Library Loaded via a CallBack Function

sequence by process.entity_id 
 [process where event.action == "start"]
 [library where 
 (
  ((dll.Ext.relative_file_creation_time <= 300 or
    (dll.Ext.device.product_id : ("Virtual DVD-ROM", "Virtual Disk") and not dll.path : "C:\\*")) and
   (dll.code_signature.trusted == false or dll.code_signature.exists == false)) or 
  
   dll.name in~ ("vaultcli.dll", "wmiutils.dll", "taskschd.dll", "dnsapi.dll", "dsquery.dll", 
              "mstask.dll", "mstscax.dll", "sqlite3.dll", "clr.dll", "coreclr.dll", "ws2_32.dll", 
              "wininet.dll", "dnsapi.dll", "winhttp.dll", "psapi.dll", "bitsproxy.dll", "softokn3.dll", 
              "System.Management.Automation.dll", "Wldap32.dll")
 ) and 

 process.thread.Ext.call_stack_summary in 
                ("ntdll.dll
| kernelbase.dll
| ntdll.dll
| kernel32.dll
| ntdll.dll", 
                 "ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| ntdll.dll
| kernel32.dll
| ntdll.dll") and
 not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info like "C:\\Windows\\Sys?????\\ntdll.dll!KiUserApcDispatcher*")
 ]
 until [process where event.action == "end"]