by Valvoline
Server: C:\WINDOWS\SERVER.EXE C:\WINDOWS\KeyHook.dll size: 312 KB port: 12345, 12346 TCP startup: HKLM\Software\Microsoft\Windows\CurrentVersion\Run