index=activity AND rg_functionality="Next Generation Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationhostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationhostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationhostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationhostname CONTAINS "miiwes.top/dl/buildz.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build2.exe" OR destinationhostname CONTAINS "rgyui.top/dl/buildz.exe" OR destinationhostname CONTAINS "uaery.top/dl/build.exe" OR destinationhostname CONTAINS "uaery.top/dl/build2.exe" OR destinationhostname CONTAINS "uaery.top/dl/buildz.exe" OR destinationhostname CONTAINS "zerit.top/dl/build.exe" OR destinationhostname CONTAINS "zerit.top/dl/build2.exe" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe" OR destinationhostname CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationhostname CONTAINS "spaceris.com/files/1/build3.exe" OR destinationhostname CONTAINS "bihsy.com/files/1/build3.exe" OR destinationhostname CONTAINS "ugll.org/files/1/build3.exe" OR destinationhostname CONTAINS "oddsium.com/g76dbf" OR destinationhostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcentdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcentdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcentdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcentdomain CONTAINS "miiwes.top/dl/buildz.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build2.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/buildz.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build2.exe" OR sourcentdomain CONTAINS "uaery.top/dl/buildz.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build2.exe" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe" OR sourcentdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcentdomain CONTAINS "spaceris.com/files/1/build3.exe" OR sourcentdomain CONTAINS "bihsy.com/files/1/build3.exe" OR sourcentdomain CONTAINS "ugll.org/files/1/build3.exe" OR sourcentdomain CONTAINS "oddsium.com/g76dbf" OR sourcentdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Next Generation Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcehostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcehostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcehostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcehostname CONTAINS "miiwes.top/dl/buildz.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build2.exe" OR sourcehostname CONTAINS "rgyui.top/dl/buildz.exe" OR sourcehostname CONTAINS "uaery.top/dl/build.exe" OR sourcehostname CONTAINS "uaery.top/dl/build2.exe" OR sourcehostname CONTAINS "uaery.top/dl/buildz.exe" OR sourcehostname CONTAINS "zerit.top/dl/build.exe" OR sourcehostname CONTAINS "zerit.top/dl/build2.exe" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe" OR sourcehostname CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcehostname CONTAINS "spaceris.com/files/1/build3.exe" OR sourcehostname CONTAINS "bihsy.com/files/1/build3.exe" OR sourcehostname CONTAINS "ugll.org/files/1/build3.exe" OR sourcehostname CONTAINS "oddsium.com/g76dbf" OR sourcehostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Next Generation Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationntdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationntdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationntdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationntdomain CONTAINS "miiwes.top/dl/buildz.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build2.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/buildz.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build2.exe" OR destinationntdomain CONTAINS "uaery.top/dl/buildz.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build2.exe" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe" OR destinationntdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationntdomain CONTAINS "spaceris.com/files/1/build3.exe" OR destinationntdomain CONTAINS "bihsy.com/files/1/build3.exe" OR destinationntdomain CONTAINS "ugll.org/files/1/build3.exe" OR destinationntdomain CONTAINS "oddsium.com/g76dbf" OR destinationntdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR requesturl CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR requesturl CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR requesturl CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR requesturl CONTAINS "miiwes.top/dl/buildz.exe" OR requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "rgyui.top/dl/build2.exe" OR requesturl CONTAINS "rgyui.top/dl/buildz.exe" OR requesturl CONTAINS "uaery.top/dl/build.exe" OR requesturl CONTAINS "uaery.top/dl/build2.exe" OR requesturl CONTAINS "uaery.top/dl/buildz.exe" OR requesturl CONTAINS "zerit.top/dl/build.exe" OR requesturl CONTAINS "zerit.top/dl/build2.exe" OR requesturl CONTAINS "zerit.top/dl/buildz.exe" OR requesturl CONTAINS "ex3mall.com/files/1/build3.exe" OR requesturl CONTAINS "spaceris.com/files/1/build3.exe" OR requesturl CONTAINS "bihsy.com/files/1/build3.exe" OR requesturl CONTAINS "ugll.org/files/1/build3.exe" OR requesturl CONTAINS "oddsium.com/g76dbf" OR requesturl CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR requesturl CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationhostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationhostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationhostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationhostname CONTAINS "miiwes.top/dl/buildz.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build2.exe" OR destinationhostname CONTAINS "rgyui.top/dl/buildz.exe" OR destinationhostname CONTAINS "uaery.top/dl/build.exe" OR destinationhostname CONTAINS "uaery.top/dl/build2.exe" OR destinationhostname CONTAINS "uaery.top/dl/buildz.exe" OR destinationhostname CONTAINS "zerit.top/dl/build.exe" OR destinationhostname CONTAINS "zerit.top/dl/build2.exe" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe" OR destinationhostname CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationhostname CONTAINS "spaceris.com/files/1/build3.exe" OR destinationhostname CONTAINS "bihsy.com/files/1/build3.exe" OR destinationhostname CONTAINS "ugll.org/files/1/build3.exe" OR destinationhostname CONTAINS "oddsium.com/g76dbf" OR destinationhostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcentdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcentdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcentdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcentdomain CONTAINS "miiwes.top/dl/buildz.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build2.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/buildz.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build2.exe" OR sourcentdomain CONTAINS "uaery.top/dl/buildz.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build2.exe" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe" OR sourcentdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcentdomain CONTAINS "spaceris.com/files/1/build3.exe" OR sourcentdomain CONTAINS "bihsy.com/files/1/build3.exe" OR sourcentdomain CONTAINS "ugll.org/files/1/build3.exe" OR sourcentdomain CONTAINS "oddsium.com/g76dbf" OR sourcentdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcehostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcehostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcehostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcehostname CONTAINS "miiwes.top/dl/buildz.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build2.exe" OR sourcehostname CONTAINS "rgyui.top/dl/buildz.exe" OR sourcehostname CONTAINS "uaery.top/dl/build.exe" OR sourcehostname CONTAINS "uaery.top/dl/build2.exe" OR sourcehostname CONTAINS "uaery.top/dl/buildz.exe" OR sourcehostname CONTAINS "zerit.top/dl/build.exe" OR sourcehostname CONTAINS "zerit.top/dl/build2.exe" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe" OR sourcehostname CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcehostname CONTAINS "spaceris.com/files/1/build3.exe" OR sourcehostname CONTAINS "bihsy.com/files/1/build3.exe" OR sourcehostname CONTAINS "ugll.org/files/1/build3.exe" OR sourcehostname CONTAINS "oddsium.com/g76dbf" OR sourcehostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationntdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationntdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationntdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationntdomain CONTAINS "miiwes.top/dl/buildz.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build2.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/buildz.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build2.exe" OR destinationntdomain CONTAINS "uaery.top/dl/buildz.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build2.exe" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe" OR destinationntdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationntdomain CONTAINS "spaceris.com/files/1/build3.exe" OR destinationntdomain CONTAINS "bihsy.com/files/1/build3.exe" OR destinationntdomain CONTAINS "ugll.org/files/1/build3.exe" OR destinationntdomain CONTAINS "oddsium.com/g76dbf" OR destinationntdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR requesturl CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR requesturl CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR requesturl CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR requesturl CONTAINS "miiwes.top/dl/buildz.exe" OR requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "rgyui.top/dl/build2.exe" OR requesturl CONTAINS "rgyui.top/dl/buildz.exe" OR requesturl CONTAINS "uaery.top/dl/build.exe" OR requesturl CONTAINS "uaery.top/dl/build2.exe" OR requesturl CONTAINS "uaery.top/dl/buildz.exe" OR requesturl CONTAINS "zerit.top/dl/build.exe" OR requesturl CONTAINS "zerit.top/dl/build2.exe" OR requesturl CONTAINS "zerit.top/dl/buildz.exe" OR requesturl CONTAINS "ex3mall.com/files/1/build3.exe" OR requesturl CONTAINS "spaceris.com/files/1/build3.exe" OR requesturl CONTAINS "bihsy.com/files/1/build3.exe" OR requesturl CONTAINS "ugll.org/files/1/build3.exe" OR requesturl CONTAINS "oddsium.com/g76dbf" OR requesturl CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR requesturl CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Web Proxy" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationhostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationhostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationhostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationhostname CONTAINS "miiwes.top/dl/buildz.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build2.exe" OR destinationhostname CONTAINS "rgyui.top/dl/buildz.exe" OR destinationhostname CONTAINS "uaery.top/dl/build.exe" OR destinationhostname CONTAINS "uaery.top/dl/build2.exe" OR destinationhostname CONTAINS "uaery.top/dl/buildz.exe" OR destinationhostname CONTAINS "zerit.top/dl/build.exe" OR destinationhostname CONTAINS "zerit.top/dl/build2.exe" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe" OR destinationhostname CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationhostname CONTAINS "spaceris.com/files/1/build3.exe" OR destinationhostname CONTAINS "bihsy.com/files/1/build3.exe" OR destinationhostname CONTAINS "ugll.org/files/1/build3.exe" OR destinationhostname CONTAINS "oddsium.com/g76dbf" OR destinationhostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Web Proxy" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcentdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcentdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcentdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcentdomain CONTAINS "miiwes.top/dl/buildz.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build2.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/buildz.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build2.exe" OR sourcentdomain CONTAINS "uaery.top/dl/buildz.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build2.exe" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe" OR sourcentdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcentdomain CONTAINS "spaceris.com/files/1/build3.exe" OR sourcentdomain CONTAINS "bihsy.com/files/1/build3.exe" OR sourcentdomain CONTAINS "ugll.org/files/1/build3.exe" OR sourcentdomain CONTAINS "oddsium.com/g76dbf" OR sourcentdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Web Proxy" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcehostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcehostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcehostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcehostname CONTAINS "miiwes.top/dl/buildz.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build2.exe" OR sourcehostname CONTAINS "rgyui.top/dl/buildz.exe" OR sourcehostname CONTAINS "uaery.top/dl/build.exe" OR sourcehostname CONTAINS "uaery.top/dl/build2.exe" OR sourcehostname CONTAINS "uaery.top/dl/buildz.exe" OR sourcehostname CONTAINS "zerit.top/dl/build.exe" OR sourcehostname CONTAINS "zerit.top/dl/build2.exe" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe" OR sourcehostname CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcehostname CONTAINS "spaceris.com/files/1/build3.exe" OR sourcehostname CONTAINS "bihsy.com/files/1/build3.exe" OR sourcehostname CONTAINS "ugll.org/files/1/build3.exe" OR sourcehostname CONTAINS "oddsium.com/g76dbf" OR sourcehostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Web Proxy" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationntdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationntdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationntdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationntdomain CONTAINS "miiwes.top/dl/buildz.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build2.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/buildz.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build2.exe" OR destinationntdomain CONTAINS "uaery.top/dl/buildz.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build2.exe" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe" OR destinationntdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationntdomain CONTAINS "spaceris.com/files/1/build3.exe" OR destinationntdomain CONTAINS "bihsy.com/files/1/build3.exe" OR destinationntdomain CONTAINS "ugll.org/files/1/build3.exe" OR destinationntdomain CONTAINS "oddsium.com/g76dbf" OR destinationntdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND (requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR requesturl CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR requesturl CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR requesturl CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR requesturl CONTAINS "miiwes.top/dl/buildz.exe" OR requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "rgyui.top/dl/build2.exe" OR requesturl CONTAINS "rgyui.top/dl/buildz.exe" OR requesturl CONTAINS "uaery.top/dl/build.exe" OR requesturl CONTAINS "uaery.top/dl/build2.exe" OR requesturl CONTAINS "uaery.top/dl/buildz.exe" OR requesturl CONTAINS "zerit.top/dl/build.exe" OR requesturl CONTAINS "zerit.top/dl/build2.exe" OR requesturl CONTAINS "zerit.top/dl/buildz.exe" OR requesturl CONTAINS "ex3mall.com/files/1/build3.exe" OR requesturl CONTAINS "spaceris.com/files/1/build3.exe" OR requesturl CONTAINS "bihsy.com/files/1/build3.exe" OR requesturl CONTAINS "ugll.org/files/1/build3.exe" OR requesturl CONTAINS "oddsium.com/g76dbf" OR requesturl CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR requesturl CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Flow" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationhostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationhostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationhostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationhostname CONTAINS "miiwes.top/dl/buildz.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build2.exe" OR destinationhostname CONTAINS "rgyui.top/dl/buildz.exe" OR destinationhostname CONTAINS "uaery.top/dl/build.exe" OR destinationhostname CONTAINS "uaery.top/dl/build2.exe" OR destinationhostname CONTAINS "uaery.top/dl/buildz.exe" OR destinationhostname CONTAINS "zerit.top/dl/build.exe" OR destinationhostname CONTAINS "zerit.top/dl/build2.exe" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe" OR destinationhostname CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationhostname CONTAINS "spaceris.com/files/1/build3.exe" OR destinationhostname CONTAINS "bihsy.com/files/1/build3.exe" OR destinationhostname CONTAINS "ugll.org/files/1/build3.exe" OR destinationhostname CONTAINS "oddsium.com/g76dbf" OR destinationhostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Flow" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcentdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcentdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcentdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcentdomain CONTAINS "miiwes.top/dl/buildz.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build2.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/buildz.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build2.exe" OR sourcentdomain CONTAINS "uaery.top/dl/buildz.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build2.exe" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe" OR sourcentdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcentdomain CONTAINS "spaceris.com/files/1/build3.exe" OR sourcentdomain CONTAINS "bihsy.com/files/1/build3.exe" OR sourcentdomain CONTAINS "ugll.org/files/1/build3.exe" OR sourcentdomain CONTAINS "oddsium.com/g76dbf" OR sourcentdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Flow" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcehostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcehostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcehostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcehostname CONTAINS "miiwes.top/dl/buildz.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build2.exe" OR sourcehostname CONTAINS "rgyui.top/dl/buildz.exe" OR sourcehostname CONTAINS "uaery.top/dl/build.exe" OR sourcehostname CONTAINS "uaery.top/dl/build2.exe" OR sourcehostname CONTAINS "uaery.top/dl/buildz.exe" OR sourcehostname CONTAINS "zerit.top/dl/build.exe" OR sourcehostname CONTAINS "zerit.top/dl/build2.exe" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe" OR sourcehostname CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcehostname CONTAINS "spaceris.com/files/1/build3.exe" OR sourcehostname CONTAINS "bihsy.com/files/1/build3.exe" OR sourcehostname CONTAINS "ugll.org/files/1/build3.exe" OR sourcehostname CONTAINS "oddsium.com/g76dbf" OR sourcehostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Flow" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationntdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationntdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationntdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationntdomain CONTAINS "miiwes.top/dl/buildz.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build2.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/buildz.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build2.exe" OR destinationntdomain CONTAINS "uaery.top/dl/buildz.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build2.exe" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe" OR destinationntdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationntdomain CONTAINS "spaceris.com/files/1/build3.exe" OR destinationntdomain CONTAINS "bihsy.com/files/1/build3.exe" OR destinationntdomain CONTAINS "ugll.org/files/1/build3.exe" OR destinationntdomain CONTAINS "oddsium.com/g76dbf" OR destinationntdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND (requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR requesturl CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR requesturl CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR requesturl CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR requesturl CONTAINS "miiwes.top/dl/buildz.exe" OR requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "rgyui.top/dl/build2.exe" OR requesturl CONTAINS "rgyui.top/dl/buildz.exe" OR requesturl CONTAINS "uaery.top/dl/build.exe" OR requesturl CONTAINS "uaery.top/dl/build2.exe" OR requesturl CONTAINS "uaery.top/dl/buildz.exe" OR requesturl CONTAINS "zerit.top/dl/build.exe" OR requesturl CONTAINS "zerit.top/dl/build2.exe" OR requesturl CONTAINS "zerit.top/dl/buildz.exe" OR requesturl CONTAINS "ex3mall.com/files/1/build3.exe" OR requesturl CONTAINS "spaceris.com/files/1/build3.exe" OR requesturl CONTAINS "bihsy.com/files/1/build3.exe" OR requesturl CONTAINS "ugll.org/files/1/build3.exe" OR requesturl CONTAINS "oddsium.com/g76dbf" OR requesturl CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR requesturl CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Web Server" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationhostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationhostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationhostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationhostname CONTAINS "miiwes.top/dl/buildz.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build2.exe" OR destinationhostname CONTAINS "rgyui.top/dl/buildz.exe" OR destinationhostname CONTAINS "uaery.top/dl/build.exe" OR destinationhostname CONTAINS "uaery.top/dl/build2.exe" OR destinationhostname CONTAINS "uaery.top/dl/buildz.exe" OR destinationhostname CONTAINS "zerit.top/dl/build.exe" OR destinationhostname CONTAINS "zerit.top/dl/build2.exe" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe" OR destinationhostname CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationhostname CONTAINS "spaceris.com/files/1/build3.exe" OR destinationhostname CONTAINS "bihsy.com/files/1/build3.exe" OR destinationhostname CONTAINS "ugll.org/files/1/build3.exe" OR destinationhostname CONTAINS "oddsium.com/g76dbf" OR destinationhostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Web Server" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcentdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcentdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcentdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcentdomain CONTAINS "miiwes.top/dl/buildz.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build2.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/buildz.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build2.exe" OR sourcentdomain CONTAINS "uaery.top/dl/buildz.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build2.exe" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe" OR sourcentdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcentdomain CONTAINS "spaceris.com/files/1/build3.exe" OR sourcentdomain CONTAINS "bihsy.com/files/1/build3.exe" OR sourcentdomain CONTAINS "ugll.org/files/1/build3.exe" OR sourcentdomain CONTAINS "oddsium.com/g76dbf" OR sourcentdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Web Server" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcehostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcehostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcehostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcehostname CONTAINS "miiwes.top/dl/buildz.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build2.exe" OR sourcehostname CONTAINS "rgyui.top/dl/buildz.exe" OR sourcehostname CONTAINS "uaery.top/dl/build.exe" OR sourcehostname CONTAINS "uaery.top/dl/build2.exe" OR sourcehostname CONTAINS "uaery.top/dl/buildz.exe" OR sourcehostname CONTAINS "zerit.top/dl/build.exe" OR sourcehostname CONTAINS "zerit.top/dl/build2.exe" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe" OR sourcehostname CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcehostname CONTAINS "spaceris.com/files/1/build3.exe" OR sourcehostname CONTAINS "bihsy.com/files/1/build3.exe" OR sourcehostname CONTAINS "ugll.org/files/1/build3.exe" OR sourcehostname CONTAINS "oddsium.com/g76dbf" OR sourcehostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Web Server" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationntdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationntdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationntdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationntdomain CONTAINS "miiwes.top/dl/buildz.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build2.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/buildz.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build2.exe" OR destinationntdomain CONTAINS "uaery.top/dl/buildz.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build2.exe" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe" OR destinationntdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationntdomain CONTAINS "spaceris.com/files/1/build3.exe" OR destinationntdomain CONTAINS "bihsy.com/files/1/build3.exe" OR destinationntdomain CONTAINS "ugll.org/files/1/build3.exe" OR destinationntdomain CONTAINS "oddsium.com/g76dbf" OR destinationntdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND (requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR requesturl CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR requesturl CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR requesturl CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR requesturl CONTAINS "miiwes.top/dl/buildz.exe" OR requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "rgyui.top/dl/build2.exe" OR requesturl CONTAINS "rgyui.top/dl/buildz.exe" OR requesturl CONTAINS "uaery.top/dl/build.exe" OR requesturl CONTAINS "uaery.top/dl/build2.exe" OR requesturl CONTAINS "uaery.top/dl/buildz.exe" OR requesturl CONTAINS "zerit.top/dl/build.exe" OR requesturl CONTAINS "zerit.top/dl/build2.exe" OR requesturl CONTAINS "zerit.top/dl/buildz.exe" OR requesturl CONTAINS "ex3mall.com/files/1/build3.exe" OR requesturl CONTAINS "spaceris.com/files/1/build3.exe" OR requesturl CONTAINS "bihsy.com/files/1/build3.exe" OR requesturl CONTAINS "ugll.org/files/1/build3.exe" OR requesturl CONTAINS "oddsium.com/g76dbf" OR requesturl CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR requesturl CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationhostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationhostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationhostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationhostname CONTAINS "miiwes.top/dl/buildz.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build2.exe" OR destinationhostname CONTAINS "rgyui.top/dl/buildz.exe" OR destinationhostname CONTAINS "uaery.top/dl/build.exe" OR destinationhostname CONTAINS "uaery.top/dl/build2.exe" OR destinationhostname CONTAINS "uaery.top/dl/buildz.exe" OR destinationhostname CONTAINS "zerit.top/dl/build.exe" OR destinationhostname CONTAINS "zerit.top/dl/build2.exe" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe" OR destinationhostname CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationhostname CONTAINS "spaceris.com/files/1/build3.exe" OR destinationhostname CONTAINS "bihsy.com/files/1/build3.exe" OR destinationhostname CONTAINS "ugll.org/files/1/build3.exe" OR destinationhostname CONTAINS "oddsium.com/g76dbf" OR destinationhostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcentdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcentdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcentdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcentdomain CONTAINS "miiwes.top/dl/buildz.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build2.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/buildz.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build2.exe" OR sourcentdomain CONTAINS "uaery.top/dl/buildz.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build2.exe" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe" OR sourcentdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcentdomain CONTAINS "spaceris.com/files/1/build3.exe" OR sourcentdomain CONTAINS "bihsy.com/files/1/build3.exe" OR sourcentdomain CONTAINS "ugll.org/files/1/build3.exe" OR sourcentdomain CONTAINS "oddsium.com/g76dbf" OR sourcentdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcehostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcehostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcehostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcehostname CONTAINS "miiwes.top/dl/buildz.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build2.exe" OR sourcehostname CONTAINS "rgyui.top/dl/buildz.exe" OR sourcehostname CONTAINS "uaery.top/dl/build.exe" OR sourcehostname CONTAINS "uaery.top/dl/build2.exe" OR sourcehostname CONTAINS "uaery.top/dl/buildz.exe" OR sourcehostname CONTAINS "zerit.top/dl/build.exe" OR sourcehostname CONTAINS "zerit.top/dl/build2.exe" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe" OR sourcehostname CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcehostname CONTAINS "spaceris.com/files/1/build3.exe" OR sourcehostname CONTAINS "bihsy.com/files/1/build3.exe" OR sourcehostname CONTAINS "ugll.org/files/1/build3.exe" OR sourcehostname CONTAINS "oddsium.com/g76dbf" OR sourcehostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationntdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationntdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationntdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationntdomain CONTAINS "miiwes.top/dl/buildz.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build2.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/buildz.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build2.exe" OR destinationntdomain CONTAINS "uaery.top/dl/buildz.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build2.exe" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe" OR destinationntdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationntdomain CONTAINS "spaceris.com/files/1/build3.exe" OR destinationntdomain CONTAINS "bihsy.com/files/1/build3.exe" OR destinationntdomain CONTAINS "ugll.org/files/1/build3.exe" OR destinationntdomain CONTAINS "oddsium.com/g76dbf" OR destinationntdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR requesturl CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR requesturl CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR requesturl CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR requesturl CONTAINS "miiwes.top/dl/buildz.exe" OR requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "rgyui.top/dl/build2.exe" OR requesturl CONTAINS "rgyui.top/dl/buildz.exe" OR requesturl CONTAINS "uaery.top/dl/build.exe" OR requesturl CONTAINS "uaery.top/dl/build2.exe" OR requesturl CONTAINS "uaery.top/dl/buildz.exe" OR requesturl CONTAINS "zerit.top/dl/build.exe" OR requesturl CONTAINS "zerit.top/dl/build2.exe" OR requesturl CONTAINS "zerit.top/dl/buildz.exe" OR requesturl CONTAINS "ex3mall.com/files/1/build3.exe" OR requesturl CONTAINS "spaceris.com/files/1/build3.exe" OR requesturl CONTAINS "bihsy.com/files/1/build3.exe" OR requesturl CONTAINS "ugll.org/files/1/build3.exe" OR requesturl CONTAINS "oddsium.com/g76dbf" OR requesturl CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR requesturl CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationhostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationhostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationhostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationhostname CONTAINS "miiwes.top/dl/buildz.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build2.exe" OR destinationhostname CONTAINS "rgyui.top/dl/buildz.exe" OR destinationhostname CONTAINS "uaery.top/dl/build.exe" OR destinationhostname CONTAINS "uaery.top/dl/build2.exe" OR destinationhostname CONTAINS "uaery.top/dl/buildz.exe" OR destinationhostname CONTAINS "zerit.top/dl/build.exe" OR destinationhostname CONTAINS "zerit.top/dl/build2.exe" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe" OR destinationhostname CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationhostname CONTAINS "spaceris.com/files/1/build3.exe" OR destinationhostname CONTAINS "bihsy.com/files/1/build3.exe" OR destinationhostname CONTAINS "ugll.org/files/1/build3.exe" OR destinationhostname CONTAINS "oddsium.com/g76dbf" OR destinationhostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcentdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcentdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcentdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcentdomain CONTAINS "miiwes.top/dl/buildz.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build2.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/buildz.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build2.exe" OR sourcentdomain CONTAINS "uaery.top/dl/buildz.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build2.exe" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe" OR sourcentdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcentdomain CONTAINS "spaceris.com/files/1/build3.exe" OR sourcentdomain CONTAINS "bihsy.com/files/1/build3.exe" OR sourcentdomain CONTAINS "ugll.org/files/1/build3.exe" OR sourcentdomain CONTAINS "oddsium.com/g76dbf" OR sourcentdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcehostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcehostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcehostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcehostname CONTAINS "miiwes.top/dl/buildz.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build2.exe" OR sourcehostname CONTAINS "rgyui.top/dl/buildz.exe" OR sourcehostname CONTAINS "uaery.top/dl/build.exe" OR sourcehostname CONTAINS "uaery.top/dl/build2.exe" OR sourcehostname CONTAINS "uaery.top/dl/buildz.exe" OR sourcehostname CONTAINS "zerit.top/dl/build.exe" OR sourcehostname CONTAINS "zerit.top/dl/build2.exe" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe" OR sourcehostname CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcehostname CONTAINS "spaceris.com/files/1/build3.exe" OR sourcehostname CONTAINS "bihsy.com/files/1/build3.exe" OR sourcehostname CONTAINS "ugll.org/files/1/build3.exe" OR sourcehostname CONTAINS "oddsium.com/g76dbf" OR sourcehostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationntdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationntdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationntdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationntdomain CONTAINS "miiwes.top/dl/buildz.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build2.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/buildz.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build2.exe" OR destinationntdomain CONTAINS "uaery.top/dl/buildz.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build2.exe" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe" OR destinationntdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationntdomain CONTAINS "spaceris.com/files/1/build3.exe" OR destinationntdomain CONTAINS "bihsy.com/files/1/build3.exe" OR destinationntdomain CONTAINS "ugll.org/files/1/build3.exe" OR destinationntdomain CONTAINS "oddsium.com/g76dbf" OR destinationntdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND (requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR requesturl CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR requesturl CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR requesturl CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR requesturl CONTAINS "miiwes.top/dl/buildz.exe" OR requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "rgyui.top/dl/build2.exe" OR requesturl CONTAINS "rgyui.top/dl/buildz.exe" OR requesturl CONTAINS "uaery.top/dl/build.exe" OR requesturl CONTAINS "uaery.top/dl/build2.exe" OR requesturl CONTAINS "uaery.top/dl/buildz.exe" OR requesturl CONTAINS "zerit.top/dl/build.exe" OR requesturl CONTAINS "zerit.top/dl/build2.exe" OR requesturl CONTAINS "zerit.top/dl/buildz.exe" OR requesturl CONTAINS "ex3mall.com/files/1/build3.exe" OR requesturl CONTAINS "spaceris.com/files/1/build3.exe" OR requesturl CONTAINS "bihsy.com/files/1/build3.exe" OR requesturl CONTAINS "ugll.org/files/1/build3.exe" OR requesturl CONTAINS "oddsium.com/g76dbf" OR requesturl CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR requesturl CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Web Application Firewall" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationhostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationhostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationhostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationhostname CONTAINS "miiwes.top/dl/buildz.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build2.exe" OR destinationhostname CONTAINS "rgyui.top/dl/buildz.exe" OR destinationhostname CONTAINS "uaery.top/dl/build.exe" OR destinationhostname CONTAINS "uaery.top/dl/build2.exe" OR destinationhostname CONTAINS "uaery.top/dl/buildz.exe" OR destinationhostname CONTAINS "zerit.top/dl/build.exe" OR destinationhostname CONTAINS "zerit.top/dl/build2.exe" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe" OR destinationhostname CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationhostname CONTAINS "spaceris.com/files/1/build3.exe" OR destinationhostname CONTAINS "bihsy.com/files/1/build3.exe" OR destinationhostname CONTAINS "ugll.org/files/1/build3.exe" OR destinationhostname CONTAINS "oddsium.com/g76dbf" OR destinationhostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Web Application Firewall" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcentdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcentdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcentdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcentdomain CONTAINS "miiwes.top/dl/buildz.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build2.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/buildz.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build2.exe" OR sourcentdomain CONTAINS "uaery.top/dl/buildz.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build2.exe" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe" OR sourcentdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcentdomain CONTAINS "spaceris.com/files/1/build3.exe" OR sourcentdomain CONTAINS "bihsy.com/files/1/build3.exe" OR sourcentdomain CONTAINS "ugll.org/files/1/build3.exe" OR sourcentdomain CONTAINS "oddsium.com/g76dbf" OR sourcentdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Web Application Firewall" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcehostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcehostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcehostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcehostname CONTAINS "miiwes.top/dl/buildz.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build2.exe" OR sourcehostname CONTAINS "rgyui.top/dl/buildz.exe" OR sourcehostname CONTAINS "uaery.top/dl/build.exe" OR sourcehostname CONTAINS "uaery.top/dl/build2.exe" OR sourcehostname CONTAINS "uaery.top/dl/buildz.exe" OR sourcehostname CONTAINS "zerit.top/dl/build.exe" OR sourcehostname CONTAINS "zerit.top/dl/build2.exe" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe" OR sourcehostname CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcehostname CONTAINS "spaceris.com/files/1/build3.exe" OR sourcehostname CONTAINS "bihsy.com/files/1/build3.exe" OR sourcehostname CONTAINS "ugll.org/files/1/build3.exe" OR sourcehostname CONTAINS "oddsium.com/g76dbf" OR sourcehostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Web Application Firewall" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationntdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationntdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationntdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationntdomain CONTAINS "miiwes.top/dl/buildz.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build2.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/buildz.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build2.exe" OR destinationntdomain CONTAINS "uaery.top/dl/buildz.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build2.exe" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe" OR destinationntdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationntdomain CONTAINS "spaceris.com/files/1/build3.exe" OR destinationntdomain CONTAINS "bihsy.com/files/1/build3.exe" OR destinationntdomain CONTAINS "ugll.org/files/1/build3.exe" OR destinationntdomain CONTAINS "oddsium.com/g76dbf" OR destinationntdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND (requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR requesturl CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR requesturl CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR requesturl CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR requesturl CONTAINS "miiwes.top/dl/buildz.exe" OR requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "rgyui.top/dl/build2.exe" OR requesturl CONTAINS "rgyui.top/dl/buildz.exe" OR requesturl CONTAINS "uaery.top/dl/build.exe" OR requesturl CONTAINS "uaery.top/dl/build2.exe" OR requesturl CONTAINS "uaery.top/dl/buildz.exe" OR requesturl CONTAINS "zerit.top/dl/build.exe" OR requesturl CONTAINS "zerit.top/dl/build2.exe" OR requesturl CONTAINS "zerit.top/dl/buildz.exe" OR requesturl CONTAINS "ex3mall.com/files/1/build3.exe" OR requesturl CONTAINS "spaceris.com/files/1/build3.exe" OR requesturl CONTAINS "bihsy.com/files/1/build3.exe" OR requesturl CONTAINS "ugll.org/files/1/build3.exe" OR requesturl CONTAINS "oddsium.com/g76dbf" OR requesturl CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR requesturl CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Endpoint management systems" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationhostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationhostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationhostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationhostname CONTAINS "miiwes.top/dl/buildz.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build2.exe" OR destinationhostname CONTAINS "rgyui.top/dl/buildz.exe" OR destinationhostname CONTAINS "uaery.top/dl/build.exe" OR destinationhostname CONTAINS "uaery.top/dl/build2.exe" OR destinationhostname CONTAINS "uaery.top/dl/buildz.exe" OR destinationhostname CONTAINS "zerit.top/dl/build.exe" OR destinationhostname CONTAINS "zerit.top/dl/build2.exe" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe" OR destinationhostname CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationhostname CONTAINS "spaceris.com/files/1/build3.exe" OR destinationhostname CONTAINS "bihsy.com/files/1/build3.exe" OR destinationhostname CONTAINS "ugll.org/files/1/build3.exe" OR destinationhostname CONTAINS "oddsium.com/g76dbf" OR destinationhostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Endpoint management systems" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcentdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcentdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcentdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcentdomain CONTAINS "miiwes.top/dl/buildz.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build2.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/buildz.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build2.exe" OR sourcentdomain CONTAINS "uaery.top/dl/buildz.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build2.exe" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe" OR sourcentdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcentdomain CONTAINS "spaceris.com/files/1/build3.exe" OR sourcentdomain CONTAINS "bihsy.com/files/1/build3.exe" OR sourcentdomain CONTAINS "ugll.org/files/1/build3.exe" OR sourcentdomain CONTAINS "oddsium.com/g76dbf" OR sourcentdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Endpoint management systems" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcehostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcehostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcehostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcehostname CONTAINS "miiwes.top/dl/buildz.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build2.exe" OR sourcehostname CONTAINS "rgyui.top/dl/buildz.exe" OR sourcehostname CONTAINS "uaery.top/dl/build.exe" OR sourcehostname CONTAINS "uaery.top/dl/build2.exe" OR sourcehostname CONTAINS "uaery.top/dl/buildz.exe" OR sourcehostname CONTAINS "zerit.top/dl/build.exe" OR sourcehostname CONTAINS "zerit.top/dl/build2.exe" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe" OR sourcehostname CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcehostname CONTAINS "spaceris.com/files/1/build3.exe" OR sourcehostname CONTAINS "bihsy.com/files/1/build3.exe" OR sourcehostname CONTAINS "ugll.org/files/1/build3.exe" OR sourcehostname CONTAINS "oddsium.com/g76dbf" OR sourcehostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Endpoint management systems" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationntdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationntdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationntdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationntdomain CONTAINS "miiwes.top/dl/buildz.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build2.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/buildz.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build2.exe" OR destinationntdomain CONTAINS "uaery.top/dl/buildz.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build2.exe" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe" OR destinationntdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationntdomain CONTAINS "spaceris.com/files/1/build3.exe" OR destinationntdomain CONTAINS "bihsy.com/files/1/build3.exe" OR destinationntdomain CONTAINS "ugll.org/files/1/build3.exe" OR destinationntdomain CONTAINS "oddsium.com/g76dbf" OR destinationntdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND (requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR requesturl CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR requesturl CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR requesturl CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR requesturl CONTAINS "miiwes.top/dl/buildz.exe" OR requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "rgyui.top/dl/build2.exe" OR requesturl CONTAINS "rgyui.top/dl/buildz.exe" OR requesturl CONTAINS "uaery.top/dl/build.exe" OR requesturl CONTAINS "uaery.top/dl/build2.exe" OR requesturl CONTAINS "uaery.top/dl/buildz.exe" OR requesturl CONTAINS "zerit.top/dl/build.exe" OR requesturl CONTAINS "zerit.top/dl/build2.exe" OR requesturl CONTAINS "zerit.top/dl/buildz.exe" OR requesturl CONTAINS "ex3mall.com/files/1/build3.exe" OR requesturl CONTAINS "spaceris.com/files/1/build3.exe" OR requesturl CONTAINS "bihsy.com/files/1/build3.exe" OR requesturl CONTAINS "ugll.org/files/1/build3.exe" OR requesturl CONTAINS "oddsium.com/g76dbf" OR requesturl CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR requesturl CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationhostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationhostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationhostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationhostname CONTAINS "miiwes.top/dl/buildz.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build2.exe" OR destinationhostname CONTAINS "rgyui.top/dl/buildz.exe" OR destinationhostname CONTAINS "uaery.top/dl/build.exe" OR destinationhostname CONTAINS "uaery.top/dl/build2.exe" OR destinationhostname CONTAINS "uaery.top/dl/buildz.exe" OR destinationhostname CONTAINS "zerit.top/dl/build.exe" OR destinationhostname CONTAINS "zerit.top/dl/build2.exe" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe" OR destinationhostname CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationhostname CONTAINS "spaceris.com/files/1/build3.exe" OR destinationhostname CONTAINS "bihsy.com/files/1/build3.exe" OR destinationhostname CONTAINS "ugll.org/files/1/build3.exe" OR destinationhostname CONTAINS "oddsium.com/g76dbf" OR destinationhostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcentdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcentdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcentdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcentdomain CONTAINS "miiwes.top/dl/buildz.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build2.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/buildz.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build2.exe" OR sourcentdomain CONTAINS "uaery.top/dl/buildz.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build2.exe" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe" OR sourcentdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcentdomain CONTAINS "spaceris.com/files/1/build3.exe" OR sourcentdomain CONTAINS "bihsy.com/files/1/build3.exe" OR sourcentdomain CONTAINS "ugll.org/files/1/build3.exe" OR sourcentdomain CONTAINS "oddsium.com/g76dbf" OR sourcentdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcehostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcehostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcehostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcehostname CONTAINS "miiwes.top/dl/buildz.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build2.exe" OR sourcehostname CONTAINS "rgyui.top/dl/buildz.exe" OR sourcehostname CONTAINS "uaery.top/dl/build.exe" OR sourcehostname CONTAINS "uaery.top/dl/build2.exe" OR sourcehostname CONTAINS "uaery.top/dl/buildz.exe" OR sourcehostname CONTAINS "zerit.top/dl/build.exe" OR sourcehostname CONTAINS "zerit.top/dl/build2.exe" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe" OR sourcehostname CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcehostname CONTAINS "spaceris.com/files/1/build3.exe" OR sourcehostname CONTAINS "bihsy.com/files/1/build3.exe" OR sourcehostname CONTAINS "ugll.org/files/1/build3.exe" OR sourcehostname CONTAINS "oddsium.com/g76dbf" OR sourcehostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationntdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationntdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationntdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationntdomain CONTAINS "miiwes.top/dl/buildz.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build2.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/buildz.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build2.exe" OR destinationntdomain CONTAINS "uaery.top/dl/buildz.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build2.exe" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe" OR destinationntdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationntdomain CONTAINS "spaceris.com/files/1/build3.exe" OR destinationntdomain CONTAINS "bihsy.com/files/1/build3.exe" OR destinationntdomain CONTAINS "ugll.org/files/1/build3.exe" OR destinationntdomain CONTAINS "oddsium.com/g76dbf" OR destinationntdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND (requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR requesturl CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR requesturl CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR requesturl CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR requesturl CONTAINS "miiwes.top/dl/buildz.exe" OR requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "rgyui.top/dl/build2.exe" OR requesturl CONTAINS "rgyui.top/dl/buildz.exe" OR requesturl CONTAINS "uaery.top/dl/build.exe" OR requesturl CONTAINS "uaery.top/dl/build2.exe" OR requesturl CONTAINS "uaery.top/dl/buildz.exe" OR requesturl CONTAINS "zerit.top/dl/build.exe" OR requesturl CONTAINS "zerit.top/dl/build2.exe" OR requesturl CONTAINS "zerit.top/dl/buildz.exe" OR requesturl CONTAINS "ex3mall.com/files/1/build3.exe" OR requesturl CONTAINS "spaceris.com/files/1/build3.exe" OR requesturl CONTAINS "bihsy.com/files/1/build3.exe" OR requesturl CONTAINS "ugll.org/files/1/build3.exe" OR requesturl CONTAINS "oddsium.com/g76dbf" OR requesturl CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR requesturl CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationhostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationhostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationhostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationhostname CONTAINS "miiwes.top/dl/buildz.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build2.exe" OR destinationhostname CONTAINS "rgyui.top/dl/buildz.exe" OR destinationhostname CONTAINS "uaery.top/dl/build.exe" OR destinationhostname CONTAINS "uaery.top/dl/build2.exe" OR destinationhostname CONTAINS "uaery.top/dl/buildz.exe" OR destinationhostname CONTAINS "zerit.top/dl/build.exe" OR destinationhostname CONTAINS "zerit.top/dl/build2.exe" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe" OR destinationhostname CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationhostname CONTAINS "spaceris.com/files/1/build3.exe" OR destinationhostname CONTAINS "bihsy.com/files/1/build3.exe" OR destinationhostname CONTAINS "ugll.org/files/1/build3.exe" OR destinationhostname CONTAINS "oddsium.com/g76dbf" OR destinationhostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcentdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcentdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcentdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcentdomain CONTAINS "miiwes.top/dl/buildz.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build2.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/buildz.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build2.exe" OR sourcentdomain CONTAINS "uaery.top/dl/buildz.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build2.exe" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe" OR sourcentdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcentdomain CONTAINS "spaceris.com/files/1/build3.exe" OR sourcentdomain CONTAINS "bihsy.com/files/1/build3.exe" OR sourcentdomain CONTAINS "ugll.org/files/1/build3.exe" OR sourcentdomain CONTAINS "oddsium.com/g76dbf" OR sourcentdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Application Audit" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcehostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcehostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcehostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcehostname CONTAINS "miiwes.top/dl/buildz.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build2.exe" OR sourcehostname CONTAINS "rgyui.top/dl/buildz.exe" OR sourcehostname CONTAINS "uaery.top/dl/build.exe" OR sourcehostname CONTAINS "uaery.top/dl/build2.exe" OR sourcehostname CONTAINS "uaery.top/dl/buildz.exe" OR sourcehostname CONTAINS "zerit.top/dl/build.exe" OR sourcehostname CONTAINS "zerit.top/dl/build2.exe" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe" OR sourcehostname CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcehostname CONTAINS "spaceris.com/files/1/build3.exe" OR sourcehostname CONTAINS "bihsy.com/files/1/build3.exe" OR sourcehostname CONTAINS "ugll.org/files/1/build3.exe" OR sourcehostname CONTAINS "oddsium.com/g76dbf" OR sourcehostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Application Audit" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationntdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationntdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationntdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationntdomain CONTAINS "miiwes.top/dl/buildz.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build2.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/buildz.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build2.exe" OR destinationntdomain CONTAINS "uaery.top/dl/buildz.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build2.exe" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe" OR destinationntdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationntdomain CONTAINS "spaceris.com/files/1/build3.exe" OR destinationntdomain CONTAINS "bihsy.com/files/1/build3.exe" OR destinationntdomain CONTAINS "ugll.org/files/1/build3.exe" OR destinationntdomain CONTAINS "oddsium.com/g76dbf" OR destinationntdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND (requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR requesturl CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR requesturl CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR requesturl CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR requesturl CONTAINS "miiwes.top/dl/buildz.exe" OR requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "rgyui.top/dl/build2.exe" OR requesturl CONTAINS "rgyui.top/dl/buildz.exe" OR requesturl CONTAINS "uaery.top/dl/build.exe" OR requesturl CONTAINS "uaery.top/dl/build2.exe" OR requesturl CONTAINS "uaery.top/dl/buildz.exe" OR requesturl CONTAINS "zerit.top/dl/build.exe" OR requesturl CONTAINS "zerit.top/dl/build2.exe" OR requesturl CONTAINS "zerit.top/dl/buildz.exe" OR requesturl CONTAINS "ex3mall.com/files/1/build3.exe" OR requesturl CONTAINS "spaceris.com/files/1/build3.exe" OR requesturl CONTAINS "bihsy.com/files/1/build3.exe" OR requesturl CONTAINS "ugll.org/files/1/build3.exe" OR requesturl CONTAINS "oddsium.com/g76dbf" OR requesturl CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR requesturl CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationhostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationhostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationhostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationhostname CONTAINS "miiwes.top/dl/buildz.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build2.exe" OR destinationhostname CONTAINS "rgyui.top/dl/buildz.exe" OR destinationhostname CONTAINS "uaery.top/dl/build.exe" OR destinationhostname CONTAINS "uaery.top/dl/build2.exe" OR destinationhostname CONTAINS "uaery.top/dl/buildz.exe" OR destinationhostname CONTAINS "zerit.top/dl/build.exe" OR destinationhostname CONTAINS "zerit.top/dl/build2.exe" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe" OR destinationhostname CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationhostname CONTAINS "spaceris.com/files/1/build3.exe" OR destinationhostname CONTAINS "bihsy.com/files/1/build3.exe" OR destinationhostname CONTAINS "ugll.org/files/1/build3.exe" OR destinationhostname CONTAINS "oddsium.com/g76dbf" OR destinationhostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcentdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcentdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcentdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcentdomain CONTAINS "miiwes.top/dl/buildz.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build2.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/buildz.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build2.exe" OR sourcentdomain CONTAINS "uaery.top/dl/buildz.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build2.exe" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe" OR sourcentdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcentdomain CONTAINS "spaceris.com/files/1/build3.exe" OR sourcentdomain CONTAINS "bihsy.com/files/1/build3.exe" OR sourcentdomain CONTAINS "ugll.org/files/1/build3.exe" OR sourcentdomain CONTAINS "oddsium.com/g76dbf" OR sourcentdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcehostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcehostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcehostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcehostname CONTAINS "miiwes.top/dl/buildz.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build2.exe" OR sourcehostname CONTAINS "rgyui.top/dl/buildz.exe" OR sourcehostname CONTAINS "uaery.top/dl/build.exe" OR sourcehostname CONTAINS "uaery.top/dl/build2.exe" OR sourcehostname CONTAINS "uaery.top/dl/buildz.exe" OR sourcehostname CONTAINS "zerit.top/dl/build.exe" OR sourcehostname CONTAINS "zerit.top/dl/build2.exe" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe" OR sourcehostname CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcehostname CONTAINS "spaceris.com/files/1/build3.exe" OR sourcehostname CONTAINS "bihsy.com/files/1/build3.exe" OR sourcehostname CONTAINS "ugll.org/files/1/build3.exe" OR sourcehostname CONTAINS "oddsium.com/g76dbf" OR sourcehostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationntdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationntdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationntdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationntdomain CONTAINS "miiwes.top/dl/buildz.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build2.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/buildz.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build2.exe" OR destinationntdomain CONTAINS "uaery.top/dl/buildz.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build2.exe" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe" OR destinationntdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationntdomain CONTAINS "spaceris.com/files/1/build3.exe" OR destinationntdomain CONTAINS "bihsy.com/files/1/build3.exe" OR destinationntdomain CONTAINS "ugll.org/files/1/build3.exe" OR destinationntdomain CONTAINS "oddsium.com/g76dbf" OR destinationntdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR requesturl CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR requesturl CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR requesturl CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR requesturl CONTAINS "miiwes.top/dl/buildz.exe" OR requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "rgyui.top/dl/build2.exe" OR requesturl CONTAINS "rgyui.top/dl/buildz.exe" OR requesturl CONTAINS "uaery.top/dl/build.exe" OR requesturl CONTAINS "uaery.top/dl/build2.exe" OR requesturl CONTAINS "uaery.top/dl/buildz.exe" OR requesturl CONTAINS "zerit.top/dl/build.exe" OR requesturl CONTAINS "zerit.top/dl/build2.exe" OR requesturl CONTAINS "zerit.top/dl/buildz.exe" OR requesturl CONTAINS "ex3mall.com/files/1/build3.exe" OR requesturl CONTAINS "spaceris.com/files/1/build3.exe" OR requesturl CONTAINS "bihsy.com/files/1/build3.exe" OR requesturl CONTAINS "ugll.org/files/1/build3.exe" OR requesturl CONTAINS "oddsium.com/g76dbf" OR requesturl CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR requesturl CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationhostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationhostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationhostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationhostname CONTAINS "miiwes.top/dl/buildz.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build2.exe" OR destinationhostname CONTAINS "rgyui.top/dl/buildz.exe" OR destinationhostname CONTAINS "uaery.top/dl/build.exe" OR destinationhostname CONTAINS "uaery.top/dl/build2.exe" OR destinationhostname CONTAINS "uaery.top/dl/buildz.exe" OR destinationhostname CONTAINS "zerit.top/dl/build.exe" OR destinationhostname CONTAINS "zerit.top/dl/build2.exe" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe" OR destinationhostname CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationhostname CONTAINS "spaceris.com/files/1/build3.exe" OR destinationhostname CONTAINS "bihsy.com/files/1/build3.exe" OR destinationhostname CONTAINS "ugll.org/files/1/build3.exe" OR destinationhostname CONTAINS "oddsium.com/g76dbf" OR destinationhostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcentdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcentdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcentdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcentdomain CONTAINS "miiwes.top/dl/buildz.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build2.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/buildz.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build2.exe" OR sourcentdomain CONTAINS "uaery.top/dl/buildz.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build2.exe" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe" OR sourcentdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcentdomain CONTAINS "spaceris.com/files/1/build3.exe" OR sourcentdomain CONTAINS "bihsy.com/files/1/build3.exe" OR sourcentdomain CONTAINS "ugll.org/files/1/build3.exe" OR sourcentdomain CONTAINS "oddsium.com/g76dbf" OR sourcentdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Unix / Linux / AIX" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcehostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcehostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcehostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcehostname CONTAINS "miiwes.top/dl/buildz.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build2.exe" OR sourcehostname CONTAINS "rgyui.top/dl/buildz.exe" OR sourcehostname CONTAINS "uaery.top/dl/build.exe" OR sourcehostname CONTAINS "uaery.top/dl/build2.exe" OR sourcehostname CONTAINS "uaery.top/dl/buildz.exe" OR sourcehostname CONTAINS "zerit.top/dl/build.exe" OR sourcehostname CONTAINS "zerit.top/dl/build2.exe" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe" OR sourcehostname CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcehostname CONTAINS "spaceris.com/files/1/build3.exe" OR sourcehostname CONTAINS "bihsy.com/files/1/build3.exe" OR sourcehostname CONTAINS "ugll.org/files/1/build3.exe" OR sourcehostname CONTAINS "oddsium.com/g76dbf" OR sourcehostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Unix / Linux / AIX" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationntdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationntdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationntdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationntdomain CONTAINS "miiwes.top/dl/buildz.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build2.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/buildz.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build2.exe" OR destinationntdomain CONTAINS "uaery.top/dl/buildz.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build2.exe" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe" OR destinationntdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationntdomain CONTAINS "spaceris.com/files/1/build3.exe" OR destinationntdomain CONTAINS "bihsy.com/files/1/build3.exe" OR destinationntdomain CONTAINS "ugll.org/files/1/build3.exe" OR destinationntdomain CONTAINS "oddsium.com/g76dbf" OR destinationntdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND (requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR requesturl CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR requesturl CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR requesturl CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR requesturl CONTAINS "miiwes.top/dl/buildz.exe" OR requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "rgyui.top/dl/build2.exe" OR requesturl CONTAINS "rgyui.top/dl/buildz.exe" OR requesturl CONTAINS "uaery.top/dl/build.exe" OR requesturl CONTAINS "uaery.top/dl/build2.exe" OR requesturl CONTAINS "uaery.top/dl/buildz.exe" OR requesturl CONTAINS "zerit.top/dl/build.exe" OR requesturl CONTAINS "zerit.top/dl/build2.exe" OR requesturl CONTAINS "zerit.top/dl/buildz.exe" OR requesturl CONTAINS "ex3mall.com/files/1/build3.exe" OR requesturl CONTAINS "spaceris.com/files/1/build3.exe" OR requesturl CONTAINS "bihsy.com/files/1/build3.exe" OR requesturl CONTAINS "ugll.org/files/1/build3.exe" OR requesturl CONTAINS "oddsium.com/g76dbf" OR requesturl CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR requesturl CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationhostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationhostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationhostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationhostname CONTAINS "miiwes.top/dl/buildz.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build2.exe" OR destinationhostname CONTAINS "rgyui.top/dl/buildz.exe" OR destinationhostname CONTAINS "uaery.top/dl/build.exe" OR destinationhostname CONTAINS "uaery.top/dl/build2.exe" OR destinationhostname CONTAINS "uaery.top/dl/buildz.exe" OR destinationhostname CONTAINS "zerit.top/dl/build.exe" OR destinationhostname CONTAINS "zerit.top/dl/build2.exe" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe" OR destinationhostname CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationhostname CONTAINS "spaceris.com/files/1/build3.exe" OR destinationhostname CONTAINS "bihsy.com/files/1/build3.exe" OR destinationhostname CONTAINS "ugll.org/files/1/build3.exe" OR destinationhostname CONTAINS "oddsium.com/g76dbf" OR destinationhostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcentdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcentdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcentdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcentdomain CONTAINS "miiwes.top/dl/buildz.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build2.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/buildz.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build2.exe" OR sourcentdomain CONTAINS "uaery.top/dl/buildz.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build2.exe" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe" OR sourcentdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcentdomain CONTAINS "spaceris.com/files/1/build3.exe" OR sourcentdomain CONTAINS "bihsy.com/files/1/build3.exe" OR sourcentdomain CONTAINS "ugll.org/files/1/build3.exe" OR sourcentdomain CONTAINS "oddsium.com/g76dbf" OR sourcentdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcehostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcehostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcehostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcehostname CONTAINS "miiwes.top/dl/buildz.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build2.exe" OR sourcehostname CONTAINS "rgyui.top/dl/buildz.exe" OR sourcehostname CONTAINS "uaery.top/dl/build.exe" OR sourcehostname CONTAINS "uaery.top/dl/build2.exe" OR sourcehostname CONTAINS "uaery.top/dl/buildz.exe" OR sourcehostname CONTAINS "zerit.top/dl/build.exe" OR sourcehostname CONTAINS "zerit.top/dl/build2.exe" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe" OR sourcehostname CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcehostname CONTAINS "spaceris.com/files/1/build3.exe" OR sourcehostname CONTAINS "bihsy.com/files/1/build3.exe" OR sourcehostname CONTAINS "ugll.org/files/1/build3.exe" OR sourcehostname CONTAINS "oddsium.com/g76dbf" OR sourcehostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationntdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationntdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationntdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationntdomain CONTAINS "miiwes.top/dl/buildz.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build2.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/buildz.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build2.exe" OR destinationntdomain CONTAINS "uaery.top/dl/buildz.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build2.exe" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe" OR destinationntdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationntdomain CONTAINS "spaceris.com/files/1/build3.exe" OR destinationntdomain CONTAINS "bihsy.com/files/1/build3.exe" OR destinationntdomain CONTAINS "ugll.org/files/1/build3.exe" OR destinationntdomain CONTAINS "oddsium.com/g76dbf" OR destinationntdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND (requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR requesturl CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR requesturl CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR requesturl CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR requesturl CONTAINS "miiwes.top/dl/buildz.exe" OR requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "rgyui.top/dl/build2.exe" OR requesturl CONTAINS "rgyui.top/dl/buildz.exe" OR requesturl CONTAINS "uaery.top/dl/build.exe" OR requesturl CONTAINS "uaery.top/dl/build2.exe" OR requesturl CONTAINS "uaery.top/dl/buildz.exe" OR requesturl CONTAINS "zerit.top/dl/build.exe" OR requesturl CONTAINS "zerit.top/dl/build2.exe" OR requesturl CONTAINS "zerit.top/dl/buildz.exe" OR requesturl CONTAINS "ex3mall.com/files/1/build3.exe" OR requesturl CONTAINS "spaceris.com/files/1/build3.exe" OR requesturl CONTAINS "bihsy.com/files/1/build3.exe" OR requesturl CONTAINS "ugll.org/files/1/build3.exe" OR requesturl CONTAINS "oddsium.com/g76dbf" OR requesturl CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR requesturl CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationhostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationhostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationhostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationhostname CONTAINS "miiwes.top/dl/buildz.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build2.exe" OR destinationhostname CONTAINS "rgyui.top/dl/buildz.exe" OR destinationhostname CONTAINS "uaery.top/dl/build.exe" OR destinationhostname CONTAINS "uaery.top/dl/build2.exe" OR destinationhostname CONTAINS "uaery.top/dl/buildz.exe" OR destinationhostname CONTAINS "zerit.top/dl/build.exe" OR destinationhostname CONTAINS "zerit.top/dl/build2.exe" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe" OR destinationhostname CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationhostname CONTAINS "spaceris.com/files/1/build3.exe" OR destinationhostname CONTAINS "bihsy.com/files/1/build3.exe" OR destinationhostname CONTAINS "ugll.org/files/1/build3.exe" OR destinationhostname CONTAINS "oddsium.com/g76dbf" OR destinationhostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcentdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcentdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcentdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcentdomain CONTAINS "miiwes.top/dl/buildz.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build2.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/buildz.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build2.exe" OR sourcentdomain CONTAINS "uaery.top/dl/buildz.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build2.exe" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe" OR sourcentdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcentdomain CONTAINS "spaceris.com/files/1/build3.exe" OR sourcentdomain CONTAINS "bihsy.com/files/1/build3.exe" OR sourcentdomain CONTAINS "ugll.org/files/1/build3.exe" OR sourcentdomain CONTAINS "oddsium.com/g76dbf" OR sourcentdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Application Security Broker" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcehostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcehostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcehostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcehostname CONTAINS "miiwes.top/dl/buildz.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build2.exe" OR sourcehostname CONTAINS "rgyui.top/dl/buildz.exe" OR sourcehostname CONTAINS "uaery.top/dl/build.exe" OR sourcehostname CONTAINS "uaery.top/dl/build2.exe" OR sourcehostname CONTAINS "uaery.top/dl/buildz.exe" OR sourcehostname CONTAINS "zerit.top/dl/build.exe" OR sourcehostname CONTAINS "zerit.top/dl/build2.exe" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe" OR sourcehostname CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcehostname CONTAINS "spaceris.com/files/1/build3.exe" OR sourcehostname CONTAINS "bihsy.com/files/1/build3.exe" OR sourcehostname CONTAINS "ugll.org/files/1/build3.exe" OR sourcehostname CONTAINS "oddsium.com/g76dbf" OR sourcehostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Application Security Broker" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationntdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationntdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationntdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationntdomain CONTAINS "miiwes.top/dl/buildz.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build2.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/buildz.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build2.exe" OR destinationntdomain CONTAINS "uaery.top/dl/buildz.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build2.exe" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe" OR destinationntdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationntdomain CONTAINS "spaceris.com/files/1/build3.exe" OR destinationntdomain CONTAINS "bihsy.com/files/1/build3.exe" OR destinationntdomain CONTAINS "ugll.org/files/1/build3.exe" OR destinationntdomain CONTAINS "oddsium.com/g76dbf" OR destinationntdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND (requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR requesturl CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR requesturl CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR requesturl CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR requesturl CONTAINS "miiwes.top/dl/buildz.exe" OR requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "rgyui.top/dl/build2.exe" OR requesturl CONTAINS "rgyui.top/dl/buildz.exe" OR requesturl CONTAINS "uaery.top/dl/build.exe" OR requesturl CONTAINS "uaery.top/dl/build2.exe" OR requesturl CONTAINS "uaery.top/dl/buildz.exe" OR requesturl CONTAINS "zerit.top/dl/build.exe" OR requesturl CONTAINS "zerit.top/dl/build2.exe" OR requesturl CONTAINS "zerit.top/dl/buildz.exe" OR requesturl CONTAINS "ex3mall.com/files/1/build3.exe" OR requesturl CONTAINS "spaceris.com/files/1/build3.exe" OR requesturl CONTAINS "bihsy.com/files/1/build3.exe" OR requesturl CONTAINS "ugll.org/files/1/build3.exe" OR requesturl CONTAINS "oddsium.com/g76dbf" OR requesturl CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR requesturl CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Source Code Repository" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationhostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationhostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationhostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationhostname CONTAINS "miiwes.top/dl/buildz.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build2.exe" OR destinationhostname CONTAINS "rgyui.top/dl/buildz.exe" OR destinationhostname CONTAINS "uaery.top/dl/build.exe" OR destinationhostname CONTAINS "uaery.top/dl/build2.exe" OR destinationhostname CONTAINS "uaery.top/dl/buildz.exe" OR destinationhostname CONTAINS "zerit.top/dl/build.exe" OR destinationhostname CONTAINS "zerit.top/dl/build2.exe" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe" OR destinationhostname CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationhostname CONTAINS "spaceris.com/files/1/build3.exe" OR destinationhostname CONTAINS "bihsy.com/files/1/build3.exe" OR destinationhostname CONTAINS "ugll.org/files/1/build3.exe" OR destinationhostname CONTAINS "oddsium.com/g76dbf" OR destinationhostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Source Code Repository" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcentdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcentdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcentdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcentdomain CONTAINS "miiwes.top/dl/buildz.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build2.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/buildz.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build2.exe" OR sourcentdomain CONTAINS "uaery.top/dl/buildz.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build2.exe" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe" OR sourcentdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcentdomain CONTAINS "spaceris.com/files/1/build3.exe" OR sourcentdomain CONTAINS "bihsy.com/files/1/build3.exe" OR sourcentdomain CONTAINS "ugll.org/files/1/build3.exe" OR sourcentdomain CONTAINS "oddsium.com/g76dbf" OR sourcentdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Source Code Repository" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcehostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcehostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcehostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcehostname CONTAINS "miiwes.top/dl/buildz.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build2.exe" OR sourcehostname CONTAINS "rgyui.top/dl/buildz.exe" OR sourcehostname CONTAINS "uaery.top/dl/build.exe" OR sourcehostname CONTAINS "uaery.top/dl/build2.exe" OR sourcehostname CONTAINS "uaery.top/dl/buildz.exe" OR sourcehostname CONTAINS "zerit.top/dl/build.exe" OR sourcehostname CONTAINS "zerit.top/dl/build2.exe" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe" OR sourcehostname CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcehostname CONTAINS "spaceris.com/files/1/build3.exe" OR sourcehostname CONTAINS "bihsy.com/files/1/build3.exe" OR sourcehostname CONTAINS "ugll.org/files/1/build3.exe" OR sourcehostname CONTAINS "oddsium.com/g76dbf" OR sourcehostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Source Code Repository" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationntdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationntdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationntdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationntdomain CONTAINS "miiwes.top/dl/buildz.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build2.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/buildz.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build2.exe" OR destinationntdomain CONTAINS "uaery.top/dl/buildz.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build2.exe" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe" OR destinationntdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationntdomain CONTAINS "spaceris.com/files/1/build3.exe" OR destinationntdomain CONTAINS "bihsy.com/files/1/build3.exe" OR destinationntdomain CONTAINS "ugll.org/files/1/build3.exe" OR destinationntdomain CONTAINS "oddsium.com/g76dbf" OR destinationntdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND (requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR requesturl CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR requesturl CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR requesturl CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR requesturl CONTAINS "miiwes.top/dl/buildz.exe" OR requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "rgyui.top/dl/build2.exe" OR requesturl CONTAINS "rgyui.top/dl/buildz.exe" OR requesturl CONTAINS "uaery.top/dl/build.exe" OR requesturl CONTAINS "uaery.top/dl/build2.exe" OR requesturl CONTAINS "uaery.top/dl/buildz.exe" OR requesturl CONTAINS "zerit.top/dl/build.exe" OR requesturl CONTAINS "zerit.top/dl/build2.exe" OR requesturl CONTAINS "zerit.top/dl/buildz.exe" OR requesturl CONTAINS "ex3mall.com/files/1/build3.exe" OR requesturl CONTAINS "spaceris.com/files/1/build3.exe" OR requesturl CONTAINS "bihsy.com/files/1/build3.exe" OR requesturl CONTAINS "ugll.org/files/1/build3.exe" OR requesturl CONTAINS "oddsium.com/g76dbf" OR requesturl CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR requesturl CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationhostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationhostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationhostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationhostname CONTAINS "miiwes.top/dl/buildz.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build2.exe" OR destinationhostname CONTAINS "rgyui.top/dl/buildz.exe" OR destinationhostname CONTAINS "uaery.top/dl/build.exe" OR destinationhostname CONTAINS "uaery.top/dl/build2.exe" OR destinationhostname CONTAINS "uaery.top/dl/buildz.exe" OR destinationhostname CONTAINS "zerit.top/dl/build.exe" OR destinationhostname CONTAINS "zerit.top/dl/build2.exe" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe" OR destinationhostname CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationhostname CONTAINS "spaceris.com/files/1/build3.exe" OR destinationhostname CONTAINS "bihsy.com/files/1/build3.exe" OR destinationhostname CONTAINS "ugll.org/files/1/build3.exe" OR destinationhostname CONTAINS "oddsium.com/g76dbf" OR destinationhostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcentdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcentdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcentdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcentdomain CONTAINS "miiwes.top/dl/buildz.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build2.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/buildz.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build2.exe" OR sourcentdomain CONTAINS "uaery.top/dl/buildz.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build2.exe" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe" OR sourcentdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcentdomain CONTAINS "spaceris.com/files/1/build3.exe" OR sourcentdomain CONTAINS "bihsy.com/files/1/build3.exe" OR sourcentdomain CONTAINS "ugll.org/files/1/build3.exe" OR sourcentdomain CONTAINS "oddsium.com/g76dbf" OR sourcentdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcehostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcehostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcehostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcehostname CONTAINS "miiwes.top/dl/buildz.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build2.exe" OR sourcehostname CONTAINS "rgyui.top/dl/buildz.exe" OR sourcehostname CONTAINS "uaery.top/dl/build.exe" OR sourcehostname CONTAINS "uaery.top/dl/build2.exe" OR sourcehostname CONTAINS "uaery.top/dl/buildz.exe" OR sourcehostname CONTAINS "zerit.top/dl/build.exe" OR sourcehostname CONTAINS "zerit.top/dl/build2.exe" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe" OR sourcehostname CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcehostname CONTAINS "spaceris.com/files/1/build3.exe" OR sourcehostname CONTAINS "bihsy.com/files/1/build3.exe" OR sourcehostname CONTAINS "ugll.org/files/1/build3.exe" OR sourcehostname CONTAINS "oddsium.com/g76dbf" OR sourcehostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationntdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationntdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationntdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationntdomain CONTAINS "miiwes.top/dl/buildz.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build2.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/buildz.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build2.exe" OR destinationntdomain CONTAINS "uaery.top/dl/buildz.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build2.exe" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe" OR destinationntdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationntdomain CONTAINS "spaceris.com/files/1/build3.exe" OR destinationntdomain CONTAINS "bihsy.com/files/1/build3.exe" OR destinationntdomain CONTAINS "ugll.org/files/1/build3.exe" OR destinationntdomain CONTAINS "oddsium.com/g76dbf" OR destinationntdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND (requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR requesturl CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR requesturl CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR requesturl CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR requesturl CONTAINS "miiwes.top/dl/buildz.exe" OR requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "rgyui.top/dl/build2.exe" OR requesturl CONTAINS "rgyui.top/dl/buildz.exe" OR requesturl CONTAINS "uaery.top/dl/build.exe" OR requesturl CONTAINS "uaery.top/dl/build2.exe" OR requesturl CONTAINS "uaery.top/dl/buildz.exe" OR requesturl CONTAINS "zerit.top/dl/build.exe" OR requesturl CONTAINS "zerit.top/dl/build2.exe" OR requesturl CONTAINS "zerit.top/dl/buildz.exe" OR requesturl CONTAINS "ex3mall.com/files/1/build3.exe" OR requesturl CONTAINS "spaceris.com/files/1/build3.exe" OR requesturl CONTAINS "bihsy.com/files/1/build3.exe" OR requesturl CONTAINS "ugll.org/files/1/build3.exe" OR requesturl CONTAINS "oddsium.com/g76dbf" OR requesturl CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR requesturl CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="DNS / DHCP" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationhostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationhostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationhostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationhostname CONTAINS "miiwes.top/dl/buildz.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build2.exe" OR destinationhostname CONTAINS "rgyui.top/dl/buildz.exe" OR destinationhostname CONTAINS "uaery.top/dl/build.exe" OR destinationhostname CONTAINS "uaery.top/dl/build2.exe" OR destinationhostname CONTAINS "uaery.top/dl/buildz.exe" OR destinationhostname CONTAINS "zerit.top/dl/build.exe" OR destinationhostname CONTAINS "zerit.top/dl/build2.exe" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe" OR destinationhostname CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationhostname CONTAINS "spaceris.com/files/1/build3.exe" OR destinationhostname CONTAINS "bihsy.com/files/1/build3.exe" OR destinationhostname CONTAINS "ugll.org/files/1/build3.exe" OR destinationhostname CONTAINS "oddsium.com/g76dbf" OR destinationhostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="DNS / DHCP" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcentdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcentdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcentdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcentdomain CONTAINS "miiwes.top/dl/buildz.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build2.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/buildz.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build2.exe" OR sourcentdomain CONTAINS "uaery.top/dl/buildz.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build2.exe" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe" OR sourcentdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcentdomain CONTAINS "spaceris.com/files/1/build3.exe" OR sourcentdomain CONTAINS "bihsy.com/files/1/build3.exe" OR sourcentdomain CONTAINS "ugll.org/files/1/build3.exe" OR sourcentdomain CONTAINS "oddsium.com/g76dbf" OR sourcentdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="DNS / DHCP" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcehostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcehostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcehostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcehostname CONTAINS "miiwes.top/dl/buildz.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build2.exe" OR sourcehostname CONTAINS "rgyui.top/dl/buildz.exe" OR sourcehostname CONTAINS "uaery.top/dl/build.exe" OR sourcehostname CONTAINS "uaery.top/dl/build2.exe" OR sourcehostname CONTAINS "uaery.top/dl/buildz.exe" OR sourcehostname CONTAINS "zerit.top/dl/build.exe" OR sourcehostname CONTAINS "zerit.top/dl/build2.exe" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe" OR sourcehostname CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcehostname CONTAINS "spaceris.com/files/1/build3.exe" OR sourcehostname CONTAINS "bihsy.com/files/1/build3.exe" OR sourcehostname CONTAINS "ugll.org/files/1/build3.exe" OR sourcehostname CONTAINS "oddsium.com/g76dbf" OR sourcehostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="DNS / DHCP" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationntdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationntdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationntdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationntdomain CONTAINS "miiwes.top/dl/buildz.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build2.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/buildz.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build2.exe" OR destinationntdomain CONTAINS "uaery.top/dl/buildz.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build2.exe" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe" OR destinationntdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationntdomain CONTAINS "spaceris.com/files/1/build3.exe" OR destinationntdomain CONTAINS "bihsy.com/files/1/build3.exe" OR destinationntdomain CONTAINS "ugll.org/files/1/build3.exe" OR destinationntdomain CONTAINS "oddsium.com/g76dbf" OR destinationntdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND (requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR requesturl CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR requesturl CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR requesturl CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR requesturl CONTAINS "miiwes.top/dl/buildz.exe" OR requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "rgyui.top/dl/build2.exe" OR requesturl CONTAINS "rgyui.top/dl/buildz.exe" OR requesturl CONTAINS "uaery.top/dl/build.exe" OR requesturl CONTAINS "uaery.top/dl/build2.exe" OR requesturl CONTAINS "uaery.top/dl/buildz.exe" OR requesturl CONTAINS "zerit.top/dl/build.exe" OR requesturl CONTAINS "zerit.top/dl/build2.exe" OR requesturl CONTAINS "zerit.top/dl/buildz.exe" OR requesturl CONTAINS "ex3mall.com/files/1/build3.exe" OR requesturl CONTAINS "spaceris.com/files/1/build3.exe" OR requesturl CONTAINS "bihsy.com/files/1/build3.exe" OR requesturl CONTAINS "ugll.org/files/1/build3.exe" OR requesturl CONTAINS "oddsium.com/g76dbf" OR requesturl CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR requesturl CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationhostname NOT NULL AND (destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationhostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationhostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationhostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationhostname CONTAINS "miiwes.top/dl/buildz.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build.exe" OR destinationhostname CONTAINS "rgyui.top/dl/build2.exe" OR destinationhostname CONTAINS "rgyui.top/dl/buildz.exe" OR destinationhostname CONTAINS "uaery.top/dl/build.exe" OR destinationhostname CONTAINS "uaery.top/dl/build2.exe" OR destinationhostname CONTAINS "uaery.top/dl/buildz.exe" OR destinationhostname CONTAINS "zerit.top/dl/build.exe" OR destinationhostname CONTAINS "zerit.top/dl/build2.exe" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe" OR destinationhostname CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationhostname CONTAINS "spaceris.com/files/1/build3.exe" OR destinationhostname CONTAINS "bihsy.com/files/1/build3.exe" OR destinationhostname CONTAINS "ugll.org/files/1/build3.exe" OR destinationhostname CONTAINS "oddsium.com/g76dbf" OR destinationhostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationhostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcentdomain NOT NULL AND (sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcentdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcentdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcentdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcentdomain CONTAINS "miiwes.top/dl/buildz.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/build2.exe" OR sourcentdomain CONTAINS "rgyui.top/dl/buildz.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build.exe" OR sourcentdomain CONTAINS "uaery.top/dl/build2.exe" OR sourcentdomain CONTAINS "uaery.top/dl/buildz.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build.exe" OR sourcentdomain CONTAINS "zerit.top/dl/build2.exe" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe" OR sourcentdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcentdomain CONTAINS "spaceris.com/files/1/build3.exe" OR sourcentdomain CONTAINS "bihsy.com/files/1/build3.exe" OR sourcentdomain CONTAINS "ugll.org/files/1/build3.exe" OR sourcentdomain CONTAINS "oddsium.com/g76dbf" OR sourcentdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcentdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND sourcehostname NOT NULL AND (sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR sourcehostname CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR sourcehostname CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR sourcehostname CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR sourcehostname CONTAINS "miiwes.top/dl/buildz.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build.exe" OR sourcehostname CONTAINS "rgyui.top/dl/build2.exe" OR sourcehostname CONTAINS "rgyui.top/dl/buildz.exe" OR sourcehostname CONTAINS "uaery.top/dl/build.exe" OR sourcehostname CONTAINS "uaery.top/dl/build2.exe" OR sourcehostname CONTAINS "uaery.top/dl/buildz.exe" OR sourcehostname CONTAINS "zerit.top/dl/build.exe" OR sourcehostname CONTAINS "zerit.top/dl/build2.exe" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe" OR sourcehostname CONTAINS "ex3mall.com/files/1/build3.exe" OR sourcehostname CONTAINS "spaceris.com/files/1/build3.exe" OR sourcehostname CONTAINS "bihsy.com/files/1/build3.exe" OR sourcehostname CONTAINS "ugll.org/files/1/build3.exe" OR sourcehostname CONTAINS "oddsium.com/g76dbf" OR sourcehostname CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR sourcehostname CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND destinationntdomain NOT NULL AND (destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR destinationntdomain CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR destinationntdomain CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR destinationntdomain CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR destinationntdomain CONTAINS "miiwes.top/dl/buildz.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/build2.exe" OR destinationntdomain CONTAINS "rgyui.top/dl/buildz.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build.exe" OR destinationntdomain CONTAINS "uaery.top/dl/build2.exe" OR destinationntdomain CONTAINS "uaery.top/dl/buildz.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build.exe" OR destinationntdomain CONTAINS "zerit.top/dl/build2.exe" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe" OR destinationntdomain CONTAINS "ex3mall.com/files/1/build3.exe" OR destinationntdomain CONTAINS "spaceris.com/files/1/build3.exe" OR destinationntdomain CONTAINS "bihsy.com/files/1/build3.exe" OR destinationntdomain CONTAINS "ugll.org/files/1/build3.exe" OR destinationntdomain CONTAINS "oddsium.com/g76dbf" OR destinationntdomain CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR destinationntdomain CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND (requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "s25.stazeni.ua.rs/download/ill2a7r2hsyufadaluvhv71xuuhubneg" OR requesturl CONTAINS "s30.stazeni.ua.rs/download/p1rcwy69oe09csyefqj4j9fmhmx1hamq" OR requesturl CONTAINS "s24.stazeni.ua.rs/download/5pg08rc9pxvy743ncrn30d2zylf2l12a" OR requesturl CONTAINS "s20.stazeni.ua.rs/download/z2guqagslno4pb06hnpuy1ocf7wstfxf" OR requesturl CONTAINS "miiwes.top/dl/buildz.exe" OR requesturl CONTAINS "rgyui.top/dl/build.exe" OR requesturl CONTAINS "rgyui.top/dl/build2.exe" OR requesturl CONTAINS "rgyui.top/dl/buildz.exe" OR requesturl CONTAINS "uaery.top/dl/build.exe" OR requesturl CONTAINS "uaery.top/dl/build2.exe" OR requesturl CONTAINS "uaery.top/dl/buildz.exe" OR requesturl CONTAINS "zerit.top/dl/build.exe" OR requesturl CONTAINS "zerit.top/dl/build2.exe" OR requesturl CONTAINS "zerit.top/dl/buildz.exe" OR requesturl CONTAINS "ex3mall.com/files/1/build3.exe" OR requesturl CONTAINS "spaceris.com/files/1/build3.exe" OR requesturl CONTAINS "bihsy.com/files/1/build3.exe" OR requesturl CONTAINS "ugll.org/files/1/build3.exe" OR requesturl CONTAINS "oddsium.com/g76dbf" OR requesturl CONTAINS "clicktoevent.com/g76dbf?lrebib=kvqqhaohs" OR requesturl CONTAINS "zerit.top/dl/buildz.exe")
index=activity AND rg_functionality="Next Generation Firewall" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Next Generation Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Firewall" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Firewall" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Web Proxy" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Web Proxy" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Web Proxy" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Flow" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Flow" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Flow" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Web Server" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Web Server" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Web Server" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Web Application Firewall" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Web Application Firewall" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Web Application Firewall" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Endpoint management systems" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Endpoint management systems" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Endpoint management systems" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Application Audit" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Application Audit" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Unix / Linux / AIX" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Unix / Linux / AIX" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Application Security Broker" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Application Security Broker" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Source Code Repository" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Source Code Repository" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Source Code Repository" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="DNS / DHCP" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="DNS / DHCP" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="DNS / DHCP" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Endpoint Management Systems" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Endpoint Management Systems" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Email / Email Security" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND filehash NOT NULL AND filehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND oldfilehash NOT NULL AND oldfilehash IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring64 NOT NULL AND customstring64 IN ("647b12dd3809b62d8b051ec643a1c5d26c32ec3397266c76e6f58e3894e39c4b","08c524509178aa6a93de9861790804266289fbed704af269f3c4ddde75518b15","d1ad11b98dd193b107731349a596558c6505e51e9b2e7195521e81b20482948d","87102e5614509da4c59b134861130708f239b68d1e062d08d1e71464c8041326","0708d5027c26f96f5bf81b373348346149511a4b9f11391a979159185371bcc5","9921cc50e6272053814c7fe2ab5ae566a9deaebc9c0412c8b518313eee65d9d9","d05a67845680af53a1efe0d852aa7ab85ad97e76cc8aaa62b1aad70288665026","4e1f743b60d65732d43e6a8c064016369a2cb6d03e81e04e114ed6a31297a2a7","168d41799cdb359a86c7e28e4b3eee3494270ec6e2884452dd61134b627b1c68","8a56cecfe36b7c105401fd246f8f3ba97bdc4d1db776eaa4991fcedf8aaaaa52","ff6d6f616687fac25a1d77e52024838239e9a3bbb7b79559b0439a968ac384fe","ba8533bd8118ec6881e25e4af2e2101996b4a9aef3f1f1931423bff03da0ace5")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Next Generation Firewall" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Next Generation Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Firewall" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Firewall" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Proxy" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Proxy" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Flow" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Flow" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Server" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Server" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Endpoint management systems" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Endpoint management systems" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Endpoint management systems" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Endpoint management systems" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Application Audit" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Application Audit" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Application Audit" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Application Audit" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Unix / Linux / AIX" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Unix / Linux / AIX" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Unix / Linux / AIX" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Unix / Linux / AIX" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Source Code Repository" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Source Code Repository" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="DNS / DHCP" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="DNS / DHCP" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="DNS / DHCP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="DNS / DHCP" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Endpoint Management Systems" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Endpoint Management Systems" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Endpoint Management Systems" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Endpoint Management Systems" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Antivirus / Malware / EDR" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Network DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Proxy" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Proxy" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Proxy" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Proxy" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Next Generation Firewall" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Next Generation Firewall" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Next Generation Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Next Generation Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Flow" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Flow" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Flow" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Flow" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Server" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Server" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Server" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Server" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Email / Email Security" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Email / Email Security" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="IDS / IPS / UTM / Threat Detection" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Authentication / SSO / Single Sign-On" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Application Security Broker" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Application Security Broker" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Application Security Broker" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Source Code Repository" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Source Code Repository" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Source Code Repository" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Source Code Repository" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Authentication / VPN" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Authentication / VPN" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Authentication / VPN" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Authentication / VPN" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Content Management System" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Content Management System" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Content Management System" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Content Management System" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Services / Applications" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Services / Applications" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Services / Applications" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Cloud Services / Applications" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Data Loss Prevention / Endpoint DLP" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Application Firewall" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Application Firewall" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Application Firewall" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Web Application Firewall" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND requesturl NOT NULL AND requesturl IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Message NOT NULL AND Message IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND Requestcontext NOT NULL AND Requestcontext IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
index=activity AND rg_functionality="Firewall / NGFW / WAF" AND customstring3 NOT NULL AND customstring3 IN ("http://veterinary-surgeons.net/g76dbf?grpvldcmq=pnstptslwh","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe","https://coin-coin-coin-2.com/downloads/toolspab2.exe","https://coin-coin-coin-2.com/downloads/toolspab4.exe","https://data-host-file-16.com/downloads/toolspab2.exe","https://host-coin-data-1.com/downloads/toolspab1.exe","https://privacy-tools-for-you-453.com/downloads/toolspab4.exe","https://privacy-tools-for-you-780.com/downloads/toolspab3.exe")
