.
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-17T23:06:50.512379111Z | 26 | PC: 14109 | Set disk transfer address |
| 2018-12-17T23:06:50.516956885Z | 78 | PC: 1411d | Find first file |
| 2018-12-17T23:06:50.522751814Z | 61 | PC: 1412a | Open file (Filename = 'SLEEP.COM') |
| 2018-12-17T23:06:50.529197418Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T23:06:50.531100859Z | 62 | PC: 14151 | Close file |
| 2018-12-17T23:06:50.532736092Z | 79 | PC: 1411d | Find next file |
| 2018-12-17T23:06:50.535199982Z | 61 | PC: 1412a | Open file (Filename = 'PRINT.COM') |
| 2018-12-17T23:06:50.542003871Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T23:06:50.543551155Z | 62 | PC: 14151 | Close file |
| 2018-12-17T23:06:50.545499257Z | 79 | PC: 1411d | Find next file |
| 2018-12-17T23:06:50.548532676Z | 61 | PC: 1412a | Open file (Filename = 'HELLO.COM') |
| 2018-12-17T23:06:50.555184842Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T23:06:50.556314359Z | 62 | PC: 14151 | Close file |
| 2018-12-17T23:06:50.558499538Z | 79 | PC: 1411d | Find next file |
| 2018-12-17T23:06:50.561233751Z | 61 | PC: 1412a | Open file (Filename = 'PHANG.COM') |
| 2018-12-17T23:06:50.568504327Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T23:06:50.571026099Z | 62 | PC: 14151 | Close file |
| 2018-12-17T23:06:50.572746486Z | 79 | PC: 1411d | Find next file |
| 2018-12-17T23:06:50.5750969Z | 61 | PC: 1412a | Open file (Filename = 'PRINTA~1.COM') |
| 2018-12-17T23:06:50.582402178Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T23:06:50.583974667Z | 62 | PC: 14151 | Close file |
| 2018-12-17T23:06:50.585750639Z | 79 | PC: 1411d | Find next file |
| 2018-12-17T23:06:50.588345Z | 61 | PC: 1412a | Open file (Filename = 'MANDEL.COM') |
| 2018-12-17T23:06:50.594614542Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T23:06:50.595990419Z | 62 | PC: 14151 | Close file |
| 2018-12-17T23:06:50.598328679Z | 79 | PC: 1411d | Find next file |
| 2018-12-17T23:06:50.601450821Z | 61 | PC: 1412a | Open file (Filename = 'PAH.COM') |
| 2018-12-17T23:06:50.607664869Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T23:06:50.608907402Z | 62 | PC: 14151 | Close file |
| 2018-12-17T23:06:50.621795572Z | 79 | PC: 1411d | Find next file |
| 2018-12-17T23:06:50.624088731Z | 61 | PC: 1412a | Open file (Filename = 'TEST.COM') |
| 2018-12-17T23:06:50.630554091Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T23:06:50.63228986Z | 87 | PC: 14141 | Get or set file date and time |
| 2018-12-17T23:06:50.633502156Z | 44 | PC: 14161 | Get time 0x14161: or dx, dx 0x14163: je 0x1415d 0x14165: mov word ptr [bp + 0x21a], dx 0x14169: mov ax, 0x4200 0x1416c: call 0x141cd 0x1416f: mov ah, 0x3f 0x14171: lea dx, word ptr [bp + 0x1f7] 0x14175: mov cx, 3 0x14178: int 0x21 0x1417a: mov ax, 0x4202 0x1417d: call 0x141cd 0x14180: sub ax, 3 0x14183: mov word ptr cs:[bp + 0x1f5], ax 0x14188: lea si, word ptr [bp + 0x105] 0x1418c: mov di, 0xfb90 0x1418f: mov cx, 0x118 0x14192: cld 0x14193: rep movsb byte ptr es:[di], byte ptr [si] 0x14195: mov si, 0xfbad 0x14198: call 0x240f2 |
| 2018-12-17T23:06:50.63549314Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T23:06:50.636808031Z | 63 | PC: 1417a | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-17T23:06:50.638529439Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T23:06:50.639634275Z | 64 | PC: 141a5 | Write file or device (Write 280 bytes on handle 5) |
| 2018-12-17T23:06:50.650290888Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T23:06:50.651432572Z | 64 | PC: 141b6 | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-17T23:06:50.65351337Z | 87 | PC: 141bd | Get or set file date and time |
| 2018-12-17T23:06:50.655075827Z | 62 | PC: 141c1 | Close file |
| 2018-12-17T23:06:50.660648807Z | 26 | PC: 141c8 | Set disk transfer address |
| 2018-12-17T23:06:50.661937577Z | 48 | PC: 12a63 | Get DOS version |
| 2018-12-17T23:06:50.66407365Z | 9 | PC: 12a7a | Display string (String= ' --=[ Selfchecking AntiStealth Goat COM/EXE file, 01/06/01 ]=------------------ (c) 1995-2001 by ROSE SWE, Dipl.-Ing. Ralph Roth - Version 1.18 - Freeware ') |
| 2018-12-17T23:06:50.669622742Z | 61 | PC: 12cb7 | Open file (Filename = '') |
| 2018-12-17T23:06:50.674155951Z | 9 | PC: 12a88 | Display string (String= 'Self test: ') |
| 2018-12-17T23:06:50.6764939Z | 93 | PC: 12b24 | File sharing functions |
| 2018-12-17T23:06:50.678143196Z | 9 | PC: 12b03 | Display string (String= 'Size change=+0230h/00560d. Virus might be activ? ') |
| 2018-12-17T23:06:50.681733427Z | 76 | PC: 12b09 | Terminate with return code (Return code = '1') |