{ strings: $a1 = "FONTCACHE.DAT" ascii $a2 = "getpd" ascii $a3 = "MCSF_Config" ascii $a4 = "NTUSER.LOG" ascii $a5 = "getp"ascii $a6 = "unlplg" ascii $a7 = "CSTR"ascii $a8 = "ldplg" ascii condition: 3 of them }