Suspicious Control Panel DLL Loaded by Explorer

sequence  with maxspan = 5s

 [library where process.name : "explorer.exe" and
  (dll.code_signature.trusted == false or dll.code_signature.exists == false) and
  (dll.Ext.relative_file_creation_time <= 500 or dll.Ext.relative_file_name_modify_time <= 500) and
  not dll.path :
          ("?:\\Program Files\\*",
           "?:\\Program Files (x86)\\*",
           "?:\\Windows\\System32\\*",
           "?:\\Windows\\SysWOW64\\*",
           "?:\\Windows\\assembly\\*",
           "?:\\Windows\\WinSxS\\*",
           "?:\\Windows\\Microsoft.NET\\assembly\\*",
           "?:\\ProgramData\\RICOH_DRV\\*",
           "?:\\ProgramData\\EPSON\\*",
           "?:\\ProgramData\\Seagull\\Drivers\\*") and
   not dll.hash.sha256 : "35fb376fac5bbd83843958df8c3bf941681db116f1f500396ce813efd13d76b0" and
   not (dll.pe.imphash : "d41d8cd98f00b204e9800998ecf8427e" and
         dll.path : ("?:\\ProgramData\\Seagull\\Drivers\\Temp\\*.tmp",
                     "?:\\Users\\*\\AppData\\Local\\Temp\\ptx*.tmp",
                     "?:\\Users\\*\\Temp\\ptx*.tmp"))
   ] by process.entity_id

 [process where event.action == "start" and process.parent.name : "explorer.exe" and

  /* CLSID_ControlPanelProcessExplorerHost */
  process.parent.args : "/factory,{5BD95610-9434-43C2-886C-57852CC8A120}" and

  /* false positives */
  not (process.name : "rundll32.exe" and
       process.args :
            ("printui.dll,PrintUIEntryDPIAware",
             "?:\\WINDOWS\\system32\\spool\\DRIVERS\\*PrintJobStatus",
             "fdprint,InvokeTask")) and
  not (process.name : "mmc.exe" and process.args : "?:\\windows\\system32\\devmgmt.msc") and
  not process.executable : ("?:\\windows\\system32\\DevicePairingWizard.exe", "?:\\Windows\\System32\\spool\\drivers\\x64\\3\\E_YARNYWE.EXE")
  ] by process.parent.entity_id