.
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-17T22:08:23.336578633Z | 26 | PC: 14109 | Set disk transfer address |
| 2018-12-17T22:08:23.33806251Z | 78 | PC: 1411d | Find first file |
| 2018-12-17T22:08:23.344551255Z | 61 | PC: 1412a | Open file (Filename = 'SLEEP.COM') |
| 2018-12-17T22:08:23.350905094Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T22:08:23.352672434Z | 62 | PC: 14151 | Close file |
| 2018-12-17T22:08:23.35435151Z | 79 | PC: 1411d | Find next file |
| 2018-12-17T22:08:23.35669542Z | 61 | PC: 1412a | Open file (Filename = 'PRINT.COM') |
| 2018-12-17T22:08:23.363476515Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T22:08:23.364670789Z | 62 | PC: 14151 | Close file |
| 2018-12-17T22:08:23.366373652Z | 79 | PC: 1411d | Find next file |
| 2018-12-17T22:08:23.368796406Z | 61 | PC: 1412a | Open file (Filename = 'HELLO.COM') |
| 2018-12-17T22:08:23.375800717Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T22:08:23.377440751Z | 62 | PC: 14151 | Close file |
| 2018-12-17T22:08:23.379413789Z | 79 | PC: 1411d | Find next file |
| 2018-12-17T22:08:23.382172513Z | 61 | PC: 1412a | Open file (Filename = 'PHANG.COM') |
| 2018-12-17T22:08:23.388523872Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T22:08:23.389900923Z | 62 | PC: 14151 | Close file |
| 2018-12-17T22:08:23.393847307Z | 79 | PC: 1411d | Find next file |
| 2018-12-17T22:08:23.395673494Z | 61 | PC: 1412a | Open file (Filename = 'PRINTA~1.COM') |
| 2018-12-17T22:08:23.400193703Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T22:08:23.401740955Z | 62 | PC: 14151 | Close file |
| 2018-12-17T22:08:23.403005826Z | 79 | PC: 1411d | Find next file |
| 2018-12-17T22:08:23.404682417Z | 61 | PC: 1412a | Open file (Filename = 'MANDEL.COM') |
| 2018-12-17T22:08:23.409486438Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T22:08:23.410850816Z | 62 | PC: 14151 | Close file |
| 2018-12-17T22:08:23.412439529Z | 79 | PC: 1411d | Find next file |
| 2018-12-17T22:08:23.416001095Z | 61 | PC: 1412a | Open file (Filename = 'PAH.COM') |
| 2018-12-17T22:08:23.420121608Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T22:08:23.421184555Z | 62 | PC: 14151 | Close file |
| 2018-12-17T22:08:23.437531234Z | 79 | PC: 1411d | Find next file |
| 2018-12-17T22:08:23.440023939Z | 61 | PC: 1412a | Open file (Filename = 'TEST.COM') |
| 2018-12-17T22:08:23.446291052Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T22:08:23.4480816Z | 87 | PC: 14141 | Get or set file date and time |
| 2018-12-17T22:08:23.44972355Z | 44 | PC: 14161 | Get time 0x14161: or dx, dx 0x14163: je 0x1415d 0x14165: mov word ptr [bp + 0x212], dx 0x14169: mov ax, 0x4200 0x1416c: call 0x141cd 0x1416f: mov ah, 0x3f 0x14171: lea dx, word ptr [bp + 0x1f7] 0x14175: mov cx, 3 0x14178: int 0x21 0x1417a: mov ax, 0x4202 0x1417d: call 0x141cd 0x14180: sub ax, 3 0x14183: mov word ptr cs:[bp + 0x1f5], ax 0x14188: lea si, word ptr [bp + 0x105] 0x1418c: mov di, 0xfb90 0x1418f: mov cx, 0x110 0x14192: cld 0x14193: rep movsb byte ptr es:[di], byte ptr [si] 0x14195: mov si, 0xfbad 0x14198: call 0x240f2 |
| 2018-12-17T22:08:23.452065631Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T22:08:23.454199591Z | 63 | PC: 1417a | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-17T22:08:23.45698946Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T22:08:23.458717384Z | 64 | PC: 141a5 | Write file or device (Write 272 bytes on handle 5) |
| 2018-12-17T22:08:23.475921573Z | 66 | PC: 141d3 | Move file pointer |
| 2018-12-17T22:08:23.477253281Z | 64 | PC: 141b6 | Write file or device (Write 3 bytes on handle 5) |
| 2018-12-17T22:08:23.479821405Z | 87 | PC: 141bd | Get or set file date and time |
| 2018-12-17T22:08:23.48169699Z | 62 | PC: 141c1 | Close file |
| 2018-12-17T22:08:23.489339103Z | 26 | PC: 141c8 | Set disk transfer address |
| 2018-12-17T22:08:23.490357064Z | 48 | PC: 12a63 | Get DOS version |
| 2018-12-17T22:08:23.491793799Z | 9 | PC: 12a7a | Display string (String= ' --=[ Selfchecking AntiStealth Goat COM/EXE file, 01/06/01 ]=------------------ (c) 1995-2001 by ROSE SWE, Dipl.-Ing. Ralph Roth - Version 1.18 - Freeware ') |
| 2018-12-17T22:08:23.501275924Z | 61 | PC: 12cb7 | Open file (Filename = '') |
| 2018-12-17T22:08:23.508042427Z | 9 | PC: 12a88 | Display string (String= 'Self test: ') |
| 2018-12-17T22:08:23.511755513Z | 93 | PC: 12b24 | File sharing functions |
| 2018-12-17T22:08:23.51378813Z | 9 | PC: 12b03 | Display string (String= 'Size change=+0220h/00544d. Virus might be activ? ') |
| 2018-12-17T22:08:23.519170081Z | 76 | PC: 12b09 | Terminate with return code (Return code = '1') |