12-17T23:09:18.210718992Z 66 PC: 155f2 | Move file pointer
2018-12-17T23:09:18.212829474Z 64 PC: 15593 | Write file or device (Write 14610 bytes on handle 6)
2018-12-17T23:09:18.30162105Z 62 PC: 15510 | Close file
2018-12-17T23:09:18.303859759Z 62 PC: 15510 | Close file
2018-12-17T23:09:18.31346169Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\CLIPBRD.EXE')
2018-12-17T23:09:18.322510449Z 64 PC: 15593 | Write file or device (Write 14610 bytes on handle 5)
2018-12-17T23:09:18.3326206Z 62 PC: 15510 | Close file
2018-12-17T23:09:18.341968102Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\CLIPBRD.EXE')
2018-12-17T23:09:18.350622226Z 61 PC: 154c0 | Open file (Filename = 'C:\DOS\COUNTRY.TXT')
2018-12-17T23:09:18.359090875Z 87 PC: 145f3 | Get or set file date and time
2018-12-17T23:09:18.362512044Z 87 PC: 145f3 | Get or set file date and time
2018-12-17T23:09:18.365101746Z 62 PC: 15510 | Close file
2018-12-17T23:09:18.372315527Z 62 PC: 15510 | Close file
2018-12-17T23:09:18.381491104Z 67 PC: 145ac | Get or set file attributes
2018-12-17T23:09:18.392804005Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\CHARMAP.EXE')
2018-12-17T23:09:18.400900792Z 63 PC: 15593 | Read file or device (Read 33 bytes on handle 5)
2018-12-17T23:09:18.407828895Z 54 PC: 1454c | Get free disk space
2018-12-17T23:09:18.411313354Z 66 PC: 15d71 | Move file pointer
2018-12-17T23:09:18.413021468Z 66 PC: 15d7f | Move file pointer
2018-12-17T23:09:18.416280804Z 66 PC: 15d8d | Move file pointer
2018-12-17T23:09:18.418937113Z 62 PC: 15510 | Close file
2018-12-17T23:09:18.423663701Z 67 PC: 145ac | Get or set file attributes
2018-12-17T23:09:18.436074433Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\CHARMAP.EXE')
2018-12-17T23:09:18.445146373Z 87 PC: 145c6 | Get or set file date and time
2018-12-17T23:09:18.447304987Z 63 PC: 15593 | Read file or device (Read 14610 bytes on handle 5)
2018-12-17T23:09:18.459933008Z 67 PC: 145ac | Get or set file attributes
2018-12-17T23:09:18.477016078Z 61 PC: 154c0 | Open file (Filename = 'C:\DOS\README.TXT')
2018-12-17T23:09:18.485527382Z 87 PC: 145c6 | Get or set file date and time
2018-12-17T23:09:18.487829472Z 66 PC: 15d71 | Move file pointer
2018-12-17T23:09:18.489724765Z 66 PC: 15d7f | Move file pointer
2018-12-17T23:09:18.492537674Z 66 PC: 15d8d | Move file pointer
2018-12-17T23:09:18.495201155Z 44 PC: 15ba8 | Get time 0x15ba8: mov word ptr [0x3e], cx
0x15bac: mov word ptr [0x40], dx
0x15bb0: retf
0x15bb1: mov cx, di
0x15bb3: mov si, 0xa
0x15bb6: mov bx, dx
0x15bb8: or bx, bx
0x15bba: jns 0x15bcd
0x15bbc: neg bx
0x15bbe: neg ax
0x15bc0: sbb bx, 0
0x15bc3: call 0x15bcd
0x15bc6: dec di
0x15bc7: mov byte ptr es:[di], 0x2d
0x15bcb: inc cx
0x15bcc: ret
0x15bcd: xor dx, dx
0x15bcf: xchg ax, bx
0x15bd0: div si
0x15bd2: xchg ax, bx
2018-12-17T23:09:18.499463292Z 44 PC: 15ba8 | Get time 0x15ba8: mov word ptr [0x3e], cx
0x15bac: mov word ptr [0x40], dx
0x15bb0: retf
0x15bb1: mov cx, di
0x15bb3: mov si, 0xa
0x15bb6: mov bx, dx
0x15bb8: or bx, bx
0x15bba: jns 0x15bcd
0x15bbc: neg bx
0x15bbe: neg ax
0x15bc0: sbb bx, 0
0x15bc3: call 0x15bcd
0x15bc6: dec di
0x15bc7: mov byte ptr es:[di], 0x2d
0x15bcb: inc cx
0x15bcc: ret
0x15bcd: xor dx, dx
0x15bcf: xchg ax, bx
0x15bd0: div si
0x15bd2: xchg ax, bx
2018-12-17T23:09:18.503820923Z 66 PC: 15d71 | Move file pointer
2018-12-17T23:09:18.505931384Z 66 PC: 15d7f | Move file pointer
2018-12-17T23:09:18.507867317Z 66 PC: 15d8d | Move file pointer
2018-12-17T23:09:18.51140249Z 66 PC: 155f2 | Move file pointer
2018-12-17T23:09:18.51344116Z 64 PC: 15593 | Write file or device (Write 14610 bytes on handle 6)
2018-12-17T23:09:18.525441774Z 62 PC: 15510 | Close file
2018-12-17T23:09:18.528271024Z 62 PC: 15510 | Close file
2018-12-17T23:09:18.537019841Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\CHARMAP.EXE')
2018-12-17T23:09:18.546860287Z 64 PC: 15593 | Write file or device (Write 14610 bytes on handle 5)
2018-12-17T23:09:18.557538561Z 62 PC: 15510 | Close file
2018-12-17T23:09:18.56650252Z 61 PC: 154c0 | Open file (Filename = 'C:\WINDOWS\CHARMAP.EXE')
2018-12-17T23:09:18.578263909Z 61 PC: 154c0 | Open file (Filename = 'C:\DOS\README.TXT')
2018-12-17T23:09:18.586131374Z 87 PC: 145f3 | Get or set file date and time
2018-12-17T23:09:18.587997925Z 87 PC: 145f3 | Get or set file date and time
2018-12-17T23:09:18.590319305Z 62 PC: 15510 | Close file
2018-12-17T23:09:18.598696227Z 62 PC: 15510 | Close file
2018-12-17T23:09:18.606387854Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:18.608020064Z 78 PC: 1462f | Find first file
2018-12-17T23:09:18.610856615Z 60 PC: 154c0 | Create or truncate file
2018-12-17T23:09:18.614070364Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:18.615647439Z 78 PC: 1462f | Find first file
2018-12-17T23:09:18.617734303Z 60 PC: 154c0 | Create or truncate file
2018-12-17T23:09:18.622410948Z 26 PC: 14623 | Set disk transfer address
2018-12-17T23:09:18.624299533Z 78 PC: 1462f | Find first file
2018-12-17T23:09:18.627009761Z 60 PC: 154c0 | Create or truncate file
2018-12-17T23:09:18.630875242Z 37 PC: 14ef1 | Set interrupt vector (Interrupt = '0' AKA 'Program terminate')
2018-12-17T23:09:18.632166784Z 37 PC: 14ef1 | Set interrupt vector (Interrupt = '2' AKA 'Character output')
2018-12-17T23:09:18.633273081Z 37 PC: 14ef1 | Set interrupt vector (Interrupt = '27' AKA 'Get allocation info for default drive')
2018-12-17T23:09:18.635349703Z 37 PC: 14ef1 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-17T23:09:18.636953569Z 37 PC: 14ef1 | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T23:09:18.63852612Z 37 PC: 14ef1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T23:09:18.648406069Z 37 PC: 14ef1 | Set interrupt vector (Interrupt = '52' AKA 'Get InDOS flag pointer')
2018-12-17T23:09:18.650641819Z 37 PC: 14ef1 | Set interrupt vector (Interrupt = '53' AKA 'Get interrupt vector')
2018-12-17T23:09:18.652478169Z 37 PC: 14ef1 | Set interrupt vector (Interrupt = '54' AKA 'Get free disk space')
2018-12-17T23:09:18.654982245Z 37 PC: 14ef1 | Set interrupt vector (Interrupt = '55' AKA 'Get or set switch character')
2018-12-17T23:09:18.656763467Z 37 PC: 14ef1 | Set interrupt vector (Interrupt = '56' AKA 'Get or set country info')
2018-12-17T23:09:18.659804536Z 37 PC: 14ef1 | Set interrupt vector (Interrupt = '57' AKA 'Create subdirectory')
2018-12-17T23:09:18.661123915Z 37 PC: 14ef1 | Set interrupt vector (Interrupt = '58' AKA 'Remove subdirectory')
2018-12-17T23:09:18.662637813Z 37 PC: 14ef1 | Set interrupt vector (Interrupt = '59' AKA 'Change current directory')
2018-12-17T23:09:18.665748067Z 37 PC: 14ef1 | Set interrupt vector (Interrupt = '60' AKA 'Create or truncate file')
2018-12-17T23:09:18.668275666Z 37 PC: 14ef1 | Set interrupt vector (Interrupt = '61' AKA 'Open file')
2018-12-17T23:09:18.669812544Z 37 PC: 14ef1 | Set interrupt vector (Interrupt = '62' AKA 'Close file')
2018-12-17T23:09:18.673444557Z 37 PC: 14ef1 | Set interrupt vector (Interrupt = '63' AKA 'Read file or device')
2018-12-17T23:09:18.675143543Z 37 PC: 14ef1 | Set interrupt vector (Interrupt = '117' AKA 'UNKNOWN!')
2018-12-17T23:09:18.678015394Z 76 PC: 14f30 | Terminate with return code (Return code = '0')