.
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-17T22:55:43.420185293Z | 53 | PC: 12c63 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T22:55:43.42187975Z | 37 | PC: 12c71 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T22:55:43.423224048Z | 26 | PC: 12c98 | Set disk transfer address |
| 2018-12-17T22:55:43.424396303Z | 78 | PC: 12cea | Find first file |
| 2018-12-17T22:55:43.43196668Z | 61 | PC: 12cf6 | Open file (Filename = 'TEST.EXE') |
| 2018-12-17T22:55:43.439241982Z | 63 | PC: 12d02 | Read file or device (Read 26 bytes on handle 5) |
| 2018-12-17T22:55:43.442272521Z | 62 | PC: 12d06 | Close file |
| 2018-12-17T22:55:43.445317839Z | 79 | PC: 12cea | Find next file |
| 2018-12-17T22:55:43.448320005Z | 78 | PC: 12cea | Find first file |
| 2018-12-17T22:55:43.45463436Z | 61 | PC: 12cf6 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-17T22:55:43.462378443Z | 63 | PC: 12d02 | Read file or device (Read 26 bytes on handle 5) |
| 2018-12-17T22:55:43.468767329Z | 62 | PC: 12d06 | Close file |
| 2018-12-17T22:55:43.471498936Z | 67 | PC: 12d7a | Get or set file attributes |
| 2018-12-17T22:55:43.490757444Z | 61 | PC: 12d7f | Open file (Filename = 'SLEEP.COM') |
| 2018-12-17T22:55:43.497244113Z | 66 | PC: 12d88 | Move file pointer |
| 2018-12-17T22:55:43.498868969Z | 44 | PC: 12dfa | Get time 0x12dfa: xchg cl, ch 0x12dfc: add dx, cx 0x12dfe: xor dx, word ptr [bp + 0x3f0] 0x12e02: mov word ptr [bp + 0x3f0], dx 0x12e06: lea si, word ptr [bp + 0x399] 0x12e0a: lea di, word ptr [bp + 0x449] 0x12e0e: mov cx, 0x18 0x12e11: rep movsb byte ptr es:[di], byte ptr [si] 0x12e13: mov ah, 0x40 0x12e15: mov cx, 0x2f5 0x12e18: lea dx, word ptr [bp + 0x100] 0x12e1c: pushaw 0x12e1d: call 0x12f71 0x12e20: mov ax, 0x4200 0x12e23: xor cx, cx 0x12e25: cdq 0x12e26: int 0x21 0x12e28: mov ah, 0x40 0x12e2a: cmp byte ptr [bp + 0x446], 0x63 0x12e2f: jne 0x12e3c |
| 2018-12-17T22:55:43.501466513Z | 64 | PC: 12f7e | Write file or device (Write 757 bytes on handle 5) |
| 2018-12-17T22:55:43.510403531Z | 66 | PC: 12e28 | Move file pointer |
| 2018-12-17T22:55:43.512267497Z | 64 | PC: 12e3a | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-17T22:55:43.519157294Z | 87 | PC: 12e53 | Get or set file date and time |
| 2018-12-17T22:55:43.521650763Z | 62 | PC: 12e57 | Close file |
| 2018-12-17T22:55:43.529444129Z | 67 | PC: 12e64 | Get or set file attributes |
| 2018-12-17T22:55:43.538920622Z | 37 | PC: 12e6c | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T22:55:43.541271633Z | 26 | PC: 12e76 | Set disk transfer address |
| 2018-12-17T22:55:43.542869808Z | 9 | PC: 12a82 | Display string (String= 'Goat file (EXE). Size=000003E8h/0000001000d bytes. ') |
| 2018-12-17T22:55:43.546973886Z | 76 | PC: 12a86 | Terminate with return code (Return code = '36') |