Remote Host Port Number
stolen.wshells.ws 3211
PASS google_cache2.tmp
NICK [DvLz-USA|XP]062652
USER 0626 “” “TsGh” :0626
JOIN #DvLz DvLz#
NICK n[DvLz-USA|XP]737534
USER 4207 “” “TsGh” :4207
NICK [DvLz-USA|XP]976295
USER 9762 “” “TsGh” :9762
* The data identified by the following URL was then requested from the remote web server:
o http://perfectteam.org/nosferatus/Crypter/taskhostt.exe
hosting infos:
http://whois.domaintools.com/208.98.26.140