Sample viewer

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":11,"TimeBased":true,"OriginalID":8349,"SideJobID":0}

.

GIF

Syscalls:

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":0,"Second":0,"TimeBased":true,"OriginalID":8349,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:04:28.96110308Z	37	PC: 18d2f | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:04:28.962271167Z	47	PC: 18d39 | Get disk transfer address
2018-12-25T12:04:28.963180051Z	26	PC: 18d42 | Set disk transfer address
2018-12-25T12:04:28.964069039Z	25	PC: 18d46 | Get default drive
2018-12-25T12:04:28.96577388Z	44	PC: 18d4d | Get time 0x18d4d: and dh, 0xf 0x18d50: mov dl, dh 0x18d52: cmp dl, 0 0x18d55: je 0x18d5e 0x18d57: cmp dl, 0xb 0x18d5a: jbe 0x18d62 0x18d5c: mov dl, 2 0x18d5e: mov ah, 0xe 0x18d60: int 0x21 0x18d62: mov ax, cs 0x18d64: mov es, ax 0x18d66: mov byte ptr [0x496], 0 0x18d6b: nop 0x18d6c: mov di, 0x460 0x18d6f: mov word ptr [0x494], di 0x18d73: call 0x18fb6 0x18d76: mov di, 0x460 0x18d79: mov ax, 0x2e2a 0x18d7c: stosw word ptr es:[di], ax 0x18d7d: mov ah, 0
2018-12-25T12:04:28.968289132Z	78	PC: 18fcb | Find first file
2018-12-25T12:04:28.974441823Z	79	PC: 19036 | Find next file
2018-12-25T12:04:28.977490774Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:28.981085977Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:28.983831713Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:28.986791368Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:28.989276579Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:28.991745536Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:28.994967189Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:28.997390078Z	54	PC: 1904e | Get free disk space
2018-12-25T12:04:29.005708033Z	67	PC: 19067 | Get or set file attributes
2018-12-25T12:04:29.011619223Z	67	PC: 19073 | Get or set file attributes
2018-12-25T12:04:29.028556318Z	61	PC: 19078 | Open file (Filename = 'TEST.COM')
2018-12-25T12:04:29.036194777Z	87	PC: 1907f | Get or set file date and time
2018-12-25T12:04:29.038888254Z	63	PC: 18edb | Read file or device (Read 3 bytes on handle 5)
2018-12-25T12:04:29.041457889Z	66	PC: 18f22 | Move file pointer
2018-12-25T12:04:29.042710931Z	64	PC: 18f35 | Write file or device (Write 9 bytes on handle 5)
2018-12-25T12:04:29.046218871Z	64	PC: 18ee7 | Write file or device (Write 1108 bytes on handle 5)
2018-12-25T12:04:29.054654995Z	64	PC: 18ef3 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T12:04:29.057182884Z	66	PC: 18efc | Move file pointer
2018-12-25T12:04:29.058781799Z	64	PC: 18f17 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T12:04:29.061400268Z	87	PC: 18ead | Get or set file date and time
2018-12-25T12:04:29.06317035Z	62	PC: 18eb1 | Close file
2018-12-25T12:04:29.072046226Z	67	PC: 18ebd | Get or set file attributes
2018-12-25T12:04:29.081775439Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:29.084062474Z	78	PC: 18d89 | Find first file
2018-12-25T12:04:29.089673322Z	79	PC: 18dce | Find next file
2018-12-25T12:04:29.093080065Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.095487876Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.097962261Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.101742966Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.104148151Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.106501747Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.109724191Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.112440042Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.114592051Z	14	PC: 18ddb | Set default drive (Drive = 'A')
2018-12-25T12:04:29.117601886Z	44	PC: 18ddf | Get time 0x18ddf: cmp cl, 0x20 0x18de2: jb 0x18e0c 0x18de4: cmp cl, 0x23 0x18de7: jae 0x18e0c 0x18de9: mov ah, 9 0x18deb: mov dx, 0x42e 0x18dee: int 0x21 0x18df0: mov ax, 0x3508 0x18df3: int 0x21 0x18df5: mov si, 0x368 0x18df8: mov word ptr [si], bx 0x18dfa: mov bx, es 0x18dfc: mov word ptr [si + 2], bx 0x18dff: mov ax, 0x2508 0x18e02: mov dx, 0x36f 0x18e05: int 0x21 0x18e07: mov dx, 0x499 0x18e0a: int 0x27 0x18e0c: mov cx, cs 0x18e0e: sub cx, word ptr [0x458]
2018-12-25T12:04:29.119646178Z	26	PC: 18e1d | Set disk transfer address
2018-12-25T12:04:29.120694966Z	48	PC: 13777 | Get DOS version
2018-12-25T12:04:29.12230133Z	9	PC: 13783 | Display string (String= 'Incorrect DOS version ')

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":32,"Second":0,"TimeBased":true,"OriginalID":8349,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:04:29.196361166Z	37	PC: 18d2f | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:04:29.19728306Z	47	PC: 18d39 | Get disk transfer address
2018-12-25T12:04:29.198344626Z	26	PC: 18d42 | Set disk transfer address
2018-12-25T12:04:29.199203854Z	25	PC: 18d46 | Get default drive
2018-12-25T12:04:29.200133837Z	44	PC: 18d4d | Get time 0x18d4d: and dh, 0xf 0x18d50: mov dl, dh 0x18d52: cmp dl, 0 0x18d55: je 0x18d5e 0x18d57: cmp dl, 0xb 0x18d5a: jbe 0x18d62 0x18d5c: mov dl, 2 0x18d5e: mov ah, 0xe 0x18d60: int 0x21 0x18d62: mov ax, cs 0x18d64: mov es, ax 0x18d66: mov byte ptr [0x496], 0 0x18d6b: nop 0x18d6c: mov di, 0x460 0x18d6f: mov word ptr [0x494], di 0x18d73: call 0x18fb6 0x18d76: mov di, 0x460 0x18d79: mov ax, 0x2e2a 0x18d7c: stosw word ptr es:[di], ax 0x18d7d: mov ah, 0
2018-12-25T12:04:29.20163324Z	78	PC: 18fcb | Find first file
2018-12-25T12:04:29.205561063Z	79	PC: 19036 | Find next file
2018-12-25T12:04:29.207280513Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:29.208886708Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:29.210724722Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:29.212730383Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:29.215146787Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:29.217725411Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:29.220640613Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:29.223673091Z	54	PC: 1904e | Get free disk space
2018-12-25T12:04:29.232160843Z	67	PC: 19067 | Get or set file attributes
2018-12-25T12:04:29.23805992Z	67	PC: 19073 | Get or set file attributes
2018-12-25T12:04:29.252998672Z	61	PC: 19078 | Open file (Filename = 'TEST.COM')
2018-12-25T12:04:29.26445538Z	87	PC: 1907f | Get or set file date and time
2018-12-25T12:04:29.266710142Z	63	PC: 18edb | Read file or device (Read 3 bytes on handle 5)
2018-12-25T12:04:29.272890559Z	66	PC: 18f22 | Move file pointer
2018-12-25T12:04:29.274198405Z	64	PC: 18f35 | Write file or device (Write 9 bytes on handle 5)
2018-12-25T12:04:29.281437891Z	64	PC: 18ee7 | Write file or device (Write 1108 bytes on handle 5)
2018-12-25T12:04:29.290601297Z	64	PC: 18ef3 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T12:04:29.293321462Z	66	PC: 18efc | Move file pointer
2018-12-25T12:04:29.295278047Z	64	PC: 18f17 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T12:04:29.298091361Z	87	PC: 18ead | Get or set file date and time
2018-12-25T12:04:29.299447634Z	62	PC: 18eb1 | Close file
2018-12-25T12:04:29.307676591Z	67	PC: 18ebd | Get or set file attributes
2018-12-25T12:04:29.317318392Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:29.31950489Z	78	PC: 18d89 | Find first file
2018-12-25T12:04:29.32583813Z	79	PC: 18dce | Find next file
2018-12-25T12:04:29.349798178Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.352167111Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.354560501Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.357064768Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.359377299Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.361703972Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.364136944Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.366412273Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.368491146Z	14	PC: 18ddb | Set default drive (Drive = 'A')
2018-12-25T12:04:29.370117751Z	44	PC: 18ddf | Get time 0x18ddf: cmp cl, 0x20 0x18de2: jb 0x18e0c 0x18de4: cmp cl, 0x23 0x18de7: jae 0x18e0c 0x18de9: mov ah, 9 0x18deb: mov dx, 0x42e 0x18dee: int 0x21 0x18df0: mov ax, 0x3508 0x18df3: int 0x21 0x18df5: mov si, 0x368 0x18df8: mov word ptr [si], bx 0x18dfa: mov bx, es 0x18dfc: mov word ptr [si + 2], bx 0x18dff: mov ax, 0x2508 0x18e02: mov dx, 0x36f 0x18e05: int 0x21 0x18e07: mov dx, 0x499 0x18e0a: int 0x27 0x18e0c: mov cx, cs 0x18e0e: sub cx, word ptr [0x458]
2018-12-25T12:04:29.372143746Z	9	PC: 18df0 | Display string (String= ' Sorry, I'm copmpletly dead. ')
2018-12-25T12:04:29.377141552Z	53	PC: 18df5 | Get interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-25T12:04:29.379218525Z	37	PC: 18e07 | Set interrupt vector (Interrupt = '8' AKA 'Console input without echo')
2018-12-25T12:04:29.380270322Z	49	PC: 18e0c | Terminate and stay resident (Return code = '0' | Memory size = '74')

{"DateBased":false,"Day":0,"Month":0,"Year":0,"Hour":0,"Min":36,"Second":0,"TimeBased":true,"OriginalID":8349,"SideJobID":0}

.

GIF

Syscalls:

Time	Syscall Op	Syscall Name
2018-12-25T12:04:29.270463413Z	37	PC: 18d2f | Set interrupt vector (Interrupt = '36' AKA 'Set random record number')
2018-12-25T12:04:29.272474356Z	47	PC: 18d39 | Get disk transfer address
2018-12-25T12:04:29.273802547Z	26	PC: 18d42 | Set disk transfer address
2018-12-25T12:04:29.275094758Z	25	PC: 18d46 | Get default drive
2018-12-25T12:04:29.277252943Z	44	PC: 18d4d | Get time 0x18d4d: and dh, 0xf 0x18d50: mov dl, dh 0x18d52: cmp dl, 0 0x18d55: je 0x18d5e 0x18d57: cmp dl, 0xb 0x18d5a: jbe 0x18d62 0x18d5c: mov dl, 2 0x18d5e: mov ah, 0xe 0x18d60: int 0x21 0x18d62: mov ax, cs 0x18d64: mov es, ax 0x18d66: mov byte ptr [0x496], 0 0x18d6b: nop 0x18d6c: mov di, 0x460 0x18d6f: mov word ptr [0x494], di 0x18d73: call 0x18fb6 0x18d76: mov di, 0x460 0x18d79: mov ax, 0x2e2a 0x18d7c: stosw word ptr es:[di], ax 0x18d7d: mov ah, 0
2018-12-25T12:04:29.27961146Z	78	PC: 18fcb | Find first file
2018-12-25T12:04:29.285780879Z	79	PC: 19036 | Find next file
2018-12-25T12:04:29.289119986Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:29.292195263Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:29.294990869Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:29.299357268Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:29.301927876Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:29.304385999Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:29.306938564Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:29.309811378Z	54	PC: 1904e | Get free disk space
2018-12-25T12:04:29.31843463Z	67	PC: 19067 | Get or set file attributes
2018-12-25T12:04:29.32463299Z	67	PC: 19073 | Get or set file attributes
2018-12-25T12:04:29.3402707Z	61	PC: 19078 | Open file (Filename = 'TEST.COM')
2018-12-25T12:04:29.346944598Z	87	PC: 1907f | Get or set file date and time
2018-12-25T12:04:29.349397884Z	63	PC: 18edb | Read file or device (Read 3 bytes on handle 5)
2018-12-25T12:04:29.351764292Z	66	PC: 18f22 | Move file pointer
2018-12-25T12:04:29.353081683Z	64	PC: 18f35 | Write file or device (Write 9 bytes on handle 5)
2018-12-25T12:04:29.356816996Z	64	PC: 18ee7 | Write file or device (Write 1108 bytes on handle 5)
2018-12-25T12:04:29.365120765Z	64	PC: 18ef3 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T12:04:29.36755334Z	66	PC: 18efc | Move file pointer
2018-12-25T12:04:29.369120339Z	64	PC: 18f17 | Write file or device (Write 3 bytes on handle 5)
2018-12-25T12:04:29.371724971Z	87	PC: 18ead | Get or set file date and time
2018-12-25T12:04:29.37298779Z	62	PC: 18eb1 | Close file
2018-12-25T12:04:29.380776731Z	67	PC: 18ebd | Get or set file attributes
2018-12-25T12:04:29.390122149Z	79	PC: 19036 | Find next file (See above)
2018-12-25T12:04:29.392362955Z	78	PC: 18d89 | Find first file
2018-12-25T12:04:29.39970717Z	79	PC: 18dce | Find next file
2018-12-25T12:04:29.402190804Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.404568208Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.407645425Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.410020294Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.41233106Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.420184845Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.422628621Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.425567887Z	79	PC: 18dce | Find next file (See above)
2018-12-25T12:04:29.429148919Z	14	PC: 18ddb | Set default drive (Drive = 'A')
2018-12-25T12:04:29.430449736Z	44	PC: 18ddf | Get time 0x18ddf: cmp cl, 0x20 0x18de2: jb 0x18e0c 0x18de4: cmp cl, 0x23 0x18de7: jae 0x18e0c 0x18de9: mov ah, 9 0x18deb: mov dx, 0x42e 0x18dee: int 0x21 0x18df0: mov ax, 0x3508 0x18df3: int 0x21 0x18df5: mov si, 0x368 0x18df8: mov word ptr [si], bx 0x18dfa: mov bx, es 0x18dfc: mov word ptr [si + 2], bx 0x18dff: mov ax, 0x2508 0x18e02: mov dx, 0x36f 0x18e05: int 0x21 0x18e07: mov dx, 0x499 0x18e0a: int 0x27 0x18e0c: mov cx, cs 0x18e0e: sub cx, word ptr [0x458]
2018-12-25T12:04:29.432615122Z	26	PC: 18e1d | Set disk transfer address
2018-12-25T12:04:29.434108895Z	48	PC: 13777 | Get DOS version
2018-12-25T12:04:29.4357573Z	9	PC: 13783 | Display string (String= 'Incorrect DOS version ')