Server:
C:\WINDOWS\slave.exe 

size: 85 KB

port: 3996, 3999, 4000 TCP
      3996 UDP
	  
startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce 

Added:
C:\WINDOWS\ra_msg.dll 
C:\WINDOWS\WININIT.INI