InstallFix Executes a Newly Downloaded Stage through rundll32
Detects rundll32 loading a DLL from common user-writable directories (Downloads, Temp, AppData, or ProgramData) which is a known technique used by malware like InstallFix to execute newly downloaded stages.
CQL
