index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("a61b2eafcf39715031357df6b01e85e0d1ea2e8ee1dfec241b114e18f7a1163f","0896e7c5433b2d426a30a43e7f4ef351fa870be8bd336952a0655392f8f8052d","b5731baa7920b4649add429fc4a025142ce6a1e1adacb45850470ca4562d5e37","e7cfeb023c3160a7366f209a16a6f6ea5a0bc9a3ddc16c6cba758114dfe6b539","3d0dae359325e8e96cf46459c38d086279865457379bd6380523727db350de43","48142dc7fe28a5d8a849fff11cb8206912e8382314a2f05e72abad0978b27e90","bfe3ebcc92a4a7d294b63ce0d7eba6313980d982709a27b337abe32651b63856","c94e2bfd4e2241fed42113049c84ac333fcff340cc202afe8926f8e885d5fca3","f08cc922c5dab73f6a2534f8ceec8525604814ae7541688b7f65ac9924ace855","cdc39ce48f8f587c536450a3bd0feb58bf40b59b310569797c1c9ae8d28b2914","fd4fd44ff26e84ce6587413271cf7ff3960471a55eb0d51b0a9870b577d66f4a","4fc768476ee92230db5dbc4d8cbca49a71f8433542e62e093c3ad160f699c98d","0adb2734a1ca0ccaf27d8a46c08b2fd1e19cb1fbd3fea6d8307851c691011f0f","7a1494839927c20a4b27be19041f2a2c2845600691aa9a2032518b81463f83be","20f58bd5381509072e46ad79e859fb198335dcd49c2cb738bd76f1d37d24c0a7","ee46f8c9769858aad6fa02466c867d7341ebe8a59c21e06e9e034048013bf65a","c187aa84f92e4cb5b2d9714b35f5b892fa14fec52f2963f72b83c0b2d259449d")
index=activity AND rg_functionality="Endpoint Management Systems" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Endpoint Management Systems" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Endpoint Management Systems" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Web Proxy" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Web Proxy" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Next Generation Firewall" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Next Generation Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Flow" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Flow" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Web Server" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Web Server" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Source Code Repository" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Source Code Repository" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Authentication / VPN" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Authentication / VPN" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Authentication / VPN" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Content Management System" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Content Management System" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Content Management System" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Services / Applications" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Services / Applications" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Services / Applications" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND requesturl IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Message NOT NULL AND Message IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Requestcontext NOT NULL AND Requestcontext IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("\\\\104.234.239.26\\share1\\mshtml_c7\\file001.url","\\\\104.234.239.26\\share1\\mshtml_c7\\ex001.url","file://104.234.239.26/share1/mshtml_c7/1/","file://104.234.239.26/share1/mshtml_c7/ex001.zip/file001.vbs","http://74.50.94.156/mshtml_c7/start.xml","http://74.50.94.156/mshtml_c7/zip_k.asp?d=","http://74.50.94.156/mshtml_c7/zip_k2.asp?d=","http://74.50.94.156/mshtml_c7/zip_k3.asp?d=","https://www.ukrainianworldcongress.info/sites/default/files/document/forms/2023/overview_of_uwcs_ukraineinnato_campaign.docx")
