.
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-17T22:58:21.440052496Z | 26 | PC: 14112 | Set disk transfer address |
| 2018-12-17T22:58:21.442515065Z | 78 | PC: 14126 | Find first file |
| 2018-12-17T22:58:21.449409534Z | 61 | PC: 14133 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-17T22:58:21.456881378Z | 63 | PC: 1416f | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-17T22:58:21.471516847Z | 66 | PC: 141cb | Move file pointer |
| 2018-12-17T22:58:21.473483784Z | 64 | PC: 141a3 | Write file or device (Write 288 bytes on handle 5) |
| 2018-12-17T22:58:21.488872229Z | 66 | PC: 141cb | Move file pointer |
| 2018-12-17T22:58:21.490560282Z | 64 | PC: 141b4 | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-17T22:58:21.498573975Z | 87 | PC: 141bb | Get or set file date and time |
| 2018-12-17T22:58:21.500294469Z | 62 | PC: 14156 | Close file |
| 2018-12-17T22:58:21.5090414Z | 79 | PC: 14126 | Find next file |
| 2018-12-17T22:58:21.513664981Z | 61 | PC: 14133 | Open file (Filename = 'PRINT.COM') |
| 2018-12-17T22:58:21.52110775Z | 62 | PC: 14156 | Close file |
| 2018-12-17T22:58:21.523467926Z | 79 | PC: 14126 | Find next file |
| 2018-12-17T22:58:21.527739094Z | 61 | PC: 14133 | Open file (Filename = 'HELLO.COM') |
| 2018-12-17T22:58:21.534757767Z | 62 | PC: 14156 | Close file |
| 2018-12-17T22:58:21.536819432Z | 79 | PC: 14126 | Find next file |
| 2018-12-17T22:58:21.539783373Z | 61 | PC: 14133 | Open file (Filename = 'PHANG.COM') |
| 2018-12-17T22:58:21.552509975Z | 62 | PC: 14156 | Close file |
| 2018-12-17T22:58:21.554824916Z | 79 | PC: 14126 | Find next file |
| 2018-12-17T22:58:21.557904915Z | 61 | PC: 14133 | Open file (Filename = 'PRINTA~1.COM') |
| 2018-12-17T22:58:21.566045347Z | 62 | PC: 14156 | Close file |
| 2018-12-17T22:58:21.567905803Z | 79 | PC: 14126 | Find next file |
| 2018-12-17T22:58:21.570815843Z | 61 | PC: 14133 | Open file (Filename = 'MANDEL.COM') |
| 2018-12-17T22:58:21.585432467Z | 63 | PC: 1416f | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-17T22:58:21.593236245Z | 66 | PC: 141cb | Move file pointer |
| 2018-12-17T22:58:21.595021Z | 64 | PC: 141a3 | Write file or device (Write 288 bytes on handle 5) |
| 2018-12-17T22:58:21.605970672Z | 66 | PC: 141cb | Move file pointer |
| 2018-12-17T22:58:21.608320859Z | 64 | PC: 141b4 | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-17T22:58:21.617479553Z | 87 | PC: 141bb | Get or set file date and time |
| 2018-12-17T22:58:21.620811056Z | 62 | PC: 14156 | Close file |
| 2018-12-17T22:58:21.630454732Z | 79 | PC: 14126 | Find next file |
| 2018-12-17T22:58:21.633809368Z | 61 | PC: 14133 | Open file (Filename = 'PAH.COM') |
| 2018-12-17T22:58:21.642020111Z | 62 | PC: 14156 | Close file |
| 2018-12-17T22:58:21.645628243Z | 79 | PC: 14126 | Find next file |
| 2018-12-17T22:58:21.649690168Z | 61 | PC: 14133 | Open file (Filename = 'TEST.COM') |
| 2018-12-17T22:58:21.657558738Z | 63 | PC: 1416f | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-17T22:58:21.665949139Z | 66 | PC: 141cb | Move file pointer |
| 2018-12-17T22:58:21.667972662Z | 64 | PC: 141a3 | Write file or device (Write 288 bytes on handle 5) |
| 2018-12-17T22:58:21.67762735Z | 66 | PC: 141cb | Move file pointer |
| 2018-12-17T22:58:21.680272862Z | 64 | PC: 141b4 | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-17T22:58:21.684012411Z | 87 | PC: 141bb | Get or set file date and time |
| 2018-12-17T22:58:21.686073065Z | 62 | PC: 14156 | Close file |
| 2018-12-17T22:58:21.695732291Z | 79 | PC: 14126 | Find next file |
| 2018-12-17T22:58:21.699875568Z | 26 | PC: 141c4 | Set disk transfer address |
| 2018-12-17T22:58:21.701554854Z | 48 | PC: 12a63 | Get DOS version |
| 2018-12-17T22:58:21.703433596Z | 9 | PC: 12a7a | Display string (String= ' --=[ Selfchecking AntiStealth Goat COM/EXE file, 01/06/01 ]=------------------ (c) 1995-2001 by ROSE SWE, Dipl.-Ing. Ralph Roth - Version 1.18 - Freeware ') |
| 2018-12-17T22:58:21.714080959Z | 61 | PC: 12cb7 | Open file (Filename = '') |
| 2018-12-17T22:58:21.733870005Z | 9 | PC: 12a88 | Display string (String= 'Self test: ') |
| 2018-12-17T22:58:21.737191659Z | 93 | PC: 12b24 | File sharing functions |
| 2018-12-17T22:58:21.740730941Z | 9 | PC: 12b03 | Display string (String= 'Size change=+0240h/00576d. Virus might be activ? ') |
| 2018-12-17T22:58:21.747287636Z | 76 | PC: 12b09 | Terminate with return code (Return code = '1') |