Sample viewer

vx.netlux.org/Virus.DOS.HLLP.Anticheck.6016

.

GIF

Syscalls:

Time Syscall Op Syscall Name
2018-12-17T22:08:24.581259669Z 74 PC: 13cca | Reallocate memory
2018-12-17T22:08:24.649738312Z 74 PC: 19209 | Reallocate memory
2018-12-17T22:08:24.652292265Z 98 PC: 18706 | Get current PSP
2018-12-17T22:08:24.654075134Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:24.660015213Z 65 PC: 13cc2 | Delete file (Filename = 'anti-vir.dat')
2018-12-17T22:08:24.66566361Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:24.671123697Z 65 PC: 13cc2 | Delete file (Filename = 'chklist.ms')
2018-12-17T22:08:24.677045354Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:24.682710878Z 65 PC: 13cc2 | Delete file (Filename = 'chklist.cps')
2018-12-17T22:08:24.688322428Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:24.693924994Z 65 PC: 13cc2 | Delete file (Filename = 'vs.vsn')
2018-12-17T22:08:24.70012034Z 26 PC: 12be8 | Set disk transfer address
2018-12-17T22:08:24.70107991Z 78 PC: 12bfa | Find first file
2018-12-17T22:08:24.706745826Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:24.712300488Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:24.72784102Z 61 PC: 133a7 | Open file (Filename = 'A:\TEST.EXE')
2018-12-17T22:08:24.734175199Z 63 PC: 13449 | Read file or device (Read 6016 bytes on handle 5)
2018-12-17T22:08:24.74162407Z 62 PC: 1348f | Close file
2018-12-17T22:08:24.743487772Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:24.753190548Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:24.759192744Z 65 PC: 13cc2 | Delete file (Filename = 'anti-vir.dat')
2018-12-17T22:08:24.765380515Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:24.770744808Z 65 PC: 13cc2 | Delete file (Filename = 'chklist.ms')
2018-12-17T22:08:24.77677052Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:24.782338743Z 65 PC: 13cc2 | Delete file (Filename = 'chklist.cps')
2018-12-17T22:08:24.787934984Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:24.793705328Z 65 PC: 13cc2 | Delete file (Filename = 'vs.vsn')
2018-12-17T22:08:24.799522002Z 47 PC: 18545 | Get disk transfer address
2018-12-17T22:08:24.800517378Z 26 PC: 18550 | Set disk transfer address
2018-12-17T22:08:24.801961876Z 78 PC: 1855c | Find first file
2018-12-17T22:08:24.807847267Z 26 PC: 1856e | Set disk transfer address
2018-12-17T22:08:24.810833665Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:24.817553504Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:24.818505456Z 78 PC: 13baa | Find first file
2018-12-17T22:08:24.824056599Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:24.830802411Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:24.840265157Z 61 PC: 133a7 | Open file (Filename = 'TEST.EXE')
2018-12-17T22:08:24.846581062Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:24.848769907Z 63 PC: 13449 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:08:24.851184529Z 62 PC: 1348f | Close file
2018-12-17T22:08:24.852756112Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:24.862332659Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:24.863683848Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:24.864718225Z 79 PC: 18591 | Find next file
2018-12-17T22:08:24.867200587Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:24.868990594Z 47 PC: 18545 | Get disk transfer address
2018-12-17T22:08:24.869941394Z 26 PC: 18550 | Set disk transfer address
2018-12-17T22:08:24.871009281Z 78 PC: 1855c | Find first file
2018-12-17T22:08:24.877150228Z 26 PC: 1856e | Set disk transfer address
2018-12-17T22:08:24.879915026Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:24.886135605Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:24.887108289Z 78 PC: 13baa | Find first file
2018-12-17T22:08:24.897900251Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:24.899100259Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:24.900625094Z 79 PC: 18591 | Find next file
2018-12-17T22:08:24.903181764Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:24.906339454Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:24.912365692Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:24.913334407Z 78 PC: 13baa | Find first file
2018-12-17T22:08:24.919133573Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:24.920484824Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:24.921777646Z 79 PC: 18591 | Find next file
2018-12-17T22:08:24.924393509Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:24.927242263Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:24.933173192Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:24.934187079Z 78 PC: 13baa | Find first file
2018-12-17T22:08:24.940089445Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:24.941052074Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:24.942018025Z 79 PC: 18591 | Find next file
2018-12-17T22:08:24.944528837Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:24.947207675Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:24.95833012Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:24.959427788Z 78 PC: 13baa | Find first file
2018-12-17T22:08:24.965214509Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:24.966195306Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:24.967266222Z 79 PC: 18591 | Find next file
2018-12-17T22:08:24.969726206Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:24.972576445Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:24.978610461Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:24.979598555Z 78 PC: 13baa | Find first file
2018-12-17T22:08:24.985378435Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:24.987709909Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:24.988691067Z 79 PC: 18591 | Find next file
2018-12-17T22:08:24.991029628Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:24.994257244Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:25.000301021Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:25.001307919Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:25.003093729Z 79 PC: 18591 | Find next file
2018-12-17T22:08:25.005412093Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:25.008050809Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:25.014414129Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:25.015672188Z 78 PC: 13baa | Find first file
2018-12-17T22:08:25.021667437Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:25.023288328Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:25.024264737Z 79 PC: 18591 | Find next file
2018-12-17T22:08:25.027188295Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:25.029009478Z 98 PC: 1873d | Get current PSP
2018-12-17T22:08:25.03044541Z 98 PC: 1873d | Get current PSP
2018-12-17T22:08:25.032082777Z 98 PC: 1873d | Get current PSP
2018-12-17T22:08:25.034218497Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:25.04311476Z 65 PC: 13cc2 | Delete file (Filename = 'C:\DOS\anti-vir.dat')
2018-12-17T22:08:25.049372009Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:25.055949096Z 65 PC: 13cc2 | Delete file (Filename = 'C:\DOS\chklist.ms')
2018-12-17T22:08:25.062238541Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:25.068353222Z 65 PC: 13cc2 | Delete file (Filename = 'C:\DOS\chklist.cps')
2018-12-17T22:08:25.075380259Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:25.081465127Z 65 PC: 13cc2 | Delete file (Filename = 'C:\DOS\vs.vsn')
2018-12-17T22:08:25.087930021Z 47 PC: 18545 | Get disk transfer address
2018-12-17T22:08:25.090315196Z 26 PC: 18550 | Set disk transfer address
2018-12-17T22:08:25.091520839Z 78 PC: 1855c | Find first file
2018-12-17T22:08:25.097901267Z 26 PC: 1856e | Set disk transfer address
2018-12-17T22:08:25.101274978Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:25.107335746Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:25.10917055Z 78 PC: 13baa | Find first file
2018-12-17T22:08:25.115606518Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:25.121637473Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:25.460563345Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\ATTRIB.EXE')
2018-12-17T22:08:25.469009836Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:25.471258095Z 63 PC: 13449 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:08:25.477580804Z 62 PC: 1348f | Close file
2018-12-17T22:08:25.481474504Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:25.49737042Z 86 PC: 1400c | Rename file
2018-12-17T22:08:25.508682048Z 26 PC: 13141 | Set disk transfer address
2018-12-17T22:08:25.510743822Z 78 PC: 13153 | Find first file
2018-12-17T22:08:25.518049543Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:25.525359163Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:25.53655357Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\ATTRIB.”Ž”')
2018-12-17T22:08:25.543099486Z 87 PC: 13314 | Get or set file date and time
2018-12-17T22:08:25.54499822Z 63 PC: 13449 | Read file or device (Read 6016 bytes on handle 5)
2018-12-17T22:08:25.550992978Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:25.552590418Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:25.557893649Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:25.57194643Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:25.587621849Z 87 PC: 13376 | Get or set file date and time
2018-12-17T22:08:25.589590511Z 62 PC: 1348f | Close file
2018-12-17T22:08:25.606512434Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:25.617181227Z 86 PC: 14025 | Rename file
2018-12-17T22:08:25.628396855Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:25.63041046Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:25.631479534Z 79 PC: 18591 | Find next file
2018-12-17T22:08:25.634463449Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:25.638721723Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:25.64527994Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:25.646705347Z 78 PC: 13baa | Find first file
2018-12-17T22:08:25.654115254Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:25.660782513Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:25.978185435Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\CHKDSK.EXE')
2018-12-17T22:08:25.986471334Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:25.989720165Z 63 PC: 13449 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:08:25.995679054Z 62 PC: 1348f | Close file
2018-12-17T22:08:25.99860716Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:26.00888857Z 86 PC: 1400c | Rename file
2018-12-17T22:08:26.019890535Z 26 PC: 13141 | Set disk transfer address
2018-12-17T22:08:26.021556997Z 78 PC: 13153 | Find first file
2018-12-17T22:08:26.025629883Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:26.031679204Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:26.038805108Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\CHKDSK.•–§')
2018-12-17T22:08:26.045721684Z 87 PC: 13314 | Get or set file date and time
2018-12-17T22:08:26.048040128Z 63 PC: 13449 | Read file or device (Read 6016 bytes on handle 5)
2018-12-17T22:08:26.055612005Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:26.0580987Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:26.065575139Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:26.085286178Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:26.097331185Z 87 PC: 13376 | Get or set file date and time
2018-12-17T22:08:26.098472242Z 62 PC: 1348f | Close file
2018-12-17T22:08:26.103657857Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:26.110436669Z 86 PC: 14025 | Rename file
2018-12-17T22:08:26.118864203Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:26.120049452Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:26.121075197Z 79 PC: 18591 | Find next file
2018-12-17T22:08:26.123150727Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:26.125705734Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:26.129822689Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:26.13064831Z 78 PC: 13baa | Find first file
2018-12-17T22:08:26.135967959Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:26.141099186Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:26.151392253Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\DEBUG.EXE')
2018-12-17T22:08:26.160753252Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:26.162492382Z 63 PC: 13449 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:08:26.166369841Z 62 PC: 1348f | Close file
2018-12-17T22:08:26.16836118Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:26.179263668Z 86 PC: 1400c | Rename file
2018-12-17T22:08:26.189890072Z 26 PC: 13141 | Set disk transfer address
2018-12-17T22:08:26.191421708Z 78 PC: 13153 | Find first file
2018-12-17T22:08:26.19753395Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:26.203409705Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:26.213920663Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\DEBUG.‘ŖĨ')
2018-12-17T22:08:26.22065566Z 87 PC: 13314 | Get or set file date and time
2018-12-17T22:08:26.221987874Z 63 PC: 13449 | Read file or device (Read 6016 bytes on handle 5)
2018-12-17T22:08:26.229467094Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:26.231137592Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:26.239108635Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:26.258954006Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:26.268315201Z 87 PC: 13376 | Get or set file date and time
2018-12-17T22:08:26.269983774Z 62 PC: 1348f | Close file
2018-12-17T22:08:26.277852735Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:26.287693189Z 86 PC: 14025 | Rename file
2018-12-17T22:08:26.298569507Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:26.301681142Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:26.30399534Z 79 PC: 18591 | Find next file
2018-12-17T22:08:26.307512898Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:26.311193977Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:26.31763322Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:26.319164404Z 78 PC: 13baa | Find first file
2018-12-17T22:08:26.326285417Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:26.332248174Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:26.341814712Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\EXPAND.EXE')
2018-12-17T22:08:26.349718274Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:26.35214484Z 63 PC: 13449 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:08:26.367444569Z 62 PC: 1348f | Close file
2018-12-17T22:08:26.370035434Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:26.380875604Z 86 PC: 1400c | Rename file
2018-12-17T22:08:26.392012287Z 26 PC: 13141 | Set disk transfer address
2018-12-17T22:08:26.393969483Z 78 PC: 13153 | Find first file
2018-12-17T22:08:26.400448136Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:26.404498735Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:26.415122032Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\EXPAND.ĻŸ­')
2018-12-17T22:08:26.423026455Z 87 PC: 13314 | Get or set file date and time
2018-12-17T22:08:26.424770702Z 63 PC: 13449 | Read file or device (Read 6016 bytes on handle 5)
2018-12-17T22:08:26.432585293Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:26.43460662Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:26.442465875Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:26.461526889Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:26.470237589Z 87 PC: 13376 | Get or set file date and time
2018-12-17T22:08:26.472216288Z 62 PC: 1348f | Close file
2018-12-17T22:08:26.479034789Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:26.488320547Z 86 PC: 14025 | Rename file
2018-12-17T22:08:26.501720545Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:26.502755285Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:26.503696697Z 79 PC: 18591 | Find next file
2018-12-17T22:08:26.507722358Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:26.510478231Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:26.516423695Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:26.518167806Z 78 PC: 13baa | Find first file
2018-12-17T22:08:26.524388549Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:26.530084549Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:26.540757889Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\FDISK.EXE')
2018-12-17T22:08:26.547754419Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:26.549659933Z 63 PC: 13449 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:08:26.55605851Z 62 PC: 1348f | Close file
2018-12-17T22:08:26.558510463Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:26.568229621Z 86 PC: 1400c | Rename file
2018-12-17T22:08:26.579876912Z 26 PC: 13141 | Set disk transfer address
2018-12-17T22:08:26.580967602Z 78 PC: 13153 | Find first file
2018-12-17T22:08:26.587061957Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:26.594240853Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:26.603601466Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\FDISK.šŦ•')
2018-12-17T22:08:26.610507685Z 87 PC: 13314 | Get or set file date and time
2018-12-17T22:08:26.613238469Z 63 PC: 13449 | Read file or device (Read 6016 bytes on handle 5)
2018-12-17T22:08:26.622422149Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:26.624417758Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:26.633656647Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:26.653248175Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:26.666384672Z 87 PC: 13376 | Get or set file date and time
2018-12-17T22:08:26.669208895Z 62 PC: 1348f | Close file
2018-12-17T22:08:26.676347011Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:26.686557966Z 86 PC: 14025 | Rename file
2018-12-17T22:08:26.698122078Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:26.699166381Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:26.700061486Z 79 PC: 18591 | Find next file
2018-12-17T22:08:26.70382011Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:26.706882186Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:26.713310809Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:26.715558984Z 78 PC: 13baa | Find first file
2018-12-17T22:08:26.722049623Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:26.72833895Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:26.747907642Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\MEM.EXE')
2018-12-17T22:08:26.755427696Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:26.757651022Z 63 PC: 13449 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:08:26.765835788Z 62 PC: 1348f | Close file
2018-12-17T22:08:26.768031407Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:26.778661444Z 86 PC: 1400c | Rename file
2018-12-17T22:08:26.790192921Z 26 PC: 13141 | Set disk transfer address
2018-12-17T22:08:26.791617527Z 78 PC: 13153 | Find first file
2018-12-17T22:08:26.798976883Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:26.80560982Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:26.816473337Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\MEM.—')
2018-12-17T22:08:26.826032911Z 87 PC: 13314 | Get or set file date and time
2018-12-17T22:08:26.827923134Z 63 PC: 13449 | Read file or device (Read 6016 bytes on handle 5)
2018-12-17T22:08:26.835349787Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:26.838732701Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:26.846467256Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:26.865718631Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:27.0751127Z 87 PC: 13376 | Get or set file date and time
2018-12-17T22:08:27.0767698Z 62 PC: 1348f | Close file
2018-12-17T22:08:27.196001558Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:27.207683336Z 86 PC: 14025 | Rename file
2018-12-17T22:08:27.220768777Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:27.222194865Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:27.22917637Z 79 PC: 18591 | Find next file
2018-12-17T22:08:27.232819875Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:27.236009013Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:27.2435846Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:27.245187164Z 78 PC: 13baa | Find first file
2018-12-17T22:08:27.251775526Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:27.259250407Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:27.269678998Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\NLSFUNC.EXE')
2018-12-17T22:08:27.276944119Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:27.279951913Z 63 PC: 13449 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:08:27.285773661Z 62 PC: 1348f | Close file
2018-12-17T22:08:27.287868524Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:27.297479981Z 86 PC: 1400c | Rename file
2018-12-17T22:08:27.306952026Z 26 PC: 13141 | Set disk transfer address
2018-12-17T22:08:27.308439862Z 78 PC: 13153 | Find first file
2018-12-17T22:08:27.315815755Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:27.321475665Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:27.331044048Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\NLSFUNC.Ą–˜')
2018-12-17T22:08:27.336968776Z 87 PC: 13314 | Get or set file date and time
2018-12-17T22:08:27.338457123Z 63 PC: 13449 | Read file or device (Read 6016 bytes on handle 5)
2018-12-17T22:08:27.343979988Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:27.345357387Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:27.351487Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:27.36244756Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:27.371431255Z 87 PC: 13376 | Get or set file date and time
2018-12-17T22:08:27.372933774Z 62 PC: 1348f | Close file
2018-12-17T22:08:27.380833314Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:27.390971511Z 86 PC: 14025 | Rename file
2018-12-17T22:08:27.402878662Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:27.404566474Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:27.405524716Z 79 PC: 18591 | Find next file
2018-12-17T22:08:27.408300146Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:27.412185418Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:27.418780265Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:27.420316987Z 78 PC: 13baa | Find first file
2018-12-17T22:08:27.427263132Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:27.433318043Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:27.443203486Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\QBASIC.EXE')
2018-12-17T22:08:27.451223114Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:27.453262545Z 63 PC: 13449 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:08:27.459408697Z 62 PC: 1348f | Close file
2018-12-17T22:08:27.46169963Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:27.4735857Z 86 PC: 1400c | Rename file
2018-12-17T22:08:27.48540966Z 26 PC: 13141 | Set disk transfer address
2018-12-17T22:08:27.486895445Z 78 PC: 13153 | Find first file
2018-12-17T22:08:27.493469486Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:27.500458792Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:27.510220209Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\QBASIC.Œ')
2018-12-17T22:08:27.517378252Z 87 PC: 13314 | Get or set file date and time
2018-12-17T22:08:27.519714258Z 63 PC: 13449 | Read file or device (Read 6016 bytes on handle 5)
2018-12-17T22:08:27.52702368Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:27.529776876Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:27.538296177Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:27.557530309Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:27.566648496Z 87 PC: 13376 | Get or set file date and time
2018-12-17T22:08:27.568590704Z 62 PC: 1348f | Close file
2018-12-17T22:08:27.575650221Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:27.586330898Z 86 PC: 14025 | Rename file
2018-12-17T22:08:27.598831766Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:27.600091522Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:27.601926587Z 79 PC: 18591 | Find next file
2018-12-17T22:08:27.60508901Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:27.608156154Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:27.615400666Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:27.617200977Z 78 PC: 13baa | Find first file
2018-12-17T22:08:27.623802146Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:27.631512222Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:27.641405897Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\REPLACE.EXE')
2018-12-17T22:08:27.648431711Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:27.651305236Z 63 PC: 13449 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:08:27.656809413Z 62 PC: 1348f | Close file
2018-12-17T22:08:27.658769808Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:27.670447675Z 86 PC: 1400c | Rename file
2018-12-17T22:08:27.681082806Z 26 PC: 13141 | Set disk transfer address
2018-12-17T22:08:27.683263206Z 78 PC: 13153 | Find first file
2018-12-17T22:08:27.689639242Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:27.695556547Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:27.706093318Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\REPLACE.ĒĢ')
2018-12-17T22:08:27.712864986Z 87 PC: 13314 | Get or set file date and time
2018-12-17T22:08:27.714306747Z 63 PC: 13449 | Read file or device (Read 6016 bytes on handle 5)
2018-12-17T22:08:27.722396308Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:27.724958352Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:27.732357863Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:27.751820552Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:27.760743828Z 87 PC: 13376 | Get or set file date and time
2018-12-17T22:08:27.762220942Z 62 PC: 1348f | Close file
2018-12-17T22:08:27.770098083Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:27.779687246Z 86 PC: 14025 | Rename file
2018-12-17T22:08:27.792520679Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:27.794063702Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:27.795540849Z 79 PC: 18591 | Find next file
2018-12-17T22:08:27.800080126Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:27.803463027Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:27.809594028Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:27.811843702Z 78 PC: 13baa | Find first file
2018-12-17T22:08:27.818452007Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:27.824739041Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:27.835456627Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\RESTORE.EXE')
2018-12-17T22:08:27.842607211Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:27.844691008Z 63 PC: 13449 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:08:27.85146273Z 62 PC: 1348f | Close file
2018-12-17T22:08:27.853579088Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:27.864412254Z 86 PC: 1400c | Rename file
2018-12-17T22:08:27.876207863Z 26 PC: 13141 | Set disk transfer address
2018-12-17T22:08:27.877221187Z 78 PC: 13153 | Find first file
2018-12-17T22:08:27.883571945Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:27.889779636Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:27.899528662Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\RESTORE.ŽŖ')
2018-12-17T22:08:27.907376208Z 87 PC: 13314 | Get or set file date and time
2018-12-17T22:08:27.908944147Z 63 PC: 13449 | Read file or device (Read 6016 bytes on handle 5)
2018-12-17T22:08:27.916230194Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:27.918704625Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:27.926928263Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:27.945984687Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:27.955370333Z 87 PC: 13376 | Get or set file date and time
2018-12-17T22:08:27.957167138Z 62 PC: 1348f | Close file
2018-12-17T22:08:27.964321237Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:27.974111107Z 86 PC: 14025 | Rename file
2018-12-17T22:08:27.985514129Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:27.986974071Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:27.987938176Z 79 PC: 18591 | Find next file
2018-12-17T22:08:27.990826544Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:27.994799233Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:28.001039532Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:28.00221059Z 78 PC: 13baa | Find first file
2018-12-17T22:08:28.009714466Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:28.015770523Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:28.025911054Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\SCANDISK.EXE')
2018-12-17T22:08:28.033361534Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:28.035228702Z 63 PC: 13449 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:08:28.041255624Z 62 PC: 1348f | Close file
2018-12-17T22:08:28.043110255Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:28.053873253Z 86 PC: 1400c | Rename file
2018-12-17T22:08:28.065337947Z 26 PC: 13141 | Set disk transfer address
2018-12-17T22:08:28.066620094Z 78 PC: 13153 | Find first file
2018-12-17T22:08:28.072799983Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:28.079959036Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:28.089451097Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\SCANDISK.—¤ž')
2018-12-17T22:08:28.097551334Z 87 PC: 13314 | Get or set file date and time
2018-12-17T22:08:28.099078138Z 63 PC: 13449 | Read file or device (Read 6016 bytes on handle 5)
2018-12-17T22:08:28.106365614Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:28.108841681Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:28.117550118Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:28.136818303Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:28.146442966Z 87 PC: 13376 | Get or set file date and time
2018-12-17T22:08:28.148112623Z 62 PC: 1348f | Close file
2018-12-17T22:08:28.155258132Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:28.165494945Z 86 PC: 14025 | Rename file
2018-12-17T22:08:28.177012714Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:28.178202947Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:28.179640511Z 79 PC: 18591 | Find next file
2018-12-17T22:08:28.182864226Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:28.186248171Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:28.192285435Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:28.193231088Z 78 PC: 13baa | Find first file
2018-12-17T22:08:28.200365775Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:28.206455301Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:28.215907392Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\SETUP.EXE')
2018-12-17T22:08:28.223700624Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:28.225511989Z 63 PC: 13449 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:08:28.232493012Z 62 PC: 1348f | Close file
2018-12-17T22:08:28.234349048Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:28.24582088Z 86 PC: 1400c | Rename file
2018-12-17T22:08:28.258336268Z 26 PC: 13141 | Set disk transfer address
2018-12-17T22:08:28.259529942Z 78 PC: 13153 | Find first file
2018-12-17T22:08:28.265723521Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:28.272512906Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:28.281801904Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\SETUP.˜Ž')
2018-12-17T22:08:28.289295289Z 87 PC: 13314 | Get or set file date and time
2018-12-17T22:08:28.291605993Z 63 PC: 13449 | Read file or device (Read 6016 bytes on handle 5)
2018-12-17T22:08:28.298572564Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:28.300279662Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:28.308295182Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:28.327198105Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:28.336208182Z 87 PC: 13376 | Get or set file date and time
2018-12-17T22:08:28.337704834Z 62 PC: 1348f | Close file
2018-12-17T22:08:28.344447524Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:28.355548469Z 86 PC: 14025 | Rename file
2018-12-17T22:08:28.367866941Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:28.369234406Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:28.371646195Z 79 PC: 18591 | Find next file
2018-12-17T22:08:28.375200015Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:28.378174156Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:28.391604115Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:28.392648646Z 78 PC: 13baa | Find first file
2018-12-17T22:08:28.399009565Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:28.405299036Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:28.41481628Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\XCOPY.EXE')
2018-12-17T22:08:28.42217416Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:28.424097425Z 63 PC: 13449 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:08:28.429434112Z 62 PC: 1348f | Close file
2018-12-17T22:08:28.432262895Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:28.442204342Z 86 PC: 1400c | Rename file
2018-12-17T22:08:28.453021653Z 26 PC: 13141 | Set disk transfer address
2018-12-17T22:08:28.455138593Z 78 PC: 13153 | Find first file
2018-12-17T22:08:28.46133695Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:28.467718268Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:28.47735618Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\XCOPY.ŽŦ•')
2018-12-17T22:08:28.48414257Z 87 PC: 13314 | Get or set file date and time
2018-12-17T22:08:28.486441181Z 63 PC: 13449 | Read file or device (Read 6016 bytes on handle 5)
2018-12-17T22:08:28.494405989Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:28.496182781Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:28.503877663Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:28.523076886Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:28.533167951Z 87 PC: 13376 | Get or set file date and time
2018-12-17T22:08:28.534945567Z 62 PC: 1348f | Close file
2018-12-17T22:08:28.542563632Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:28.549120571Z 86 PC: 14025 | Rename file
2018-12-17T22:08:28.556387944Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:28.55759184Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:28.558481148Z 79 PC: 18591 | Find next file
2018-12-17T22:08:28.561327497Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:28.564536836Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:28.570625088Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:28.571535407Z 78 PC: 13baa | Find first file
2018-12-17T22:08:28.578092156Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:28.583803202Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:28.593271509Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\DEFRAG.EXE')
2018-12-17T22:08:28.600208186Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:28.601865325Z 63 PC: 13449 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:08:28.608215546Z 62 PC: 1348f | Close file
2018-12-17T22:08:28.609979172Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:28.620414175Z 86 PC: 1400c | Rename file
2018-12-17T22:08:28.63145112Z 26 PC: 13141 | Set disk transfer address
2018-12-17T22:08:28.632751333Z 78 PC: 13153 | Find first file
2018-12-17T22:08:28.639297832Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:28.645809599Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:28.655318243Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\DEFRAG.Ÿ™ĸ')
2018-12-17T22:08:28.664697281Z 87 PC: 13314 | Get or set file date and time
2018-12-17T22:08:28.666509226Z 63 PC: 13449 | Read file or device (Read 6016 bytes on handle 5)
2018-12-17T22:08:28.674019882Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:28.677264983Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:28.685869413Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:28.70586755Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:28.716578589Z 87 PC: 13376 | Get or set file date and time
2018-12-17T22:08:28.718453671Z 62 PC: 1348f | Close file
2018-12-17T22:08:28.726694036Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:28.737173607Z 86 PC: 14025 | Rename file
2018-12-17T22:08:28.754346452Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:28.755980002Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:28.757477292Z 79 PC: 18591 | Find next file
2018-12-17T22:08:28.760651023Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:28.764925571Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:28.771131207Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:28.772385862Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:28.773784961Z 79 PC: 18591 | Find next file
2018-12-17T22:08:28.776936001Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:28.780554014Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:28.786746216Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:28.787931156Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:28.789774785Z 79 PC: 18591 | Find next file
2018-12-17T22:08:28.792695971Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:28.794944773Z 47 PC: 18545 | Get disk transfer address
2018-12-17T22:08:28.796874815Z 26 PC: 18550 | Set disk transfer address
2018-12-17T22:08:28.798327873Z 78 PC: 1855c | Find first file
2018-12-17T22:08:28.805125835Z 26 PC: 1856e | Set disk transfer address
2018-12-17T22:08:28.807840418Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:28.813872177Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:28.815452014Z 78 PC: 13baa | Find first file
2018-12-17T22:08:28.822416368Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:28.824374942Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:28.825710602Z 79 PC: 18591 | Find next file
2018-12-17T22:08:28.82855735Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:28.831870081Z 61 PC: 138ee | Open file (Filename = 'chekmate.ini')
2018-12-17T22:08:28.837953282Z 26 PC: 13b98 | Set disk transfer address
2018-12-17T22:08:28.839650452Z 78 PC: 13baa | Find first file
2018-12-17T22:08:28.845975417Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:28.851887603Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:28.867247238Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\FORMAT.COM')
2018-12-17T22:08:28.874228645Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:28.876173835Z 63 PC: 13449 | Read file or device (Read 4 bytes on handle 5)
2018-12-17T22:08:28.883453283Z 62 PC: 1348f | Close file
2018-12-17T22:08:28.885275677Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:28.905012126Z 86 PC: 1400c | Rename file
2018-12-17T22:08:28.915908101Z 26 PC: 13141 | Set disk transfer address
2018-12-17T22:08:28.916886296Z 78 PC: 13153 | Find first file
2018-12-17T22:08:28.928067851Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:28.933987531Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:28.945113866Z 61 PC: 133a7 | Open file (Filename = 'C:\DOS\FORMAT.‘Ĩ')
2018-12-17T22:08:28.953250979Z 87 PC: 13314 | Get or set file date and time
2018-12-17T22:08:28.955124917Z 63 PC: 13449 | Read file or device (Read 6016 bytes on handle 5)
2018-12-17T22:08:28.962512342Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:28.964521336Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:28.973003612Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:28.992041755Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:29.001122837Z 87 PC: 13376 | Get or set file date and time
2018-12-17T22:08:29.003090241Z 62 PC: 1348f | Close file
2018-12-17T22:08:29.010193463Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:29.021138375Z 86 PC: 14025 | Rename file
2018-12-17T22:08:29.031949529Z 47 PC: 18582 | Get disk transfer address
2018-12-17T22:08:29.032890417Z 26 PC: 1858d | Set disk transfer address
2018-12-17T22:08:29.03448926Z 79 PC: 18591 | Find next file
2018-12-17T22:08:29.037339996Z 26 PC: 185a1 | Set disk transfer address
2018-12-17T22:08:29.039792408Z 86 PC: 1400c | Rename file
2018-12-17T22:08:29.051150788Z 26 PC: 12d0f | Set disk transfer address
2018-12-17T22:08:29.052162012Z 78 PC: 12d21 | Find first file
2018-12-17T22:08:29.059640759Z 67 PC: 13259 | Get or set file attributes
2018-12-17T22:08:29.065144351Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:29.090376459Z 61 PC: 133a7 | Open file (Filename = 'A:\TEST.¯¨‘')
2018-12-17T22:08:29.097700922Z 87 PC: 13314 | Get or set file date and time
2018-12-17T22:08:29.099300762Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:29.102258979Z 63 PC: 13449 | Read file or device (Read 6016 bytes on handle 5)
2018-12-17T22:08:29.109762284Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:29.128484195Z 64 PC: 133f3 | Write file or device (Write 6016 bytes on handle 5)
2018-12-17T22:08:29.139338632Z 87 PC: 13376 | Get or set file date and time
2018-12-17T22:08:29.141084712Z 62 PC: 1348f | Close file
2018-12-17T22:08:29.14951449Z 61 PC: 133a7 | Open file (Filename = 'A:\TEST.¯¨‘')
2018-12-17T22:08:29.156317707Z 66 PC: 1882b | Move file pointer
2018-12-17T22:08:29.158280956Z 64 PC: 133f3 | Write file or device (Write 0 bytes on handle 5)
2018-12-17T22:08:29.167150494Z 87 PC: 13376 | Get or set file date and time
2018-12-17T22:08:29.169359844Z 62 PC: 1348f | Close file
2018-12-17T22:08:29.178076123Z 67 PC: 13290 | Get or set file attributes
2018-12-17T22:08:29.188051241Z 86 PC: 14025 | Rename file
2018-12-17T22:08:29.202271735Z 75 PC: 12fb9 | Execute program
2018-12-17T22:08:29.22493547Z 80 PC: 1b6c9 | Set current PSP
2018-12-17T22:08:29.225931427Z 48 PC: 1b6ce | Get DOS version
2018-12-17T22:08:29.227515709Z 99 PC: 21eb0 | Get DBCS lead byte table pointer
2018-12-17T22:08:29.231338869Z 101 PC: 1b754 | Get extended country info
2018-12-17T22:08:29.232715891Z 99 PC: 1b75a | Get DBCS lead byte table pointer
2018-12-17T22:08:29.23518615Z 74 PC: 1b7bc | Reallocate memory
2018-12-17T22:08:29.236475097Z 25 PC: 1b7f3 | Get default drive
2018-12-17T22:08:29.237501778Z 37 PC: 1b2b3 | Set interrupt vector (Interrupt = '34' AKA 'Random write')
2018-12-17T22:08:29.238872769Z 37 PC: 1b2ba | Set interrupt vector (Interrupt = '35' AKA 'Get file size in records')
2018-12-17T22:08:29.239885647Z 37 PC: 1b2c1 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-17T22:08:29.244151149Z 74 PC: 1a45c | Reallocate memory
2018-12-17T22:08:29.245951907Z 72 PC: 1a49d | Allocate memory
2018-12-17T22:08:29.248358982Z 72 PC: 1a4d5 | Allocate memory
2018-12-17T22:08:29.251008341Z 72 PC: 1a4dd | Allocate memory