Suspicious AppDomain Manager Configuration File

sequence with maxspan=5m
 [file where event.action : ("creation", "rename") and file.name : "*.exe.config" and
  not file.path : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
  not process.executable :
               ("?:\\Windows\\Microsoft.NET\\Framework*\\dfsvc.exe",
                "?:\\Program Files\\Microsoft Visual Studio\\*.exe") and
  not (process.code_signature.subject_name : "Volvo Car Corporation" and process.code_signature.trusted == true)] as event0
 [library where
  not dll.code_signature.status : "trusted" and startswith~(event0.file.name, process.name) and
  user.id : ("S-1-5-21*", "S-1-12-*") and
  (dll.Ext.relative_file_creation_time <= 500 or dll.Ext.relative_file_name_modify_time <= 500) and
  _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: "*clr.dll!StrongNameTokenFromPublicKey*")  and

  not process.executable : ("?:\\Program Files\\*", "?:\\Program Files (x86)\\*") and
  not _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info: ("*ntdll.dll*!LdrLoadDll*", "*combase.dll*!CoGetTreatAsClass*")) and
  not dll.path :
        ("?:\\Windows\\System32\\DriverStore\\FileRepository\\*",
		 "?:\\Windows\\SysWOW64\\DriverStore\\FileRepository\\*",
		 "?:\\Windows\\assembly\\NativeImages\\*",
		 "?:\\windows\\WinSxS\\*",
		 "?:\\Program Files\\*",
		 "?:\\Program Files (x86)\\*",
		 "?:\\Windows\\Microsoft.NET\\*") and
  not dll.path regex~ """(.:\\windows\\system32\\[a-z0-9\-\_\.]+\.dll
| .:\\windows\\syswow64\\[a-z0-9\-\_\.]+\.dll
| .:\\windows\\[a-z0-9\-\_\.]+\.dll)""" and
  not process.executable :
            ("?:\\Windows\\System32\\rundll32.exe",
			 "?:\\Windows\\SysWOW64\\rundll32.exe",
			 "?:\\Windows\\System32\\regsvr32.exe",
			 "?:\\ProgramData\\Thermo\\Proteome Discoverer*\\Scratch\\*\\ISE.exe") and
  not dll.hash.sha256 : ("4810a7b50ffb5e044ac64432b7fcfe4795cc4c6494e1d7f25f9f9cfe388d2ea6",
                         "9a5294182e611ccdae9962d2e26a84c3287cd18409b4985d468055b690d9134c",
                         "506e3d9184a6c08ae75c1bb7f3d72901ff6eeade3f6ed06237de878276f9fed7",
                         "eb0153d13e522520015d09e679618b4cc61bd43d0fcd402922b6507daf706edc",
                         "73e6c417b244cfc12f8128732a9af5a336247136b04bdf79e64829bf32d53d67",
                         "7f503243ac077b20f47739c03f1ee57fb9fc487ae34c73c485226c4049806487") and
  not (process.code_signature.subject_name : "Volvo Car Corporation" and process.code_signature.trusted == true)
]