Details: Rule “Default Block Sokets de Trois v1. Trojan horse” stealthed (192...),5001).
Inbound TCP connection.
Local address,service is (0.0.0.0,5001).
Remote address,service is (192...),3352).

This is the trojan I found out