Sample viewer

{"DateBased":true,"Day":8,"Month":10,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":4832,"SideJobID":0}

.

GIF

Syscalls:

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":4832,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T11:52:58.579204961Z	42	PC: 1515f | Get date 0x1515f: cmp dx, 0xa08 0x15163: jne 0x151c1 0x15165: mov ah, 9 0x15167: lea dx, word ptr [bp + 0x2a4] 0x1516b: int 0x21 0x1516d: mov ax, 0x3d02 0x15170: lea dx, word ptr [bp + 0x298] 0x15174: int 0x21 0x15176: mov bx, ax 0x15178: mov ax, 0x4200 0x1517b: xor cx, cx 0x1517d: mov dx, cx 0x1517f: int 0x21 0x15181: mov ah, 0x40 0x15183: mov cx, 3 0x15186: lea dx, word ptr [bp + 0x295] 0x1518a: int 0x21 0x1518c: mov ax, 0x4202 0x1518f: xor cx, cx 0x15191: mov dx, cx
2018-12-25T11:52:58.581775373Z	78	PC: 151e3 | Find first file
2018-12-25T11:52:58.587511252Z	61	PC: 151fa | Open file (Filename = 'SLEEP.COM')
2018-12-25T11:52:58.593781833Z	66	PC: 15201 | Move file pointer
2018-12-25T11:52:58.596068424Z	66	PC: 15206 | Move file pointer
2018-12-25T11:52:58.597634395Z	66	PC: 15210 | Move file pointer
2018-12-25T11:52:58.599191174Z	63	PC: 1521c | Read file or device (Read 3 bytes on handle 5)
2018-12-25T11:52:58.603629823Z	66	PC: 15249 | Move file pointer
2018-12-25T11:52:58.604895802Z	63	PC: 15255 | Read file or device (Read 3 bytes on handle 5)
2018-12-25T11:52:58.610727184Z	66	PC: 15268 | Move file pointer
2018-12-25T11:52:58.612323452Z	64	PC: 15273 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T11:52:58.614060128Z	66	PC: 1527c | Move file pointer
2018-12-25T11:52:58.61537188Z	64	PC: 15287 | Write file or device (Write 609 bytes on handle 5)
2018-12-25T11:52:58.626692114Z	62	PC: 1528b | Close file
2018-12-25T11:52:58.633548257Z	76	PC: 1514d | Terminate with return code (Return code = '0')