config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_registry_key_name contains "Software\Wow6432Node\Google\Chrome\Extensions" and 
 action_registry_key_name contains "update_url") and 
 (action_registry_key_name in ("*fdcgdnkidjaadafnichfpabhfomcebme*", "*fcfhplploccackoneaefokcmbjfbkenj*", "*bihmplhobchoageeokmgbdihknkjbknd*", "*gkojfkhlekighikafcpjkiklfbnlmeio*", "*jajilbjjinjmgcibalaakngmkilboobh*", "*gjknjjomckknofjidppipffbpoekiipm*", "*nabbmpekekjknlbkgpodfndbodhijjem*", "*kpiecbcckbofpmkkkdibbllpinceiihk*", "*nlbejmccbhkncgokjcmghpfloaajcffj*", "*omghfjlpggmjjaagoclmmobgdodcjboh*", "*bibjcjfmgapbfoljiojpipaooddpkpai*", "*mpcaainmfjjigeicjnlkdfajbioopjko*", "*jljopmgdobloagejpohpldgkiellmfnc*", "*lochiccbgeohimldjooaakjllnafhaid*", "*nhnfcgpcbfclhfafjlooihdfghaeinfc*", "*ookhnhpkphagefgdiemllfajmkdkcaim*", "*namfblliamklmeodpcelkokjbffgmeoo*", "*nbcojefnccbanplpoffopkoepjmhgdgh*", "*majdfhpaihoncoakbjgbdhglocklcgno*", "*lnfdmdhmfbimhhpaeocncdlhiodoblbd*", "*eppiocemhmnlbhjplcgkofciiegomcon*", "*cocfojppfigjeefejbpfmedgjbpchcng*", "*foiopecknacmiihiocgdjgbjokkpkohc*", "*hhdobjgopfphlmjbmnpglhfcgppchgje*", "*jgbaghohigdbgbolncodkdlpenhcmcge*", "*inligpkjkhbpifecbdjhmdpcfhnlelja*", "*higioemojdadgdbhbbbkfbebbdlfjbip*", "*hipncndjamdcmphkgngojegjblibadbe*", "*iolonopooapdagdemdoaihahlfkncfgg*", "*nhfjkakglbnnpkpldhjmpmmfefifedcj*", "*jpgljfpmoofbmlieejglhonfofmahini*", "*fgddmllnllkalaagkghckoinaemmogpe*", "*ejkaocphofnobjdedneohbbiilggdlbi*", "*keodbianoliadkoelloecbhllnpiocoi*", "*hoapmlpnmpaehilehggglehfdlnoegck*", "*poeojclicodamonabcabmapamjkkmnnk*", "*dfkdflfgjdajbhocmfjolpjbebdkcjog*", "*kcdahmgmaagjhocpipbodaokikjkampi*", "*klnkiajpmpkkkgpgbogmcgfjhdoljacg*", "*lneaocagcijjdpkcabeanfpdbmapcjjg*", "*pgfpignfckbloagkfnamnolkeaecfgfh*", "*jplnlifepflhkbkgonidnobkakhmpnmh*", "*jliodmnojccaloajphkingdnpljdhdok*", "*hnmpcagpplmpfojmgmnngilcnanddlhb*", "*ffbkglfijbcbgblgflchnbphjdllaogb*", "*kcndmbbelllkmioekdagahekgimemejo*", "*jdgilggpfmjpbodmhndmhojklgfdlhob*", "*bihhflimonbpcfagfadcnbbdngpopnjb*", "*ppajinakbfocjfnijggfndbdmjggcmde*", "*oofgbpoabipfcfjapgnbbjjaenockbdp*", "*bhnhkdgoefpmekcgnccpnhjfdgicfebm*", "*knmmpciebaoojcpjjoeonlcjacjopcpf*", "*dhadilbmmjiooceioladdphemaliiobo*", "*jedieiamjmoflcknjdjhpieklepfglin*", "*mhngpdlhojliikfknhfaglpnddniijfh*", "*omdakjcmkglenbhjadbccaookpfjihpa*", "*npgimkapccfidfkfoklhpkgmhgfejhbj*", "*akeehkgglkmpapdnanoochpfmeghfdln*", "*gbmdmipapolaohpinhblmcnpmmlgfgje*", "*aigmfoeogfnljhnofglledbhhfegannp*", "*cgojmfochfikphincbhokimmmjenhhgk*", "*ficajfeojakddincjafebjmfiefcmanc*", "*ifnaibldjfdmaipaddffmgcmekjhiloa*", "*jbnmpdkcfkochpanomnkhnafobppmccn*", "*apcfdffemoinopelidncddjbhkiblecc*", "*mjolnodfokkkaichkcjipfgblbfgojpa*", "*oifjbnnafapeiknapihcmpeodaeblbkn*", "*plpmggfglncceinmilojdkiijhmajkjh*", "*mjnbclmflcpookeapghfhapeffmpodij*", "*bblcccknbdbplgmdjnnikffefhdlobhp*", "*aojlhgbkmkahabcmcpifbolnoichfeep*", "*lcmammnjlbmlbcaniggmlejfjpjagiia*", "*knajdeaocbpmfghhmijicidfcmdgbdpm*", "*bdlcnpceagnkjnjlbbbcepohejbheilk*", "*edknjdjielmpdlnllkdmaghlbpnmjmgb*", "*eidnihaadmmancegllknfbliaijfmkgo*", "*ckiahbcmlmkpfiijecbpflfahoimklke*", "*macdlemfnignjhclfcfichcdhiomgjjb*", "*chioafkonnhbpajpengbalkececleldf*", "*amnoibeflfphhplmckdbiajkjaoomgnj*", "*llbhddikeonkpbhpncnhialfbpnilcnc*", "*pcienlhnoficegnepejpfiklggkioccm*", "*iocnglnmfkgfedpcemdflhkchokkfeii*", "*igahhbkcppaollcjeaaoapkijbnphfhb*", "*njpmifchgidinihmijhcfpbdmglecdlb*", "*ggackgngljinccllcmbgnpgpllcjepgc*", "*kchocjcihdgkoplngjemhpplmmloanja*", "*bnijmipndnicefcdbhgcjoognndbgkep*", "*lklekjodgannjcccdlbicoamibgbdnmi*", "*dbdbnchagbkhknegmhgikkleoogjcfge*", "*egblhcjfjmbjajhjhpmnlekffgaemgfh*", "*ehbhfpfdkmhcpaehaooegfdflljcnfec*", "*bkkgdjpomdnfemhhkalfkogckjdkcjkg*", "*almalgbpmcfpdaopimbdchdliminoign*", "*akkbkhnikoeojlhiiomohpdnkhbkhieh*", "*gbfgfbopcfokdpkdigfmoeaajfmpkbnh*", "*bniikohfmajhdcffljgfeiklcbgffppl*", "*lejgfmmlngaigdmmikblappdafcmkndb*", "*ffhhkmlgedgcliajaedapkdfigdobcif*", "*gcknhkkoolaabfmlnjonogaaifnjlfnp*", "*pooljnboifbodgifngpppfklhifechoe*", "*fjoaledfpmneenckfbpdfhkmimnjocfa*", "*aakchaleigkohafkfjfjbblobjifikek*", "*dpplabbmogkhghncfbfdeeokoefdjegm*", "*padekgcemlokbadohgkifijomclgjgif*", "*bfidboloedlamgdmenmlbipfnccokknp*"))))