Suspicious Activity from a Control Panel Applet

sequence by process.entity_id
[library where process.executable != null and 
 (dll.Ext.relative_file_creation_time <= 900 or dll.Ext.relative_file_name_modify_time <= 900 or dll.path : "\\Device\\Mup\\*") and 
 (dll.code_signature.exists == false or 
  dll.code_signature.status : ("errorBadDigest", "errorExpired", "errorRevoked", "errorTimeStamp", "errorUntrustedRoot")) and
 not dll.path regex~ """([C-H]:\\windows\\system32\\[a-zA-Z0-9\-\_\.]+\.cpl
| [C-H]:\\windows\\syswow64\\[a-zA-Z0-9\-\_\.]+\.cpl)"""] as event0
[any where
 (
  (((event.category == "api" and not process.Ext.api.name : "IoCreateDevice") or
   (event.category : "library" and dll.name : ("ws2_32.dll", "winhttp.dll", "wininet.dll"))) and
   _arraysearch(process.thread.Ext.call_stack, $entry, stringcontains~($entry.symbol_info, concat(event0.dll.name, "!CPlApplet")))) or 
   
  (event.category : "process" and event.action == "start" and 
   _arraysearch(process.parent.thread.Ext.call_stack, $entry, stringcontains~($entry.symbol_info, concat(event0.dll.name, "!CPlApplet")))) or

  (event.category == "api" and process.Ext.api.name != "IoCreateDevice" and
   _arraysearch(process.thread.Ext.call_stack, $entry, endswith~($entry.protection_provenance, "*.cpl") and stringcontains~($entry.protection_provenance, event0.dll.name)))
  )]
 until [process where event.action == "end"]