NTDLL Loaded from an Unusual Path

library where dll.pe.original_file_name : "ntdll.dll" and
 dll.name != null and process.pid != 4 and process.executable != null and
 not dll.path : ("?:\\Windows\\SysWOW64\\ntdll.dll",
                 "?:\\Windows\\System32\\ntdll.dll",
                 "?:\\Windows\\System32\\ntdll.dll.???",
                 "?:\\Windows\\SyChpe32\\ntdll.dll",
                 "?:\\Windows\\WinSxS\\amd64_microsoft-windows-ntdll_*\\ntdll.dll",
                 "?:\\Windows\\WinSxS\\wow64_microsoft-windows-ntdll_*\\ntdll.dll",
                 "?:\\Windows\\WinSxS\\Temp\\InFlight\\*\\amd64_microsoft-windows-ntdll_*\\ntdll.dll",
                 "C:\\Windows\\SMSS-*.tmp",
                 "C:\\$Windows.~BT\\NewOS\\Windows\\SysWOW64\\ntdll.dll",
                 /* vsmbSharePrefix */
                 "\\Device\\vmsmb\\VSMB-{*}\\os\\windows\\*\\ntdll.dll",
                 "?:\\Windows\\WinSxS\\Temp\\PendingDeletes\\$$DeleteMe*",
                 "?:\\ProgramData\\Microsoft\\Windows\\Containers\\BaseImages\\*\\Files\\Windows\\System32\\ntdll.dll",
                 "?:\\Windows\\WinSxS\\Temp\\InFlight\\*\\ntdll.dll",
                 "?:\\$Windows.~BT\\NewOS\\Windows\\WinSxS\\amd64_microsoft-windows-ntdll_*\\ntdll.dll",
                 "C:\\ProgramData\\SecureWorks\\TaegisAgent\\{*}\\ntdll.x64.dll",
                 "C:\\$Windows.~BT\\NewOS\\Windows\\System32\\ntdll.dll") and
 not (process.code_signature.subject_name : ("INCA Internet Co.,Ltd.", "NEXON Korea Corporation.", "Acronis International GmbH", "Pearl abyss Corp") and
      process.code_signature.trusted == true) and
 not (process.executable : "C:\\Windows\\System32\\smss.exe" and dll.path : "?:\\ProgramData\\docker\\windowsfilter\\*\\Files\\Windows\\System32\\ntdll.dll")