Oversized DLL Creation followed by SideLoad

sequence with maxspan=5m
 [file where event.action != "deletion" and file.Ext.header_bytes : "4d5a*" and

  /* size more or equal to 90MB */
   file.size >= 90000000 and

  not process.executable : "?:\\Windows\\System32\\drvinst.exe" and

  not (process.code_signature.trusted == true and not process.code_signature.subject_name : "Microsoft *")
 ] as event0
 [library where
   (dll.Ext.relative_file_creation_time < 5000 or dll.Ext.relative_file_name_modify_time < 5000) and
   not dll.code_signature.trusted == true and
   process.code_signature.trusted == true and not startswith~(dll.name, process.name) and
   startswith~(dll.path, event0.file.path) and
   not process.executable : 
               ("?:\\Program Files\\*.exe", 
                "?:\\Program Files (x86)\\*.exe", 
                "?:\\Windows\\System32\\DriverStore\\FileRepository\\*", 
                "?:\\Windows\\SysWOW64\\DriverStore\\FileRepository\\*", 
                "?:\\Windows\\System32\\msiexec.exe", 
                "?:\\Users\\*\\AppData\\Local\\SquirrelTemp\\Update.exe") and 
   not process.code_signature.subject_name :
                              ("TEAMDEV LTD.", "Spotify AB", "Snap-on Business Solutions, Inc.", "ITAU UNIBANCO S.A.",
                               "Kahua Inc.", "Bloomberg LP", "Amazon.com Services LLC", "EnterpriseDB Corporation",
                               "Mitel Networks Corporation", "The Document Foundation", "Bytedance Pte. Ltd.", "Kahua Inc.", 
                               "Sikka Software Corporation", "Leica Geosystems Inc", "3M Company", "DASSAULT SYSTEMES SE",
                               "Dassault Systemes SolidWorks Corp.", "Siemens Industry Software Inc.", "PlanGrid, Inc.",
                               "Stichting Blender Foundation") and
   not dll.name : ("libcef.dll", "Qt?WebEngineCore.dll", "xul.dll", "chrome.dll", "libwireshark.dll", "chrome_child.dll", "msedge.dll") and
  /* loaded from current dir */
   endswith~(substring(dll.path, 0, length(dll.path) - (length(dll.name) + 1)),
             substring(process.executable, 0, length(process.executable) - (length(process.name) + 1)))]