Sample viewer

{"DateBased":true,"Day":26,"Month":12,"Year":1994,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":7742,"SideJobID":0}

.

GIF

Syscalls:

{"DateBased":true,"Day":1,"Month":1,"Year":1980,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":7742,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:02:32.089676238Z	48	PC: 12f68 | Get DOS version
2018-12-25T12:02:32.092549417Z	74	PC: 12f27 | Reallocate memory
2018-12-25T12:02:32.094470434Z	42	PC: 9f676 | Get date 0x9f676: cmp cx, 0x7ca 0x9f67a: jl 0x9f692 0x9f67c: sub dx, 0x909 0x9f680: je 0x9f68d 0x9f682: sub dx, 0x311 0x9f686: jne 0x9f692 0x9f688: mov ax, 0x235 0x9f68b: jmp 0x9f694 0x9f68d: mov ax, 0x20c 0x9f690: jmp 0x9f694 0x9f692: xor ax, ax 0x9f694: mov word ptr [0x602], ax 0x9f697: ret 0x9f698: in al, 0x61 0x9f69a: or al, 3 0x9f69c: out 0x61, al 0x9f69e: mov al, 0xb6 0x9f6a0: out 0x43, al 0x9f6a2: mov ax, bx 0x9f6a4: out 0x42, al
2018-12-25T12:02:32.097615155Z	42	PC: 9f676 | Get date (See above)
2018-12-25T12:02:32.100937353Z	61	PC: 9f9fb | Open file (Filename = 'C:\COMMAND.COM')
2018-12-25T12:02:32.107370464Z	63	PC: 9f9fb | Read file or device (See above)
2018-12-25T12:02:32.110176894Z	62	PC: 9f978 | Close file
2018-12-25T12:02:32.112629134Z	37	PC: 9f9fb | Set interrupt vector (See above)
2018-12-25T12:02:32.114214052Z	67	PC: 9f99a | Get or set file attributes
2018-12-25T12:02:32.119752247Z	67	PC: 9f9fb | Get or set file attributes (See above)
2018-12-25T12:02:32.829086196Z	61	PC: 9f9fb | Open file (See above)
2018-12-25T12:02:32.83594107Z	87	PC: 9f9c3 | Get or set file date and time
2018-12-25T12:02:32.838547617Z	66	PC: 9f9fb | Move file pointer (See above)
2018-12-25T12:02:32.840300082Z	64	PC: 9f9fb | Write file or device (See above)
2018-12-25T12:02:32.850924137Z	66	PC: 9f9fb | Move file pointer (See above)
2018-12-25T12:02:32.852450813Z	64	PC: 9f9fb | Write file or device (See above)
2018-12-25T12:02:32.855343535Z	87	PC: 9f9dc | Get or set file date and time
2018-12-25T12:02:32.857557979Z	62	PC: 9f978 | Close file (See above)
2018-12-25T12:02:32.864411134Z	37	PC: 9f9fb | Set interrupt vector (See above)
2018-12-25T12:02:32.86675428Z	26	PC: 12a82 | Set disk transfer address
2018-12-25T12:02:32.86890985Z	42	PC: 12a92 | Get date 0x12a92: test dl, 1 0x12a95: jne 0x12ab6 0x12a97: mov dx, si 0x12a99: add dx, 5 0x12a9d: xor cx, cx 0x12a9f: mov ah, 0x4e 0x12aa1: int 0x21 0x12aa3: jb 0x12ab6 0x12aa5: call 0x12ad4 0x12aa8: mov dx, si 0x12aaa: add dx, 5 0x12aae: xor cx, cx 0x12ab0: mov ah, 0x4f 0x12ab2: int 0x21 0x12ab4: jae 0x12aa5 0x12ab6: mov al, byte ptr [si + 0x12] 0x12ab9: mov byte ptr [0x100], al 0x12abc: mov ax, word ptr [si + 0x13] 0x12abf: mov word ptr [0x101], ax 0x12ac2: mov dx, 0x80
2018-12-25T12:02:32.871807036Z	26	PC: 12ac9 | Set disk transfer address
2018-12-25T12:02:32.873097712Z	74	PC: 12c99 | Reallocate memory
2018-12-25T12:02:32.875892332Z	49	PC: 12a42 | Terminate and stay resident (Return code = '126' | Memory size = '30')

{"DateBased":true,"Day":1,"Month":1,"Year":1994,"Hour":0,"Min":0,"Second":0,"TimeBased":false,"OriginalID":7742,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:02:32.284051566Z	48	PC: 12f68 | Get DOS version
2018-12-25T12:02:32.285821113Z	74	PC: 12f27 | Reallocate memory
2018-12-25T12:02:32.287356531Z	42	PC: 9f676 | Get date 0x9f676: cmp cx, 0x7ca 0x9f67a: jl 0x9f692 0x9f67c: sub dx, 0x909 0x9f680: je 0x9f68d 0x9f682: sub dx, 0x311 0x9f686: jne 0x9f692 0x9f688: mov ax, 0x235 0x9f68b: jmp 0x9f694 0x9f68d: mov ax, 0x20c 0x9f690: jmp 0x9f694 0x9f692: xor ax, ax 0x9f694: mov word ptr [0x602], ax 0x9f697: ret 0x9f698: in al, 0x61 0x9f69a: or al, 3 0x9f69c: out 0x61, al 0x9f69e: mov al, 0xb6 0x9f6a0: out 0x43, al 0x9f6a2: mov ax, bx 0x9f6a4: out 0x42, al
2018-12-25T12:02:32.290370959Z	42	PC: 9f676 | Get date (See above)
2018-12-25T12:02:32.293745711Z	61	PC: 9f9fb | Open file (Filename = 'C:\COMMAND.COM')
2018-12-25T12:02:32.30016911Z	63	PC: 9f9fb | Read file or device (See above)
2018-12-25T12:02:32.30392839Z	62	PC: 9f978 | Close file
2018-12-25T12:02:32.306317684Z	37	PC: 9f9fb | Set interrupt vector (See above)
2018-12-25T12:02:32.307659698Z	67	PC: 9f99a | Get or set file attributes
2018-12-25T12:02:32.312947825Z	67	PC: 9f9fb | Get or set file attributes (See above)
2018-12-25T12:02:32.82911754Z	61	PC: 9f9fb | Open file (See above)
2018-12-25T12:02:32.836147035Z	87	PC: 9f9c3 | Get or set file date and time
2018-12-25T12:02:32.837959895Z	66	PC: 9f9fb | Move file pointer (See above)
2018-12-25T12:02:32.839723543Z	64	PC: 9f9fb | Write file or device (See above)
2018-12-25T12:02:32.866651365Z	66	PC: 9f9fb | Move file pointer (See above)
2018-12-25T12:02:32.868343558Z	64	PC: 9f9fb | Write file or device (See above)
2018-12-25T12:02:32.871471613Z	87	PC: 9f9dc | Get or set file date and time
2018-12-25T12:02:32.874839321Z	62	PC: 9f978 | Close file (See above)
2018-12-25T12:02:32.881911504Z	37	PC: 9f9fb | Set interrupt vector (See above)
2018-12-25T12:02:32.88400602Z	26	PC: 12a82 | Set disk transfer address
2018-12-25T12:02:32.886038262Z	42	PC: 12a92 | Get date 0x12a92: test dl, 1 0x12a95: jne 0x12ab6 0x12a97: mov dx, si 0x12a99: add dx, 5 0x12a9d: xor cx, cx 0x12a9f: mov ah, 0x4e 0x12aa1: int 0x21 0x12aa3: jb 0x12ab6 0x12aa5: call 0x12ad4 0x12aa8: mov dx, si 0x12aaa: add dx, 5 0x12aae: xor cx, cx 0x12ab0: mov ah, 0x4f 0x12ab2: int 0x21 0x12ab4: jae 0x12aa5 0x12ab6: mov al, byte ptr [si + 0x12] 0x12ab9: mov byte ptr [0x100], al 0x12abc: mov ax, word ptr [si + 0x13] 0x12abf: mov word ptr [0x101], ax 0x12ac2: mov dx, 0x80
2018-12-25T12:02:32.888592084Z	26	PC: 12ac9 | Set disk transfer address
2018-12-25T12:02:32.892744728Z	74	PC: 12c99 | Reallocate memory
2018-12-25T12:02:32.895323121Z	49	PC: 12a42 | Terminate and stay resident (Return code = '126' | Memory size = '30')