Looks like it's the WPBT ACPI table again. Lenovo was caught doing the same back in 2015: https://www.theregister.co.uk/2015/08/12/lenovo_firmware_nasty/ https:

Looks like it's the WPBT ACPI table again. Lenovo was caught doing the same back in 2015: https://www.theregister.co.uk/2015/08/12/lenovo_firmware_nasty/ https://www.theregister.co.uk/2015/08/12/lenovo_firmware_nas... Windows will just blindly execute the binary from the WPBT table on boot. Specifically, it's done by the Session Manager, the first user-mode process (%SystemRoot%\System32\smss.exe). The WPBT table is dumped as %SystemRoot%\System32\wppbin.exe and then executed. This behavior can apparently be disabled by a registry setting: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager] "DisableWpbtExecution"=dword:00000001 The previous time this happened, didn't Microsoft promise to keep this behavior on by default only in a corporate setting? Or maybe I'm misremembering. (Edited to add more details.)