.
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-17T23:11:53.889742342Z | 26 | PC: 1410c | Set disk transfer address |
| 2018-12-17T23:11:53.896735271Z | 78 | PC: 1414a | Find first file |
| 2018-12-17T23:11:53.902493075Z | 61 | PC: 14156 | Open file (Filename = 'SLEEP.COM') |
| 2018-12-17T23:11:53.908651448Z | 63 | PC: 14165 | Read file or device (Read 4 bytes on handle 5) |
| 2018-12-17T23:11:53.916441862Z | 66 | PC: 1417e | Move file pointer |
| 2018-12-17T23:11:53.918251861Z | 64 | PC: 14193 | Write file or device (Write 4 bytes on handle 5) |
| 2018-12-17T23:11:53.920899769Z | 64 | PC: 1419e | Write file or device (Write 276 bytes on handle 5) |
| 2018-12-17T23:11:54.084831007Z | 66 | PC: 141a7 | Move file pointer |
| 2018-12-17T23:11:54.086065852Z | 64 | PC: 141c9 | Write file or device (Write 4 bytes on handle 5) |
| 2018-12-17T23:11:54.090271364Z | 62 | PC: 1413e | Close file |
| 2018-12-17T23:11:54.095796775Z | 90 | PC: 1414a | Create unique file |
| 2018-12-17T23:11:54.099577156Z | 59 | PC: 141ea | Change current directory |
| 2018-12-17T23:11:54.105644975Z | 26 | PC: 14120 | Set disk transfer address |
| 2018-12-17T23:11:54.106698505Z | 48 | PC: 12a63 | Get DOS version |
| 2018-12-17T23:11:54.108118426Z | 9 | PC: 12a7a | Display string (String= ' --=[ Selfchecking AntiStealth Goat COM/EXE file, 01/06/01 ]=------------------ (c) 1995-2001 by ROSE SWE, Dipl.-Ing. Ralph Roth - Version 1.18 - Freeware ') |
| 2018-12-17T23:11:54.113216562Z | 61 | PC: 12cb7 | Open file (Filename = '') |
| 2018-12-17T23:11:54.1192353Z | 9 | PC: 12a88 | Display string (String= 'Self test: ') |
| 2018-12-17T23:11:54.121631654Z | 93 | PC: 12b24 | File sharing functions |
| 2018-12-17T23:11:54.122903071Z | 9 | PC: 12b03 | Display string (String= 'Size change=+0118h/00280d. Virus might be activ? ') |
| 2018-12-17T23:11:54.126284032Z | 76 | PC: 12b09 | Terminate with return code (Return code = '1') |