So the next step is to look at windows System/Application/Security logs to see if any entries correspond with these process executions. Also set up a trace and try and capture more information about these queries.
The probability of survival is inversely proportional to the angle of arrival.