Written in Visual C++

Backdoor.Win32.Checkesp:
size: 61.440 bytes

added to registry:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run "tunelling" 
data: sys64.exe