index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("9e88c287eb376f3c319a5cb13f980d36","501af977080d56a55ff0aeba66b58e7f3d1404ea","74b6d14e35ff51fe47e169e76b4732b9f157cd7e537a2ca587c58dbdb15c624f","7b68bc3dd393c2e5273f180e361f178a","07610f11d3b8ccb7b60cc8ad033dda6c7d3940c4","d4f4069b1c40a5b27ba0bc15c09dceb7035d054a022bb5d558850edfba0b9534","0c0195c48b6b8582fa6f6373032118da","d25340ae8e92a6d29f599fef426a2bc1b5217299","11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5","bfd36fd6a20ccd39f5c3bb64a5c5dd8b","e938646862477e598fcda20d0b7551863f8b651c","35b95496b243541d5ad3667f4aabe2ed00066ba8b69b82f10dd1186872ce4be2","08bdf000031bbad1a836381f73adace5","3dff4ae3c421c9143978f8fc9499dca4aed0eac5","f955eeb3a464685eaac96744964134e49e849a03fc910454faaff2109c378b0b","42a80cc2333b612b63a859f17474c9af","e7be97fb2200eb99805e39513304739a7a28b17e","3b463c94b52414cfaad61ecdac64ca84eaea1ab4be69f75834aaa7701ab5e7d0")
index=activity AND rg_functionality="Endpoint Management Systems" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Endpoint Management Systems" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Endpoint Management Systems" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Web Proxy" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Web Proxy" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Next Generation Firewall" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Next Generation Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Flow" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Flow" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Web Server" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Web Server" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Source Code Repository" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Source Code Repository" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Authentication / VPN" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Authentication / VPN" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Authentication / VPN" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Content Management System" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Content Management System" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Content Management System" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Services / Applications" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Services / Applications" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Services / Applications" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND requesturl IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Message NOT NULL AND Message IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Requestcontext NOT NULL AND Requestcontext IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("http://0x53611451/win/clocal","http://qlqd5zqefmkcr34a.onion.sh/win/checking.hta","https://asq.d6shiiwz.pw/win/hssl/d6.hta","http://83.97.20.81/win/checking.hta","http://83.97.20.81/win/update.hta","https://asd.s7610rir.pw/win/checking.hta","https://asq.r77vh0.pw/win/hssl/r7.hta","http://asq.r77vh0.pw/win/checking.hta","http://5.188.86.237/vmware.exe")
