.
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-17T23:08:00.029756356Z | 67 | PC: 13e8f | Get or set file attributes |
| 2018-12-17T23:08:00.036432425Z | 61 | PC: 13e8f | Open file (Filename = ' k') |
| 2018-12-17T23:08:00.04444194Z | 87 | PC: 13e8f | Get or set file date and time |
| 2018-12-17T23:08:00.046476334Z | 63 | PC: 13e8f | Read file or device (Read 2459041820 bytes on handle 5) |
| 2018-12-17T23:08:00.049856998Z | 66 | PC: 13e8f | Move file pointer |
| 2018-12-17T23:08:00.052378748Z | 66 | PC: 13f22 | Move file pointer |
| 2018-12-17T23:08:00.054010536Z | 63 | PC: 13f2c | Read file or device (Read 2459041799 bytes on handle 5) |
| 2018-12-17T23:08:00.057292044Z | 66 | PC: 13e8f | Move file pointer |
| 2018-12-17T23:08:00.059574084Z | 64 | PC: 13e8f | Write file or device (Write 2459043644 bytes on handle 5) |
| 2018-12-17T23:08:00.384214252Z | 64 | PC: 1402d | Write file or device (Write 2459041799 bytes on handle 5) |
| 2018-12-17T23:08:00.387892416Z | 66 | PC: 13e8f | Move file pointer |
| 2018-12-17T23:08:00.390334046Z | 64 | PC: 13e8f | Write file or device (Write 2459041820 bytes on handle 5) |
| 2018-12-17T23:08:00.394313906Z | 87 | PC: 13e8f | Get or set file date and time |
| 2018-12-17T23:08:00.396456604Z | 62 | PC: 13e8f | Close file |
| 2018-12-17T23:08:00.405588469Z | 65 | PC: 13e8f | Delete file (Filename = '!COM1 �') |
| 2018-12-17T23:08:00.41280875Z | 75 | PC: 13a81 | Execute program |
| 2018-12-17T23:08:00.418172452Z | 74 | PC: 13aa1 | Reallocate memory |
| 2018-12-17T23:08:00.420192339Z | 82 | PC: 13aa6 | Get DOS internal pointers (SYSVARS) |
| 2018-12-17T23:08:00.436457472Z | 53 | PC: 13b05 | Get interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-17T23:08:00.438466459Z | 37 | PC: 13b1b | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-17T23:08:00.440342004Z | 9 | PC: 12a82 | Display string (String= 'Goat file (EXE). Size=000011A0h/0000004512d bytes. ') |
| 2018-12-17T23:08:00.446954093Z | 76 | PC: 12a86 | Terminate with return code (Return code = '36') |