Microsoft Common Language Runtime Loaded from Suspicious Memory

library where dll.name : "clr.dll" and
 process.thread.Ext.call_stack_summary : 
             ("ntdll.dll
| wow64.dll
| wow64cpu.dll
| wow64.dll
| ntdll.dll
| kernelbase.dll
| mscoreei.dll
| Unbacked", 
              "ntdll.dll
| kernelbase.dll
| mscoreei.dll
| Unbacked") and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : "*mscoreei.dll!CreateInterface*") and
 not (process.executable : "?:\\Program Files\\Dell\\DTP\\DiagnosticsSubAgent\\Dell.TechHub.Diagnostics.SubAgent.exe" and
      process.code_signature.trusted == true and process.code_signature.subject_name : "Dell Inc") and
 not (process.code_signature.trusted == true and 
      process.code_signature.subject_name : ("Azul Systems, Inc.", "JetBrains s.r.o.", "HAYLEM Technologies Inc.", "MicroStrategy, Inc.", "Oracle America, Inc.")) and
 not (process.executable : "C:\\ManageEngine\\ADManager Plus\\jre\\bin\\java.exe" and 
      process.code_signature.subject_name : "Oracle America, Inc." and process.code_signature.trusted == true) and 
 not (process.executable : "?:\\Program Files*\\Amazon Corretto\\jdk*\\bin\\java.exe" and 
      process.code_signature.subject_name : ("Amazon.com Services LLC", "Amazon Services LLC", "Adaptive Protocols, Inc.") and process.code_signature.trusted == true)  and 
 not (process.executable : "?:\\ManageEngine\\PAM360\\jre\\bin\\java.exe" and
      process.code_signature.trusted == true and
      process.code_signature.subject_name : ("Oracle America, Inc.", "Eclipse.org Foundation, Inc.")) and
 not (process.executable : "*\\EL.AudioVideoConversion.Console.exe" and
      process.code_signature.trusted == true and
      process.code_signature.subject_name : "NEXUS / E&L GmbH") and
 not process.executable :
               ("?:\\Program Files\\Microsoft Visual Studio\\*.exe",
                "?:\\Program Files (x86)\\Microsoft Visual Studio\\*.exe",
                "?:\\Program Files (x86)\\PMP\\jre\\bin\\java.exe",
                "?:\\Program Files\\ManageEngine\\PMP\\jre\\bin\\java.exe",
                "?:\\Program Files\\ManageEngine\\PAM360\\jre\\bin\\java.exe",
                "?:\\Program Files (x86)\\Adaptiva\\AdaptivaClient\\bin\\AdaptivaClientService.exe",
                "?:\\Program Files\\Adaptiva\\AdaptivaClient\\bin\\AdaptivaClientService.exe",
                "C:\\Program Files\\Siemens\\teamplay\\bin\\*\\syngo.Cloud.Receiver.Plugin.DicomTagResolver.exe",
                "?:\\Program Files\\Sql Server Extension\\SqlServerExtension.Service.exe",
                "C:\\Program Files\\Siemens\\CloudLink\\*.exe",
                "C:\\Program Files (x86)\\Razer\\Razer Cortex\\RazerCortex.exe",
                "C:\\Program Files\\Guard\\Data Vault Publisher for Citect\\*.exe",
                "C:\\Program Files\\Koios\\Koios DS\\KoiosDS-MVC-App.exe",
                "?:\\Program Files\\Commvault\\ContentStore\\DotNetCore\\dotnet.exe",
                "?:\\Program Files\\Siemens\\ABT Site\\Bin\\Siemens.BASys.ABTSite.exe") and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                    $entry.callsite_trailing_bytes : ("c5f8774883ec10c5fb1104244883ec104889042449ba00000000000000004*",
                                                      "*488b8d48ffffff48894b104c8b658049894424084c896588c745c0*"))