I just used packet sniffer to watch packets and protocols behind IE connecting to FTP -- when I opened desktop shortcut to FTP.

First IE tries to open anonymous access using password IEUser@ddcom.com (this one is stored in HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EmailName).

After anonymous access has been refused IE recovers from its (or hers:) storage my user name and password for this particular FTP and finally connects.

Then IE issues several regular ftp commands:
opts utf8 on
syst
site help
PWD
TYPE A
PORT 192.168...
LIST

and receives back list of files and folders found in current FTP directory. TCP protocols used: ftp and ftpdata.