index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("6d403c3fc246d6d493a6f4acc18c1c292f710db6ad9c3ea2ff065595c5ad3c5b","7e29615126585b9f87ded09cfae4724bb5d7896c7daf2adfcef775924549e49b","801b23bffa65facee1da69bc6f72f8e1e4e1aeefc63dfd3a99b238d4f9d0a637","85143ecc41fb6aadd822ed2d6f20c721a83ae1088f406f29b8b0b05459053a03","940a674cfe8179b2b8964bf408037e0e5a5ab7e47354fe4fa7a9289732e1f1b8","c399b56e1baf063ca2c8aadbbe4a2b58141916aac8ef790a9c29762ed1956bd5","fdc94d0dedf6e53dd435d2b5eacb4c34923fadee50529db6f3de38c71f325e05","48628ca95608a015f47506eb1dc6fad0cd04a4cf5d44fdb8f10255fe0aa3c29b","099ac2f3e10346dbef472b2a7b443ebfe1f6011a9a2518a54c20aad07fe9ec61","0b4b25fab4c922e752e689111f38957e0402fd83f6b1d69e8f43c6f4b68fc1ba")
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Endpoint Management Systems" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Endpoint Management Systems" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Endpoint Management Systems" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Cloud Email / Email Security" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Next Generation Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Next Generation Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Next Generation Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Web Proxy" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Web Proxy" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Web Proxy" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Web Proxy" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Flow" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Flow" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Flow" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Flow" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Web Server" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Web Server" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Web Server" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Web Server" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Web Application Firewall" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Web Application Firewall" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Web Application Firewall" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Web Application Firewall" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Cloud Services / Applications" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Cloud Services / Applications" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Cloud Services / Applications" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Cloud Application Audit" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Cloud Application Audit" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Cloud Application Audit" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Authentication / VPN" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Authentication / VPN" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Authentication / VPN" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Authentication / VPN" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Unix / Linux / AIX" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Authentication / WiFi" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Authentication / WiFi" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Authentication / WiFi" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationaddress NOT NULL AND destinationport NOT NULL AND (destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="5.39.217.212" AND destinationport=80 OR destinationaddress="64.32.6.143" AND destinationport=80 OR destinationaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourceaddress NOT NULL AND sourceport NOT NULL AND (sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="5.39.217.212" AND sourceport=80 OR sourceaddress="64.32.6.143" AND sourceport=80 OR sourceaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Cloud Application Security Broker" AND translatedipaddress NOT NULL AND sourceport NOT NULL AND (translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="5.39.217.212" AND sourceport=80 OR translatedipaddress="64.32.6.143" AND sourceport=80 OR translatedipaddress="45.149.77.39" AND sourceport=80)
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationtranslatedaddress NOT NULL AND destinationport NOT NULL AND (destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="5.39.217.212" AND destinationport=80 OR destinationtranslatedaddress="64.32.6.143" AND destinationport=80 OR destinationtranslatedaddress="45.149.77.39" AND destinationport=80)
index=activity AND rg_functionality="Endpoint Management Systems" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Cloud Services / Applications" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Authentication / VPN" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Authentication / WiFi" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("http://106.246.224.219/one","http://107.148.12.162:12345/log","http://107.148.13.247:7777/file","http://107.148.13.247/4file","http://107.148.13.247/error.txt","http://107.191.43.86/start","http://113.185.0.244/wls-wsat/root","http://135.148.91.146:1980/bins.sh","http://138.68.61.82:444","http://185.157.160.214/xms","http://192.3.1.223/favicon.ico","http://198.46.189.105:80/Ugliest.x86","http://20.205.61.88/payllll.sh","http://45.144.179.204:9999/log","http://51.81.133.91/FKKK/NW_BBB.x86","http://80.94.92.38/folder/enemybotarm64/","http://80.94.92.38/folder/enemybotx64/","http://80.94.92.38/folder/enemybotx86/","https://129.226.227.246/help.txt","https://20.232.97.189/up/388e6567d5.sh","https://20.232.97.189/up/4102909932.sh","https://20.232.97.189/up/d1bea27b13.sh","https://enlib2w9g8mze.x.pipedream.net","https://tmpfiles.org/dl/262822/a.txt","https://tmpfiles.org/dl/262853/vmware_log.jsp","https://tmpfiles.org/dl/265326/cmd.jsp","https://tmpfiles.org/dl/265351/shell.py","https://tmpfiles.org/dl/265385/xmrigdaemon","https://tmpfiles.org/dl/266116/vmware_log.jsp","http://193.56.28.202/.d/bot.redis","http://193.56.28.202/.d/bot.v","http://193.56.28.202/.d/botVNC")
