.
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-17T23:00:46.710995591Z | 48 | PC: 14115 | Get DOS version |
| 2018-12-17T23:00:46.713096198Z | 37 | PC: 141a9 | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-17T23:00:46.715148725Z | 48 | PC: 12a63 | Get DOS version |
| 2018-12-17T23:00:46.716576178Z | 9 | PC: 12a7a | Display string (String= ' --=[ Selfchecking AntiStealth Goat COM/EXE file, 01/06/01 ]=------------------ (c) 1995-2001 by ROSE SWE, Dipl.-Ing. Ralph Roth - Version 1.18 - Freeware ') |
| 2018-12-17T23:00:46.72785945Z | 53 | PC: 9ee82 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T23:00:46.729861793Z | 37 | PC: 9ee82 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T23:00:46.731523025Z | 67 | PC: 9ee82 | Get or set file attributes |
| 2018-12-17T23:00:46.738132936Z | 67 | PC: 9ee82 | Get or set file attributes |
| 2018-12-17T23:00:47.840510936Z | 61 | PC: 9ee82 | Open file (Filename = '4 Microsoft Corp Licensed Material - Property of Microsoft All rights reserved ') |
| 2018-12-17T23:00:47.863196755Z | 87 | PC: 9ee82 | Get or set file date and time |
| 2018-12-17T23:00:47.86496064Z | 66 | PC: 9ee82 | Move file pointer |
| 2018-12-17T23:00:47.867666435Z | 66 | PC: 9ee82 | Move file pointer |
| 2018-12-17T23:00:47.869736655Z | 63 | PC: 9ee82 | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-17T23:00:47.872992954Z | 66 | PC: 9ee82 | Move file pointer |
| 2018-12-17T23:00:47.876200802Z | 63 | PC: 9ee82 | Read file or device (Read 16 bytes on handle 5) |
| 2018-12-17T23:00:47.884103101Z | 62 | PC: 9ee82 | Close file |
| 2018-12-17T23:00:47.886597719Z | 42 | PC: 9ee82 | Get date 0x9ee82: ret 0x9ee83: push ds 0x9ee84: pop es 0x9ee85: push ds 0x9ee86: pop word ptr cs:[0xc2c] 0x9ee8b: mov word ptr cs:[0xc2a], dx 0x9ee90: mov ax, 0x4300 0x9ee93: call 0xaee7c 0x9ee96: jb 0x9ee67 0x9ee98: mov word ptr cs:[0xc30], cx 0x9ee9d: and cx, 0xfe 0x9eea1: mov dx, word ptr cs:[0xc2a] 0x9eea6: mov ax, 0x4301 0x9eea9: call 0xaee7c 0x9eeac: jb 0x9ee67 0x9eeae: mov dx, word ptr cs:[0xc2a] 0x9eeb3: mov di, dx 0x9eeb5: xor al, al 0x9eeb7: mov cx, 0x100 0x9eeba: cld |
| 2018-12-17T23:00:47.891727188Z | 37 | PC: 9ee82 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T23:00:47.894329298Z | 61 | PC: 12cb7 | Open file (Filename = '') |
| 2018-12-17T23:00:47.902858986Z | 9 | PC: 12a88 | Display string (String= 'Self test: ') |
| 2018-12-17T23:00:47.906385413Z | 93 | PC: 12b24 | File sharing functions |
| 2018-12-17T23:00:47.909056943Z | 9 | PC: 12b03 | Display string (String= 'Size change=+0B16h/02838d. Virus might be activ? ') |
| 2018-12-17T23:00:47.915804663Z | 76 | PC: 12b09 | Terminate with return code (Return code = '1') |