Asynchronous Procedure Call from Unusual Module

api where process.pid != 4 and process.Ext.api.name in ("NtQueueApcThread", "QueueUserAPC") and
 process.Ext.api.behaviors == "cross-process" and
 process.thread.Ext.call_stack_final_user_module.name != null and
 process.thread.Ext.call_stack_final_user_module.hash.sha256 != null and
 not process.thread.Ext.call_stack_final_user_module.name in ("Undetermined", "Kernel", "Unknown") and
 (
  _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == false or $entry.exists == false) or
  _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.subject_name in ("AutoIt Consulting Ltd", "Python Software Foundation")) or
  (process.thread.Ext.call_stack_final_user_module.name == "Unbacked" and
   (process.thread.Ext.call_stack_final_user_module.protection_provenance_path like "c:\\windows\\microsoft.net\\framework*\\clr.dll" or process.thread.Ext.call_stack_final_user_module.protection_provenance == "clr.dll"))
 ) and
 process.Ext.api.summary != "NtQueueApcThread( csrss.exe, basesrv.dll!BaseSrvNlsUpdateRegistryCache, NULL, Data, Data )" and
 not _arraysearch(process.thread.Ext.call_stack_final_user_module.code_signature, $entry, $entry.trusted == true and
                  $entry.subject_name in ("Microsoft Windows Hardware Compatibility Publisher",
                                          "Microsoft Windows Software Compatibility Publisher",
                                          "Mozilla Corporation", "Beijing Qihu Technology Co., Ltd.",
                                          "Symantec Corporation", "Deep Instinct Ltd",
                                          "TPZ SOLUCOES DIGITAIS LTDA",
                                          "Carbon Black, Inc.", 
                                          "MUSARUBRA US LLC")) and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.symbol_info like ("c:\\windows\\sys?????\\ntdll.dll!NtCreateUserProcess+*",
                                           "c:\\windows\\sys?????\\ntdll.dll!ZwCreateUserProcess*")) and
 not (process.thread.Ext.call_stack_final_user_module.hash.sha256 == "d7d35019ce0c03d97c32ab25a145371806ca2d1572af1e5146ea886d41818850" and
      Target.process.executable : "?:\\Windows\\SysWOW64\\rserver30\\FamItrfc.Exe")