.
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-17T23:11:34.994843593Z | 26 | PC: 14113 | Set disk transfer address |
| 2018-12-17T23:11:34.997418848Z | 78 | PC: 14127 | Find first file |
| 2018-12-17T23:11:35.003667061Z | 61 | PC: 14134 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-17T23:11:35.010288707Z | 66 | PC: 141eb | Move file pointer |
| 2018-12-17T23:11:35.012288163Z | 62 | PC: 1415b | Close file |
| 2018-12-17T23:11:35.013896574Z | 79 | PC: 14127 | Find next file |
| 2018-12-17T23:11:35.01559261Z | 61 | PC: 14134 | Open file (Filename = 'PRINT.COM') |
| 2018-12-17T23:11:35.019679535Z | 66 | PC: 141eb | Move file pointer |
| 2018-12-17T23:11:35.021070812Z | 62 | PC: 1415b | Close file |
| 2018-12-17T23:11:35.022444714Z | 79 | PC: 14127 | Find next file |
| 2018-12-17T23:11:35.024247331Z | 61 | PC: 14134 | Open file (Filename = 'HELLO.COM') |
| 2018-12-17T23:11:35.028946931Z | 66 | PC: 141eb | Move file pointer |
| 2018-12-17T23:11:35.030424027Z | 62 | PC: 1415b | Close file |
| 2018-12-17T23:11:35.032207483Z | 79 | PC: 14127 | Find next file |
| 2018-12-17T23:11:35.040457952Z | 61 | PC: 14134 | Open file (Filename = 'PHANG.COM') |
| 2018-12-17T23:11:35.051956437Z | 66 | PC: 141eb | Move file pointer |
| 2018-12-17T23:11:35.053404554Z | 62 | PC: 1415b | Close file |
| 2018-12-17T23:11:35.056438585Z | 79 | PC: 14127 | Find next file |
| 2018-12-17T23:11:35.058913395Z | 61 | PC: 14134 | Open file (Filename = 'PRINTA~1.COM') |
| 2018-12-17T23:11:35.065932382Z | 66 | PC: 141eb | Move file pointer |
| 2018-12-17T23:11:35.067989065Z | 62 | PC: 1415b | Close file |
| 2018-12-17T23:11:35.06973415Z | 79 | PC: 14127 | Find next file |
| 2018-12-17T23:11:35.072175716Z | 61 | PC: 14134 | Open file (Filename = 'MANDEL.COM') |
| 2018-12-17T23:11:35.079332243Z | 66 | PC: 141eb | Move file pointer |
| 2018-12-17T23:11:35.080785765Z | 62 | PC: 1415b | Close file |
| 2018-12-17T23:11:35.082514053Z | 79 | PC: 14127 | Find next file |
| 2018-12-17T23:11:35.085699085Z | 61 | PC: 14134 | Open file (Filename = 'PAH.COM') |
| 2018-12-17T23:11:35.092221302Z | 66 | PC: 141eb | Move file pointer |
| 2018-12-17T23:11:35.093672687Z | 62 | PC: 1415b | Close file |
| 2018-12-17T23:11:35.096757713Z | 79 | PC: 14127 | Find next file |
| 2018-12-17T23:11:35.099858776Z | 61 | PC: 14134 | Open file (Filename = 'TEST.COM') |
| 2018-12-17T23:11:35.106451166Z | 66 | PC: 141eb | Move file pointer |
| 2018-12-17T23:11:35.108479618Z | 87 | PC: 1414b | Get or set file date and time |
| 2018-12-17T23:11:35.11036008Z | 44 | PC: 1416b | Get time 0x1416b: or dx, dx 0x1416d: je 0x14167 0x1416f: mov word ptr [bp + 0x232], dx 0x14173: mov ax, 0x4200 0x14176: call 0x141e5 0x14179: mov ah, 0x3f 0x1417b: lea dx, word ptr [bp + 0x20f] 0x1417f: mov cx, 3 0x14182: int 0x21 0x14184: cmp byte ptr [bp + 0x20f], 0x4d 0x14189: je 0x14157 0x1418b: cmp byte ptr [bp + 0x20f], 0x5a 0x14190: je 0x14157 0x14192: mov ax, 0x4202 0x14195: call 0x141e5 0x14198: sub ax, 3 0x1419b: mov word ptr cs:[bp + 0x20d], ax 0x141a0: lea si, word ptr [bp + 0x105] 0x141a4: mov di, 0xfb90 0x141a7: mov cx, 0x130 |
| 2018-12-17T23:11:35.112767625Z | 66 | PC: 141eb | Move file pointer |
| 2018-12-17T23:11:35.114438343Z | 63 | PC: 14184 | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-17T23:11:35.121527961Z | 66 | PC: 141eb | Move file pointer |
| 2018-12-17T23:11:35.123172173Z | 64 | PC: 141bd | Write file or device (Write 304 bytes on handle 5) |
| 2018-12-17T23:11:35.138599129Z | 66 | PC: 141eb | Move file pointer |
| 2018-12-17T23:11:35.14138387Z | 64 | PC: 141ce | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-17T23:11:35.144159956Z | 87 | PC: 141d5 | Get or set file date and time |
| 2018-12-17T23:11:35.145803845Z | 62 | PC: 141d9 | Close file |
| 2018-12-17T23:11:35.16202556Z | 26 | PC: 141e0 | Set disk transfer address |
| 2018-12-17T23:11:35.163487459Z | 48 | PC: 12a63 | Get DOS version |
| 2018-12-17T23:11:35.164892599Z | 9 | PC: 12a7a | Display string (String= ' --=[ Selfchecking AntiStealth Goat COM/EXE file, 01/06/01 ]=------------------ (c) 1995-2001 by ROSE SWE, Dipl.-Ing. Ralph Roth - Version 1.18 - Freeware ') |
| 2018-12-17T23:11:35.174648256Z | 61 | PC: 12cb7 | Open file (Filename = '') |
| 2018-12-17T23:11:35.18125115Z | 9 | PC: 12a88 | Display string (String= 'Self test: ') |
| 2018-12-17T23:11:35.183500197Z | 93 | PC: 12b24 | File sharing functions |
| 2018-12-17T23:11:35.186124067Z | 9 | PC: 12b03 | Display string (String= 'Size change=+0260h/00608d. Virus might be activ? ') |
| 2018-12-17T23:11:35.191798191Z | 76 | PC: 12b09 | Terminate with return code (Return code = '1') |