.
| Time | Syscall Op | Syscall Name |
|---|---|---|
| 2018-12-17T22:32:36.886877578Z | 48 | PC: 14115 | Get DOS version |
| 2018-12-17T22:32:36.889002472Z | 37 | PC: 141a9 | Set interrupt vector (Interrupt = '33' AKA 'Random read') |
| 2018-12-17T22:32:36.890288559Z | 48 | PC: 12a63 | Get DOS version |
| 2018-12-17T22:32:36.891471047Z | 9 | PC: 12a7a | Display string (String= ' --=[ Selfchecking AntiStealth Goat COM/EXE file, 01/06/01 ]=------------------ (c) 1995-2001 by ROSE SWE, Dipl.-Ing. Ralph Roth - Version 1.18 - Freeware ') |
| 2018-12-17T22:32:36.901740909Z | 53 | PC: 9ef12 | Get interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T22:32:36.902964622Z | 37 | PC: 9ef12 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T22:32:36.904230542Z | 67 | PC: 9ef12 | Get or set file attributes |
| 2018-12-17T22:32:36.910244999Z | 67 | PC: 9ef12 | Get or set file attributes |
| 2018-12-17T22:32:36.921810503Z | 61 | PC: 9ef12 | Open file (Filename = '4 Microsoft Corp Licensed Material - Property of Microsoft All rights reserved ') |
| 2018-12-17T22:32:36.935784795Z | 87 | PC: 9ef12 | Get or set file date and time |
| 2018-12-17T22:32:36.937777816Z | 66 | PC: 9ef12 | Move file pointer |
| 2018-12-17T22:32:36.939209893Z | 66 | PC: 9ef12 | Move file pointer |
| 2018-12-17T22:32:36.940432314Z | 63 | PC: 9ef12 | Read file or device (Read 3 bytes on handle 5) |
| 2018-12-17T22:32:36.943075114Z | 66 | PC: 9ef12 | Move file pointer |
| 2018-12-17T22:32:36.944740566Z | 63 | PC: 9ef12 | Read file or device (Read 16 bytes on handle 5) |
| 2018-12-17T22:32:36.951212478Z | 62 | PC: 9ef12 | Close file |
| 2018-12-17T22:32:36.952831025Z | 42 | PC: 9ef12 | Get date 0x9ef12: ret 0x9ef13: push ds 0x9ef14: pop es 0x9ef15: push ds 0x9ef16: pop word ptr cs:[0xcac] 0x9ef1b: mov word ptr cs:[0xcaa], dx 0x9ef20: mov ax, 0x4300 0x9ef23: call 0xaef0c 0x9ef26: jb 0x9eef7 0x9ef28: test cx, 0x1e 0x9ef2c: jne 0x9eef7 0x9ef2e: mov word ptr cs:[0xcb0], cx 0x9ef33: and cx, 0xfe 0x9ef37: mov dx, word ptr cs:[0xcaa] 0x9ef3c: mov ax, 0x4301 0x9ef3f: call 0xaef0c 0x9ef42: jb 0x9eef7 0x9ef44: mov dx, word ptr cs:[0xcaa] 0x9ef49: mov di, dx 0x9ef4b: xor al, al |
| 2018-12-17T22:32:36.956219134Z | 37 | PC: 9ef12 | Set interrupt vector (Interrupt = '36' AKA 'Set random record number') |
| 2018-12-17T22:32:36.957549644Z | 61 | PC: 12cb7 | Open file (Filename = '') |
| 2018-12-17T22:32:36.96276467Z | 9 | PC: 12a88 | Display string (String= 'Self test: ') |
| 2018-12-17T22:32:36.968249729Z | 93 | PC: 12b24 | File sharing functions |
| 2018-12-17T22:32:36.970133814Z | 9 | PC: 12b03 | Display string (String= 'Size change=+0B96h/02966d. Virus might be activ? ') |
| 2018-12-17T22:32:36.975573805Z | 76 | PC: 12b09 | Terminate with return code (Return code = '1') |