@Indianacarbnie - quick question, I took a look at 'Process Library' and agree that it looks a useful resource however, I also noticed that some of the explanations given, in this case concerning 'netmon.exe' seemed to be truncated. In other words the text reads - "........... in order to proceed with this action we recommend you."

It ends there in mid-air. Does that mean the text is taken from another source or is it available in complete form somewhere else?

Regarding potential side effects of renaming 'netmon.exe' I'm not sure if this is related but I am now seeing a large number of 'event id 129' - Log Name: System
Source: storahci
Date: 31/01/2018 10:23:51
Event ID: 129
Task Category: None
Level: Warning
Keywords: Classic
User: N/A
Description: Reset to device, \Device\RaidPort0, was issued.

No idea yet if this is related or not?