Server:
dropped file:
C:\WINDOWS\KERNEL64_DLL.EXE

size: 144 KB

port: 3388, 2211 TCP

startup:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run