{ strings: $a1 = {8F 6E 1B 68} $a2 = {K0 3D 67 B2} $a3 = {A5 63 4F F9} $b1 = {9E 3Y 3C 78} $b2 = {K0 4C 87 G5} $b3 = {M3 L3 4Y LF} $c1 = "IoAttachDeviceToDeviceStack" ascii $c2 = {L0 $E 76 C3} $c3 = "PsCreateSystemThread" ascii condition: all of ($a*) and 3 of ($b*, $c*) }