Might have changed by now, but what they used to do was usually: * Download a large file (e.g. XP SP3) from Microsofts servers to test bandwidth * Download IP

Might have changed by now, but what they used to do was usually: * Download a large file (e.g. XP SP3) from Microsofts servers to test bandwidth * Download IP scanners and trying to run them (in order to find new hosts to attack) * Download botnet code that connects to some C2 server Tools they download were often downloaded as source, which they then tried to compile in order to run it. Searching for e.g. 'youtube kippo' will get you videos of honeypot sessions.