Suspicious Call Stack Trailing Bytes

any where process.executable != null and 
 /* add esp, 0xab; ret; nop; nop; nop; */
_arraysearch(process.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes : ("4883????c3909090909090*", "4883C4485B415CC390909090*")) and 
 (
  (event.category == "api" and process.Ext.api.name like ("VirtualProtect*", "WriteProcessMemory")) or 
  (event.category == "library" and dll.name in~ ("ws2_32.dll", "wininet.dll", "winhttp.dll"))
  ) and 
 not _arraysearch(process.thread.Ext.call_stack, $entry, 
                  $entry.callsite_trailing_bytes :
                           ("4883c428c390909090909090904c8bdc574883ec6049c743b8feffffff49895b1849897320488b05c9a024004833c44889442450488bfa488bd9488b521849c7",
                            "4883c4205bc3488b8180000000c390909090909090904883ec2833c08b123b15261b3601751d83797c007417488b05f3d43101488b008b517c4889c1e8c5a406",
                            "4883c428c3909090909090909090909044894c242044894424188954241048894c24084883ec28*")) and
 not _arraysearch(process.thread.Ext.call_stack, $entry,
                  $entry.callsite_leading_bytes :"3b4208750b498908488b01ff5008eb05bb024000808bc34883c4205bc34883ec3848c7442420feffffff488bc1488b094885c9740b48832000488b01ff501090")