.
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-17T23:00:52.541355744Z | 48 | PC: 14118 | Get DOS version |
| 2018-12-17T23:00:52.543966219Z | 37 | PC: 141ad | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-17T23:00:52.55951094Z | 48 | PC: 12a63 | Get DOS version |
| 2018-12-17T23:00:52.56095872Z | 9 | PC: 12a7a | Display string (String= ' --=[ Selfchecking AntiStealth Goat COM/EXE file, 01/06/01 ]=------------------ (c) 1995-2001 by ROSE SWE, Dipl.-Ing. Ralph Roth - Version 1.18 - Freeware ') |
| 2018-12-17T23:00:52.571954663Z | 53 | PC: 9efbb | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T23:00:52.575110934Z | 37 | PC: 9efbb | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T23:00:52.576988312Z | 67 | PC: 9efbb | Get or set file attributes |
| 2018-12-17T23:00:52.583798288Z | 67 | PC: 9efbb | Get or set file attributes |
| 2018-12-17T23:00:52.604212088Z | 61 | PC: 9efbb | Open file (Filename = '4 Microsoft Corp Licensed Material - Property of Microsoft All rights reserved ') |
| 2018-12-17T23:00:52.61558041Z | 87 | PC: 9efbb | Get or set file date and time |
| 2018-12-17T23:00:52.617911812Z | 66 | PC: 9efbb | Move file pointer |
| 2018-12-17T23:00:52.621089703Z | 66 | PC: 9efbb | Move file pointer |
| 2018-12-17T23:00:52.624058372Z | 63 | PC: 9efbb | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-17T23:00:52.639597151Z | 66 | PC: 9efbb | Move file pointer |
| 2018-12-17T23:00:52.642335246Z | 63 | PC: 9efbb | Read file or device (Read 16 bytes on handle 5) |
| 2018-12-17T23:00:52.650666131Z | 62 | PC: 9efbb | Close file |
| 2018-12-17T23:00:52.653643155Z | 42 | PC: 9efbb | Get date 0x9efbb: ret 0x9efbc: push ds 0x9efbd: pop es 0x9efbe: push ds 0x9efbf: pop word ptr cs:[0xc7e] 0x9efc4: mov word ptr cs:[0xc7c], dx 0x9efc9: mov ax, 0x4300 0x9efcc: call 0xaefb5 0x9efcf: jb 0x9ef9d 0x9efd1: test cx, 0x1e 0x9efd5: jne 0x9ef9d 0x9efd7: mov word ptr cs:[0xc82], cx 0x9efdc: and cx, 0xfe 0x9efe0: mov dx, word ptr cs:[0xc7c] 0x9efe5: mov ax, 0x4301 0x9efe8: call 0xaefb5 0x9efeb: jb 0x9ef9d 0x9efed: mov dx, word ptr cs:[0xc7c] 0x9eff2: mov di, dx 0x9eff4: xor al, al |
| 2018-12-17T23:00:52.656539918Z | 37 | PC: 9efbb | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T23:00:52.659421062Z | 61 | PC: 12cb7 | Open file (Filename = '') |
| 2018-12-17T23:00:52.667164393Z | 9 | PC: 12a88 | Display string (String= 'Self test: ') |
| 2018-12-17T23:00:52.670169009Z | 93 | PC: 12b24 | File sharing functions |
| 2018-12-17T23:00:52.67341583Z | 9 | PC: 12b03 | Display string (String= 'Size change=+0B68h/02920d. Virus might be activ? ') |
| 2018-12-17T23:00:52.679462232Z | 76 | PC: 12b09 | Terminate with return code (Return code = '1') |