Written in Delphi

c:\WINDOWS\wsaS4747.exe 

size: 30.720 bytes
 
port: 4747, 4748 TCP

startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "wsaS4747"