Tried different filters in ProcMon to find relevant information. Filter: Path (contains) - Shows two different rundll instances, PID 320 and 940. PID 320 had three events total, nothing notable. PID ...