Sample viewer

{"DateBased":true,"Day":12,"Month":10,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":1347,"SideJobID":0}

.

GIF

Syscalls:

{"DateBased":true,"Day":25,"Month":12,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":1347,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T11:43:26.077242689Z	237	PC: 138a7 | UNKNOWN!
2018-12-25T11:43:26.078687258Z	53	PC: 138d8 | Get interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T11:43:26.080873712Z	53	PC: 138e4 | Get interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T11:43:26.083330673Z	37	PC: 13941 | Set interrupt vector (Interrupt = '33' AKA 'Random read')
2018-12-25T11:43:26.085078542Z	42	PC: 13945 | Get date 0x13945: cmp dx, 0x419 0x13949: je 0x1395a 0x1394b: cmp dx, 0xc19 0x1394f: je 0x1395a 0x13951: cmp dx, 0xa0c 0x13955: je 0x1395a 0x13957: jmp 0x13964 0x13959: nop 0x1395a: push es 0x1395b: pop ds 0x1395c: mov dx, 0x2be 0x1395f: mov ax, 0x251c 0x13962: int 0x21 0x13964: push cs 0x13965: pop ds 0x13966: ret 0x13967: push si 0x13968: add si, 0xd 0x1396b: mov cx, 3 0x1396e: push cs
2018-12-25T11:43:26.088393534Z	37	PC: 13964 | Set interrupt vector (Interrupt = '28' AKA 'Get allocation info for specified drive')
2018-12-25T11:43:26.089858931Z	53	PC: 13d05 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:43:26.09129897Z	37	PC: 13d1e | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:43:26.096889996Z	67	PC: 13ad7 | Get or set file attributes
2018-12-25T11:43:26.104336509Z	67	PC: 13ae5 | Get or set file attributes
2018-12-25T11:43:27.003349932Z	61	PC: 13af7 | Open file (Filename = ' ')
2018-12-25T11:43:27.018668276Z	66	PC: 13b0b | Move file pointer
2018-12-25T11:43:27.020531472Z	63	PC: 13cd9 | Read file or device (Read 4 bytes on handle 5)
2018-12-25T11:43:27.024259593Z	62	PC: 13cfb | Close file
2018-12-25T11:43:27.028182376Z	61	PC: 13b37 | Open file (Filename = 'c:\command.com')
2018-12-25T11:43:27.036758603Z	66	PC: 13cec | Move file pointer
2018-12-25T11:43:27.038873309Z	63	PC: 13cd9 | Read file or device (See above)
2018-12-25T11:43:27.044876406Z	87	PC: 13cb3 | Get or set file date and time
2018-12-25T11:43:27.050250538Z	66	PC: 13cf6 | Move file pointer
2018-12-25T11:43:27.051864517Z	66	PC: 13cf6 | Move file pointer (See above)
2018-12-25T11:43:27.053321777Z	64	PC: 13ce2 | Write file or device (Write 1371 bytes on handle 5)
2018-12-25T11:43:27.064826209Z	66	PC: 13cec | Move file pointer (See above)
2018-12-25T11:43:27.0665927Z	64	PC: 13ce2 | Write file or device (See above)
2018-12-25T11:43:27.069917583Z	87	PC: 13ccc | Get or set file date and time
2018-12-25T11:43:27.072387867Z	62	PC: 13cfb | Close file (See above)
2018-12-25T11:43:27.079643372Z	67	PC: 13aef | Get or set file attributes
2018-12-25T11:43:27.089461176Z	37	PC: 13d31 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:43:27.091408653Z	9	PC: 12a86 | Display string (String= 'Goat file (EXE/....). Size=00000FA0h/0000004000d bytes. ')
2018-12-25T11:43:27.097712477Z	48	PC: 12a8f | Get DOS version
2018-12-25T11:43:27.09915282Z	61	PC: 12b5c | Open file (Filename = '')
2018-12-25T11:43:27.108662313Z	93	PC: 12afe | File sharing functions
2018-12-25T11:43:27.111978708Z	9	PC: 12a86 | Display string (See above)
2018-12-25T11:43:27.116965015Z	76	PC: 12ae3 | Terminate with return code (Return code = '1')