Sample viewer

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":34,"TimeBased":true,"OriginalID":4560,"SideJobID":0}

.

GIF

Syscalls:

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":4560,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T11:52:09.455264445Z	53	PC: 12f08 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:52:09.458938619Z	37	PC: 12f1b | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:52:09.460474855Z	73	PC: 12d5c | Release memory
2018-12-25T11:52:09.462667234Z	72	PC: 12d64 | Allocate memory
2018-12-25T11:52:09.465923183Z	74	PC: 12d6c | Reallocate memory
2018-12-25T11:52:09.467648328Z	72	PC: 12d74 | Allocate memory
2018-12-25T11:52:09.469548904Z	44	PC: 12d87 | Get time 0x12d87: cmp dh, 0x22 0x12d8a: jne 0x12d8f 0x12d8c: call 0x12ea8 0x12d8f: call 0x12fce 0x12d92: lea si, word ptr [bp + 0x2eb] 0x12d96: mov ax, dx 0x12d98: xor bx, bx 0x12d9a: call 0x12ed2 0x12d9d: xor ax, 0x1234 0x12da0: call 0x12ed2 0x12da3: mov ax, word ptr [si] 0x12da5: xor ah, ah 0x12da7: mov bl, 2 0x12da9: div bl 0x12dab: xor ah, ah 0x12dad: mov byte ptr [bp + 0x2fa], al 0x12db1: push si 0x12db2: lea si, word ptr [bp + 0x28d] 0x12db6: call 0x12f49 0x12db9: pop si
2018-12-25T11:52:09.472675669Z	26	PC: 12fef | Set disk transfer address
2018-12-25T11:52:09.474988926Z	78	PC: 12ffb | Find first file
2018-12-25T11:52:09.486354149Z	67	PC: 13064 | Get or set file attributes
2018-12-25T11:52:09.490582075Z	61	PC: 13075 | Open file (Filename = 'A*c}����f��;o\�}�h��4Q5Z��C,�QF@�a�5�����>�9�Z'|��ݾ �s��)4|U��0�QPr����)֜��":�\�};�n���4�g ')
2018-12-25T11:52:09.500658506Z	37	PC: 12eff | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T11:52:09.501781631Z	73	PC: 1319c | Release memory
2018-12-25T11:52:09.507554133Z	76	PC: 0 | Terminate with return code (Return code = '0')