The next morning, the engineer turns on his computer at about 8:30 a.m., and it establishes a connection to my laptop. Because the Trojan is running under his account, I have full domain administrator privileges, and it takes me only a few seconds to identify the domain controller that contains all the account passwords for the entire company. A hacker tool called "fgdump" allows me to dump the hashed (meaning scrambled) passwords for every user.