index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("b5b323679524d52e4c058b1a3dd8dee7","4efa8ca01d7c566ff1b72f4ebf57cf2c","10f888a9aa8082651adeff4790675fd5","30dd26075a5ca7a4861e9214a99d0495","60efc41c30fd9ab438e88c6011df5c38","961fa114e9eb92016977940f7c97cdd9","1457e18b453d8cefc34047e1b0fbf76f","284418b6a9c70cc30ef14df3a87c24da","5788631016d8bc495f4f2614f9a7bbe0","a9bc00e5e8a17df95bd5b8c289a12b31","a9bd813679517c846dcf36454baa6170","a99f3f8736d7d3001aa5eb6202123948","a802ce130be6546b76d4b54f72d14645","ae9e83d1031462cb5e58b4525036670c","b25f9490f6d80f9de5a9c02cc344f9f9","cffc70e4fb7363024fcc3590755fa846","e9154a7613a8f8baf67ec3b696c9cb12","f213f94729b294c01a0df21800c4e395","2e68f4438ce59c868af01b535c98060d","839471243f9c4a294c42fabf636f7cad","4b0d76262dd82985d330b02190a880c0","1a5d955be79046a3288b869e44e87404","f8342fd3e32dcf9832dff3e923ef530b","20b6ac10f657963245940c9bcd25a346","33c7c22e33e134ec3ddfc6be8ee1f1ee","2e4146c1a93c0bfe0f4e9ea53b8da7ee","827eca9ec457f3c5180f602832f44955","e3b6142df6a7c73a99736082fbae2fa6","4bdcbc7ec1929d9b1ebcc4d01d605b05","0da6e1036ca5d8231ee94a4db8c48728","098872e9e39bd4cd0e4debd4b397b555","0305f8a9dee464f56023411e7b0924df","be8b6452aa874904f116f9b7cdfe343b","6c0416f719ceca15f9e9c4f210c64fb0","25b90fa3b21875157c6f33b7e1b6e8d7","14b7429205955056f1763553f82fe244")
index=activity AND rg_functionality="Endpoint Management Systems" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Endpoint Management Systems" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Endpoint Management Systems" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Web Proxy" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Web Proxy" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Next Generation Firewall" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Next Generation Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Flow" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Flow" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Web Server" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Web Server" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Source Code Repository" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Source Code Repository" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Authentication / VPN" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Authentication / VPN" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Authentication / VPN" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Content Management System" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Content Management System" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Content Management System" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Services / Applications" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Services / Applications" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Services / Applications" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND requesturl IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Message NOT NULL AND Message IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Requestcontext NOT NULL AND Requestcontext IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("http://excel-ms.github.io/windows/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.ziputorrent-client.github.io","http://excel-ms.github.io/windows/ms-excel.zipgta-5rp.github.io/windows/gtarp.zip","http://excel-ms.github.io/windows/ms-excel.zipmssg.me/eahcu","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/excel_ms","http://excel-ms.github.io/windows/ms-excel.ziplinktr.ee/utorrent_client","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/art/utorrent.zip","http://excel-ms.github.io/windows/ms-excel.zipnyaera.ru/wp-includes/uploads/my/ms-excel.zip","http://excel-ms.github.io/windows/ms-excel.zipgithub.com/lidiyakamalova89/www/raw/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/lidiyakamalova89/www/main/ver.1.4.1.zip","http://excel-ms.github.io/windows/ms-excel.zipraw.githubusercontent.com/radominator7204/dsz/main/install.zip","http://excel-ms.github.io/windows/ms-excel.zipsportjump.ru","http://excel-ms.github.io/windows/ms-excel.zipgamesjumpers.com","http://excel-ms.github.io/windows/ms-excel.zipgamejump.site","http://excel-ms.github.io/windows/ms-excel.zipalljump.ru","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/f87y7zjv","http://excel-ms.github.io/windows/ms-excel.zippastebin.com/raw/uu34qunt","http://excel-ms.github.io/windows/ms-excel.ziprentry.co/mi9fomgo/raw")
