Suspicious Image Load from a Stomped Module

library where dll.code_signature.subject_name == "Microsoft Windows" and
 process.thread.Ext.call_stack_summary regex """.*\
| (wininet.dll
| ws2_32.dll)\
| [a-z]+\.dll""" and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.symbol_info : ("C:\\Windows\\System32\\wininet.dll!InternetOpen*", "C:\\Windows\\System32\\ws2_32.dll!WSASocket*")) and
 _arraysearch(process.thread.Ext.call_stack, $entry, $entry.callsite_trailing_bytes : "?*" and not $entry.symbol_info : ("C:\\Windows\\System32\\ntdll.dll*", "C:\\Windows\\System32\\kernelbase.dll*", "C:\\Windows\\System32\\wininet.dll*", "C:\\Windows\\System32\\ws2_32.dll*", "Unbacked*")) and
 not process.thread.Ext.call_stack_summary like "ntdll.dll
| *
| kernelbase.dll
| ws2_32.dll
| libcef.dll" and
 not (process.name : ("msedge.exe", "msedgewebview2.exe") and process.thread.Ext.call_stack_summary like "ntdll.dll
| *
| ws2_32.dll
| msedge.dll") and
 not dll.name in ("mswsock.dll", "bcrypt.dll") and
 not (dll.name : "FWPUCLNT.DLL" and process.thread.Ext.call_stack_summary like "ntdll.dll
| *
| wininet.dll
| adal.dll") and
 not (dll.name : "dnsapi.dll" and process.thread.Ext.call_stack_summary like ("ntdll.dll
| *
| ws2_32.dll
| wininet.dll", "ntdll.dll
| *
| wininet.dll
| ntdll.dll"))