Analysis PDF here: http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-La... They don't give information on how the DLL got there in the first place, though.