config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (actor_process_image_path contains "\gup.exe" and 
 (not 
 ((action_file_name in ("C:\Program Files\Notepad++\*", "C:\Program Files (x86)\Notepad++\*")) or 
 (action_file_name contains "C:\Users\" and 
 (action_file_name contains "\AppData\Local\Temp\" and 
 action_file_name contains "npp." and 
 action_file_name contains ".Installer." and 
 action_file_name contains ".exe")) or 
 (action_file_name contains "C:\Users\" and 
 (action_file_name contains "\AppData\Local\Temp\" and 
 action_file_name contains ".zip")) or 
 action_file_name contains "C:\$Recycle.Bin\S-1-5-21" or 
 ((action_file_name in ("*\plugins\JsonTools\testfiles\*", "*\Notepad++\plugins\ComparePlugin\*")) or 
 (action_file_name contains "npp." and 
 action_file_name contains ".portable." and 
 action_file_name contains "\plugins\"))))))