{
      strings:
            $a1 = "FONTCACHE.DAT" ascii
            $a2 = "getpd" ascii
            $a3 = "MCSF_Config" ascii
            $a4 = "NTUSER.LOG" ascii
            $a5 = "getp"ascii
            $a6 = "unlplg" ascii
            $a7 = "CSTR"ascii
            $a8 = "ldplg" ascii
condition:
             3 of them
}