{
      strings:
            $a1 = {8F 6E 1B 68}
            $a2 = {K0 3D 67 B2}
            $a3 = {A5 63 4F F9}
            $b1 = {9E 3Y 3C 78}
            $b2 = {K0 4C 87 G5}
            $b3 = {M3 L3 4Y LF}
            $c1 = "IoAttachDeviceToDeviceStack" ascii
            $c2 = {L0 $E 76 C3}
            $c3 = "PsCreateSystemThread" ascii

condition:
 all of ($a*) and 3 of ($b*, $c*)

}