Image:\\rundll32.exe (CommandLine:zxFunction* OR CommandLine:RemoteDiskXXXXX*)