value: obfuscated service profile file is written to %APPDATA%\Microsoft\%RANDOM%%RANDOM%.txt that is executed using cmstp.exe to download and execute a first-stage scriptlet 
name: Signed Binary Proxy Execution: Cmstp